Security Insights
Deep dives, expert analysis, and practical guidance on exposure management, adversarial validation, and the future of AI-driven exposure management.
PHP2Shell (CVE-2026-109618 & CVE-2026-109619): Leaked PHP Flaws and What to Do Now
PHP2Shell: two leaked critical PHP RCE flaws, CVE-2026-109618 and CVE-2026-109619, rated CVSS 9.2. What's confirmed, which PHP versions get the fix, and what to do before and after the October 21 patch.
Top CVEs of September 2026: Four Zero-Days, and Patching Wasn’t the Fix
Four of September 2026’s top five CVEs were exploited before a patch existed. Fix order, fixed builds, and the compromise check each one needs.
Top CVEs of August 2026
August's CVSS 7.0 was a Lazarus zero-day exploited for five weeks. Its CVSS 10.0 needed no patch at all. The top CVEs of August 2026, ranked by exploitation evidence rather than severity, with remediation steps for all five.
Top CVEs of July 2026
Five CVEs defined July 2026, ranked by what attackers actually exploited, not CVSS: an AD FS zero-day, twin SharePoint RCEs, a May patch that became a July KEV deadline, and the month's highest score that nobody touched.
Top CVEs of June 2026: 5 Critical Flaws to Patch Now
Five CVEs defined June 2026: Check Point VPN bypass, Splunk pre-auth RCE, Windows HTTP.sys kernel RCE, LiteLLM AI-gateway RCE, and Defender BlueHammer. How to fix each.
Top CVEs of May 2026: 5 Critical Flaws to Patch Now
Five CVEs dominated May 2026: cPanel's two-month zero-day, Linux's stealth kernel priv-esc, Langflow exploited 20 hours after disclosure, n8n's perfect-10 RCE chain, and Microsoft's SSO bypass. Here's what happened and what to do.
Black-Box Agentic Scanners: Strengths and Their Ceiling
Black box agentic pentesting finds real CVEs fast and proves them, but where does it hit a ceiling? An honest, category-level verdict.
Top 7 Critical CVEs of April 2026 You Need to Act On Now
The top CVEs of April 2026 were exploited in hours. Marimo RCE, Windows IKE, Fortinet EMS, GitHub GHES, ActiveMQ, and more. Attack scenarios, risk context, and fixes.
NIST Just Changed How It Tracks and Prioritizes CVEs
NIST has changed how it enriches CVEs in the NVD. Learn what the new risk-based triage model means for your vulnerability management program, scanner data, and remediation workflows.
Top 10 Exposure Management Platforms That Truly Reduce Risks
If you’ve owned security outcomes for any length of time, the shift is clear. Counting CVEs no longer tells you whether risk is actually going down. Attack surfaces expand continuously, change faster than teams can track, and traditional scanners struggle to show what attackers are actually exploiti
Top CVEs of December 2025
December 2025 was a brutal reality check for security teams. While most were winding down for the holidays, threat actors weaponized a tectonic shift in the landscape, headlined by the "React2Shell" exploit. From mass web server takeovers to unauthenticated mail server compromises, the Top CVEs of D
Top CVEs of November 2025
Security teams barely got a break in November. High-severity alerts kept popping up, ranging from active Windows kernel exploits to urgent cloud infrastructure flaws. With so many patches releasing at once, identifying the most dangerous threats is essential for protecting your network. The followin