Security Insights
Deep dives, expert analysis, and practical guidance on exposure management, adversarial validation, and the future of AI-driven exposure management.
PHP2Shell (CVE-2026-109618 & CVE-2026-109619): Leaked PHP Flaws and What to Do Now
PHP2Shell: two leaked critical PHP RCE flaws, CVE-2026-109618 and CVE-2026-109619, rated CVSS 9.2. What's confirmed, which PHP versions get the fix, and what to do before and after the October 21 patch.
Why your annual penetration test is already obsolete
Your annual pentest describes an environment that no longer exists. Here is how continuous offensive security testing closes the gap, and what it takes to run one.
Top CVEs of August 2026
August's CVSS 7.0 was a Lazarus zero-day exploited for five weeks. Its CVSS 10.0 needed no patch at all. The top CVEs of August 2026, ranked by exploitation evidence rather than severity, with remediation steps for all five.
How to Achieve Cheaper, Faster and Accurate Pentests
Cheaper, faster and accurate pentests were never a real tradeoff. Context removes it: one graph of assets, code and cloud that every engagement reads from and writes back to.
Tooling as Code and Structured Scratchpads
The two changes that moved our AI security agents furthest this year had nothing to do with the model. Here is how tooling as code and structured scratchpads reshaped how the agents act, and how they prove a finding is real.
How Agentic Pentesting Separates Test Failures From Real Security Findings
Agentic pentesting reliability on unstable apps: a six-state failure taxonomy, safe retry rules, and what a trustworthy pentest report must disclose.
Bug Bounty vs. Pentesting vs. AI Pentesting: Which Model Fits Your AppSec Program?
Bug bounty vs pentesting vs AI pentesting: compare costs, coverage, compliance, and when to use each model. Build a layered AppSec testing strategy.
Continuous Application Pentesting for DevSecOps Teams
How DevSecOps teams integrate continuous application pentesting into CI/CD pipelines. AI-driven testing, run-over-run diffing, and developer workflow integration.
Why AI-Generated Exploit Code Must Run in Isolation
Agent-written exploit code is the new RCE vector aimed at the tester. Here's why per-task isolation and egress control are non-negotiable.
ISO 27001 Penetration Testing Requirements
ISO 27001:2022 never names penetration testing, yet it is how you evidence Annex A 8.8 and 8.29 at a surveillance audit. The honest read on required vs expected, with the 2013 lineage and the Oct 2025 deadline.
PCI DSS Penetration Testing Requirements
PCI DSS v4.0.1 Requirement 11.4 is the rare standard that names penetration testing outright: internal and external annually plus after change, segmentation at 12 or 6 months, mandatory since 31 Mar 2025.
Top 10 Data Breaches of April 2026
The biggest data breaches of April 2026 ranked and analyzed, from Checkmarx supply chain poisoning to Salesforce misconfigurations and ransomware hitting two major US banks.