No zero day exploit, no phishing. Just a trust decision nobody made on purpose, and how to close the same gap in your own pipelines.

A practitioner’s walk through SAST, DAST, manual pentesting and the OWASP checklist, and how to layer them so gaps don’t line up.

GitLab Patches a Maximum-Severity Flaw GitLab has fixed a critical vulnerability that, under certain conditions, lets attackers run arbitrary code on a server. They need no password and no user in…

How a missing RBAC policy check exposed security actions and resources to low-privileged users.

A technical walkthrough of the open-source, code-aware AI pentester — its agent architecture, its “no exploit, no report” philosophy, how…

GitHub Tightens npm Trusted Publishing Rules GitHub has changed the rules for npm trusted publishing. A new configuration that does not complete its first successful publish within 48 hours will n…

Technical debt is often discussed as an engineering problem. Outdated software, temporary workarounds, inconsistent configurations, and…

If you are attacking web targets on platforms like Hack The Box (HTB) or navigating OffSec lab environments, running a headless Docker…

I recently listened to a discussion between James Berthoty and Chris Romeo about AI pentesting and whether traditional DAST is basically…

Ten risks. Clear owners. Verifiable controls. A practical 90-day plan for making application security part of software delivery.

Open any modern web application in your browser, right-click the page, and view the raw HTML source. Scroll past the meta tags and…

TL;DR On October 19, 2026, an attacker replaced official OVHcloud CLI release files on GitHub with a build that steals secrets from disk. A customer spotted the OVHcloud CLI attack when a checksum…

FortProof is a free, open-source engine that judges every security control from evidence of what actually ran, never from what was…

Can a single unpatched web page bring down a company’s customer trust overnight? In 2015, UK telecom provider TalkTalk found out the hard…

I ran Snyk, Semgrep, Drogonsec and Claude Code on 39 planted bugs. The answer was more interesting than yes or no

A senior-level field briefing on CVE-2026–110264: how an unauthenticated attacker runs code on your GitLab server by uploading a text file…

Picture an organization with a WAF, a valid TLS certificate and a yearly penetration test that still finds its customer data on a public…

PHP2Shell isn’t a WordPress bug or a Drupal bug — it’s in PHP itself, and a “Hello World” app running on an affected version is vulnerable…

A security scanner can tell you that something looks suspicious.

Why understanding exposure requires more than periodic scans — and why discovery without reconciliation is only half the story.