Security Insights
Deep dives, expert analysis, and practical guidance on exposure management, adversarial validation, and the future of AI-driven exposure management.
PHP2Shell (CVE-2026-109618 & CVE-2026-109619): Leaked PHP Flaws and What to Do Now
PHP2Shell: two leaked critical PHP RCE flaws, CVE-2026-109618 and CVE-2026-109619, rated CVSS 9.2. What's confirmed, which PHP versions get the fix, and what to do before and after the October 21 patch.
Top CVEs of June 2026: 5 Critical Flaws to Patch Now
Five CVEs defined June 2026: Check Point VPN bypass, Splunk pre-auth RCE, Windows HTTP.sys kernel RCE, LiteLLM AI-gateway RCE, and Defender BlueHammer. How to fix each.
Top CVEs of May 2026: 5 Critical Flaws to Patch Now
Five CVEs dominated May 2026: cPanel's two-month zero-day, Linux's stealth kernel priv-esc, Langflow exploited 20 hours after disclosure, n8n's perfect-10 RCE chain, and Microsoft's SSO bypass. Here's what happened and what to do.
5 Vulnerabilities in Every Vibe-Coded App
The 5 security flaws AI coding assistants ship by default: missing authz, leaked secrets, weak JWTs, IDOR, eval RCE — with detection queries and fixes for each.
A Poisoned PyPI Package Quietly Hit 36 Percent of Cloud Environments Through LiteLLM
LiteLLM 1.82.7 and 1.82.8 silently swept AWS credentials, Kubernetes configs, and SSH keys from 3.4 million daily installs. Here is exactly what the payload did and how Strobes AI detects and shuts it down.
Threat Modeling Explained: STRIDE and Methodology
Threat modeling finds design flaws on a whiteboard, before code exists. A worked STRIDE pass on a login system, attack trees, and why DREAD lost favor.
Top CVEs of November 2025
Security teams barely got a break in November. High-severity alerts kept popping up, ranging from active Windows kernel exploits to urgent cloud infrastructure flaws. With so many patches releasing at once, identifying the most dangerous threats is essential for protecting your network. The followin
Top CVEs & Vulnerabilities of September 2025
CVEs & Vulnerabilities of September 2025 reveal a wave of high-impact flaws that security teams cannot afford to ignore. From unauthenticated exploits in FreePBX to privilege escalation in Android and root-level risks in Cisco firewalls, attackers are moving fast to weaponize these weaknesses. This
Top CVEs & Vulnerabilities of August 2025- Risks, Impacts & Fixes
August 2025 saw critical CVEs surface, including high-impact flaws in WinRAR and Microsoft SharePoint. This blog highlights the most urgent vulnerabilities, their potential business risks, and the patch actions security teams should prioritize to stay ahead of threats.
Cloud Security Posture Checklist for 2026
A 2026 cloud security posture checklist grouped by IAM, Storage, Network, Logging, and Encryption, with provider-specific controls for AWS, Azure, and GCP, real scanner output, and the gap a green dashboard hides.
How to Tame Your Multi-Cloud Attack Surface with Pentesting
Let’s face it most organizations aren’t using just one cloud provider anymore. Maybe your dev team loves AWS. Your analytics team prefers GCP. And someone else decided Azure was better for access controls. The result? A multi-cloud setup that’s great for flexibility but a nightmare for security and
AWS Penetration Testing: Rules, Scope, and Methodology
AWS penetration testing from first principles: the eight permitted services, the IMDSv2 SSRF pivot with real output, S3 and IAM privilege escalation, a sample findings table, and the config that actually closes the gaps.