https://strobes.co/blog Insights on cybersecurity, vulnerability management, CTEM, and exposure management from the Strobes Security team. en-us Thu, 22 Oct 2026 15:11:44 GMT https://strobes.co/blog/introducing-red-loop-continuous-proven-attack-surface-testing https://strobes.co/blog/introducing-red-loop-continuous-proven-attack-surface-testing Red Loop brings continuous offensive testing to Strobes Attack Surface Management. It discovers what you own, scans it the same way every time, and sends results to AI agents that attack and validate them. Only proven findings reach your queue. Thu, 22 Oct 2026 06:00:00 GMT Akhil Reni https://strobes.co/blog/php2shell-cve-2026-109618-cve-2026-109619 https://strobes.co/blog/php2shell-cve-2026-109618-cve-2026-109619 PHP2Shell: two leaked critical PHP RCE flaws, CVE-2026-109618 and CVE-2026-109619, rated CVSS 9.2. What's confirmed, which PHP versions get the fix, and what to do before and after the October 21 patch. Wed, 21 Oct 2026 10:10:00 GMT Shubham Jha https://strobes.co/blog/ciso-board-reporting-security-evidence https://strobes.co/blog/ciso-board-reporting-security-evidence Boards now ask for evidence that cyber risk is within appetite. What board-ready security evidence looks like, how to govern autonomous testing, and how to get it into your 2027 plan. Thu, 08 Oct 2026 10:00:00 GMT Venu Rao https://strobes.co/blog/continuous-offensive-security-testing https://strobes.co/blog/continuous-offensive-security-testing Your annual pentest describes an environment that no longer exists. Here is how continuous offensive security testing closes the gap, and what it takes to run one. Wed, 07 Oct 2026 00:00:00 GMT Shubham Jha https://strobes.co/blog/biggest-data-breaches-september-2026 https://strobes.co/blog/biggest-data-breaches-september-2026 153 million driver's licenses claimed, 23.6 million Gyazo records confirmed. September 2026's biggest breaches, with every number sourced. Tue, 06 Oct 2026 00:00:00 GMT Shubham Jha https://strobes.co/blog/agentic-pentesting-android-app-testing https://strobes.co/blog/agentic-pentesting-android-app-testing Strobes Agentic Pentesting now runs Android app pentesting on your own phones and emulators: live crawling, traffic interception, Frida instrumentation, and verified findings. Tue, 06 Oct 2026 00:00:00 GMT Shubham Jha https://strobes.co/blog/top-cves-september-2026 https://strobes.co/blog/top-cves-september-2026 Four of September 2026’s top five CVEs were exploited before a patch existed. Fix order, fixed builds, and the compromise check each one needs. Mon, 05 Oct 2026 00:00:00 GMT Shubham Jha https://strobes.co/blog/openai-daybreak-trusted-access-strobes https://strobes.co/blog/openai-daybreak-trusted-access-strobes OpenAI gates its cyber models behind an application, identity checks, and workspace scoping. Strobes is now verified for Daybreak. Mon, 28 Sep 2026 14:32:27 GMT Shubham Jha https://strobes.co/blog/agentic-pentesting-data-security https://strobes.co/blog/agentic-pentesting-data-security Session tokens, customer records, error traces. Here's exactly where that data goes during an agentic pentest, and what to ask any vendor. Thu, 24 Sep 2026 00:00:00 GMT Shubham Jha https://strobes.co/blog/anthropic-cyber-verification-program-strobes https://strobes.co/blog/anthropic-cyber-verification-program-strobes Strobes has run Claude-powered agentic pentests under Anthropic's Cyber Verification Program since June 2026. Here's what the program gates and what changed in three months. Mon, 21 Sep 2026 00:00:00 GMT Akhil Reni https://strobes.co/blog/are-security-practitioners-ready-for-autonomous-pentesting https://strobes.co/blog/are-security-practitioners-ready-for-autonomous-pentesting We asked 50+ security leaders one open question about autonomous pentesting. Here is the readiness spectrum that came back, and what vendors get wrong. Thu, 10 Sep 2026 00:00:00 GMT Venu Rao https://strobes.co/blog/nist-sp-1353-ai-prompts-csf-2-0 https://strobes.co/blog/nist-sp-1353-ai-prompts-csf-2-0 NIST's draft SP 1353 provides AI prompts for three CSF 2.0 tasks and says weeks of drafting compresses into hours. Here is what the prompts can draft, what only humans can validate, and the four things to settle before anyone opens a model. Fri, 04 Sep 2026 00:00:00 GMT Venu Rao https://strobes.co/blog/top-cves-august-2026 https://strobes.co/blog/top-cves-august-2026 August's CVSS 7.0 was a Lazarus zero-day exploited for five weeks. Its CVSS 10.0 needed no patch at all. The top CVEs of August 2026, ranked by exploitation evidence rather than severity, with remediation steps for all five. Thu, 03 Sep 2026 00:00:00 GMT Shubham Jha https://strobes.co/blog/biggest-data-breaches-august-2026 https://strobes.co/blog/biggest-data-breaches-august-2026 284 million records claimed at McKesson, 12.9 million verified at Carhartt. The eight biggest data breaches of August 2026, with every number checked against a company statement, filing, or named outlet. Thu, 03 Sep 2026 00:00:00 GMT Shubham Jha https://strobes.co/blog/pentest-report-automation https://strobes.co/blog/pentest-report-automation Report quality is decided before the reporting layer runs. Here's the pipeline, the gates that stop bad output shipping, and what a real automated report contains. Tue, 01 Sep 2026 00:00:00 GMT Shubham Jha https://strobes.co/blog/build-vs-buy-agentic-pentesting https://strobes.co/blog/build-vs-buy-agentic-pentesting Everyone can build a working pentest agent in a weekend. Owning it for two years is the hard part: the four costs nobody adds up, and the seven requirements a demo never has to meet. Mon, 31 Aug 2026 00:00:00 GMT Shubham Jha https://strobes.co/blog/cheaper-faster-accurate-pentests https://strobes.co/blog/cheaper-faster-accurate-pentests Cheaper, faster and accurate pentests were never a real tradeoff. Context removes it: one graph of assets, code and cloud that every engagement reads from and writes back to. Fri, 21 Aug 2026 00:00:00 GMT Akhil Reni https://strobes.co/blog/agentic-pentesting-poc https://strobes.co/blog/agentic-pentesting-poc A 10-day testing playbook to evaluate agentic pentesting vendors: what to test each day, the red flags to watch for, and a scorecard that works with any vendor. Tue, 11 Aug 2026 00:00:00 GMT Shubham Jha https://strobes.co/blog/tooling-as-code-structured-scratchpads https://strobes.co/blog/tooling-as-code-structured-scratchpads The two changes that moved our AI security agents furthest this year had nothing to do with the model. Here is how tooling as code and structured scratchpads reshaped how the agents act, and how they prove a finding is real. Mon, 03 Aug 2026 00:00:00 GMT Strobes Security https://strobes.co/blog/top-cves-july-2026 https://strobes.co/blog/top-cves-july-2026 Five CVEs defined July 2026, ranked by what attackers actually exploited, not CVSS: an AD FS zero-day, twin SharePoint RCEs, a May patch that became a July KEV deadline, and the month's highest score that nobody touched. Mon, 03 Aug 2026 00:00:00 GMT Shubham Jha https://strobes.co/blog/top-8-data-breaches-july-2026 https://strobes.co/blog/top-8-data-breaches-july-2026 The 8 confirmed data breaches of July 2026, from a 78-million-account Suno leak to rogue AI agents breaching Hugging Face and Anthropic. What happened and how to defend. Sat, 01 Aug 2026 00:00:00 GMT Shubham Jha https://strobes.co/blog/evaluate-ai-agent-pentesting-checklist https://strobes.co/blog/evaluate-ai-agent-pentesting-checklist An AI agent that can exploit your systems does an attacker's work. Here are the seven governance checks to clear before you authorize agentic pentesting in production. Fri, 24 Jul 2026 00:00:00 GMT Shubham Jha https://strobes.co/blog/human-in-the-loop-security https://strobes.co/blog/human-in-the-loop-security An AI pentester can hand you a critical finding in minutes. The only question that matters is whether you believe it. Here is why human validation turns a claim into proof. Fri, 24 Jul 2026 00:00:00 GMT Shubham Jha https://strobes.co/blog/ai-sql-injection-testing https://strobes.co/blog/ai-sql-injection-testing See how Strobes AI runs autonomous SQL injection testing, finding an injectable parameter, proving exploitability, and shipping evidence for remediation. Fri, 24 Jul 2026 00:00:00 GMT Shubham Jha https://strobes.co/blog/wp2shell-wordpress-pre-auth-rce https://strobes.co/blog/wp2shell-wordpress-pre-auth-rce wp2shell is a pre-authentication RCE in WordPress Core that an anonymous request can trigger on a default install. Here are the affected versions, the patch steps, and why events like this are really an exposure validation problem. Sat, 18 Jul 2026 00:00:00 GMT Strobes Security https://strobes.co/blog/strobes-agentic-pentesting-a-pen-tester-experience-and-point-of-view https://strobes.co/blog/strobes-agentic-pentesting-a-pen-tester-experience-and-point-of-view Eleven validated Critical and High findings from Strobes AI's autonomous pentesting agents, each with the agent's reasoning, the request sent, and the response that proved it. Sun, 12 Jul 2026 00:00:00 GMT Sumeet Darekar https://strobes.co/blog/open-source-agentic-pentesting-tools https://strobes.co/blog/open-source-agentic-pentesting-tools Compare the 10 best open source agentic pentesting tools for self-hosted workflows, from PentAGI and PentestGPT to CAI, Strix, and VulnBot. Wed, 08 Jul 2026 00:00:00 GMT Shubham Jha https://strobes.co/blog/vulnerability-chaining-agentic-pentesting-attack-paths https://strobes.co/blog/vulnerability-chaining-agentic-pentesting-attack-paths Three low-severity findings can chain into one critical breach. See why CVSS misses chained risk and how agentic pentesting proves or rejects each attack path. Wed, 08 Jul 2026 00:00:00 GMT Shubham Jha https://strobes.co/blog/agentic-pentesting-reliability-unstable-apps https://strobes.co/blog/agentic-pentesting-reliability-unstable-apps Agentic pentesting reliability on unstable apps: a six-state failure taxonomy, safe retry rules, and what a trustworthy pentest report must disclose. Wed, 08 Jul 2026 00:00:00 GMT Shubham Jha https://strobes.co/blog/agentic-pentesting-validation https://strobes.co/blog/agentic-pentesting-validation Valid proof in an agentic pentest is reproducible, in-scope, and attributable evidence of exploitability. What counts, what doesn't, and how to prove it. Wed, 08 Jul 2026 00:00:00 GMT Shubham Jha https://strobes.co/blog/top-cves-june-2026-5-critical-flaws-to-patch-now https://strobes.co/blog/top-cves-june-2026-5-critical-flaws-to-patch-now Five CVEs defined June 2026: Check Point VPN bypass, Splunk pre-auth RCE, Windows HTTP.sys kernel RCE, LiteLLM AI-gateway RCE, and Defender BlueHammer. How to fix each. Wed, 01 Jul 2026 00:00:00 GMT Shubham Jha https://strobes.co/blog/top-data-breaches-june-2026 https://strobes.co/blog/top-data-breaches-june-2026 The 8 confirmed data breaches of June 2026, from a 24-billion-record credential dump to ShinyHunters' PeopleSoft and Klue OAuth campaigns. What happened and how to defend. Tue, 30 Jun 2026 00:00:00 GMT Shubham Jha https://strobes.co/blog/vulnerability-ai-race-myth https://strobes.co/blog/vulnerability-ai-race-myth The "vulnerability AI race" is vendor theater. What AI actually changes for exposure management, and why validation through exploitation beats discovery speed. Wed, 17 Jun 2026 00:00:00 GMT Venu Rao https://strobes.co/blog/what-is-vulnerability-validation https://strobes.co/blog/what-is-vulnerability-validation Vulnerability validation proves which scanner findings are real, reachable, and exploitable. Why manual triage fails and how agentic validation scales. Tue, 09 Jun 2026 00:00:00 GMT Shubham Jha https://strobes.co/blog/gartner-srm-2026-enterprise-security-takeaways https://strobes.co/blog/gartner-srm-2026-enterprise-security-takeaways Strobes CEO Venu Rao shares his takeaways from Gartner Security & Risk Management Summit 2026: everyone can find vulnerabilities, almost no one has cracked fixing them. Tue, 09 Jun 2026 00:00:00 GMT Venu Rao https://strobes.co/blog/pentesting-single-page-applications https://strobes.co/blog/pentesting-single-page-applications Learn how to pentest React, Angular, and Vue SPAs. Covers DOM XSS, client-side routing bypass, JS bundle secrets, and why traditional DAST scanners fail. Thu, 04 Jun 2026 00:00:00 GMT Alibha https://strobes.co/blog/bug-bounty-vs-pentesting-vs-ai-pentesting https://strobes.co/blog/bug-bounty-vs-pentesting-vs-ai-pentesting Bug bounty vs pentesting vs AI pentesting: compare costs, coverage, compliance, and when to use each model. Build a layered AppSec testing strategy. Thu, 04 Jun 2026 00:00:00 GMT Alibha https://strobes.co/blog/pentesting-in-house-vs-outsourcing https://strobes.co/blog/pentesting-in-house-vs-outsourcing Compare in-house vs outsourced pentesting on cost, coverage, and depth. Discover why AI pentesting is the third option that changes the math for security teams. Thu, 04 Jun 2026 00:00:00 GMT Alibha https://strobes.co/blog/dast-vs-pentesting-vs-ai-pentesting https://strobes.co/blog/dast-vs-pentesting-vs-ai-pentesting Compare DAST, manual pentesting, and AI pentesting. Learn what each approach finds, misses, costs, and when to use each for full application security coverage. Thu, 04 Jun 2026 00:00:00 GMT Alibha https://strobes.co/blog/continuous-app-pentesting-devsecops https://strobes.co/blog/continuous-app-pentesting-devsecops How DevSecOps teams integrate continuous application pentesting into CI/CD pipelines. AI-driven testing, run-over-run diffing, and developer workflow integration. Thu, 04 Jun 2026 00:00:00 GMT Alibha https://strobes.co/blog/pentesting-microservices-architecture https://strobes.co/blog/pentesting-microservices-architecture Why traditional pentesting misses 90% of microservices attack surface. Learn how to test East-West traffic, service mesh, and Kubernetes security at scale. Thu, 04 Jun 2026 00:00:00 GMT Alibha https://strobes.co/blog/app-pentesting-saas-soc2-iso27001 https://strobes.co/blog/app-pentesting-saas-soc2-iso27001 How SaaS companies should structure application pentesting for SOC 2 and ISO 27001 compliance. AI-driven continuous testing vs annual manual engagements. Thu, 04 Jun 2026 00:00:00 GMT Alibha https://strobes.co/blog/pentest-apis-at-scale https://strobes.co/blog/pentest-apis-at-scale Learn how to pentest hundreds of API endpoints using AI agents. Cover OWASP API Top 10, authorization testing, and scale without hiring more pentesters. Thu, 04 Jun 2026 00:00:00 GMT Alibha https://strobes.co/blog/top-data-breaches-may-2026 https://strobes.co/blog/top-data-breaches-may-2026 The 8 confirmed data breaches of May 2026, from the 275M-record Canvas LMS breach to GitHub's VS Code supply chain attack, and how to defend against each pattern. Wed, 03 Jun 2026 00:00:00 GMT Shubham Jha https://strobes.co/blog/top-cves-may-2026-5-critical-flaws-to-patch-now https://strobes.co/blog/top-cves-may-2026-5-critical-flaws-to-patch-now Five CVEs dominated May 2026: cPanel's two-month zero-day, Linux's stealth kernel priv-esc, Langflow exploited 20 hours after disclosure, n8n's perfect-10 RCE chain, and Microsoft's SSO bypass. Here's what happened and what to do. Wed, 03 Jun 2026 00:00:00 GMT Shubham Jha https://strobes.co/blog/out-of-band-validation https://strobes.co/blog/out-of-band-validation Out-of-band validation detects blind SSRF, blind SQLi, and out-of-band XXE that return no in-band response. Learn how it works and why it matters. Fri, 29 May 2026 00:00:00 GMT Alibha https://strobes.co/blog/vibe-coded-app-vulnerabilities https://strobes.co/blog/vibe-coded-app-vulnerabilities The 5 security flaws AI coding assistants ship by default: missing authz, leaked secrets, weak JWTs, IDOR, eval RCE — with detection queries and fixes for each. Fri, 29 May 2026 00:00:00 GMT Alibha https://strobes.co/blog/black-box-agentic-scanner-limits https://strobes.co/blog/black-box-agentic-scanner-limits Black box agentic pentesting finds real CVEs fast and proves them, but where does it hit a ceiling? An honest, category-level verdict. Fri, 29 May 2026 00:00:00 GMT Alibha https://strobes.co/blog/ai-exploit-code-isolation https://strobes.co/blog/ai-exploit-code-isolation Agent-written exploit code is the new RCE vector aimed at the tester. Here's why per-task isolation and egress control are non-negotiable. Fri, 29 May 2026 00:00:00 GMT Alibha https://strobes.co/blog/agentic-pentesting-complete-guide https://strobes.co/blog/agentic-pentesting-complete-guide Agentic pentesting uses specialized AI agents to test your entire attack surface in hours, not weeks. Here is how it works, what surfaces it covers, how safety is enforced, and how to evaluate platforms with real benchmarks. Thu, 28 May 2026 00:00:00 GMT Shubham Jha