Stay informed with the latest cybersecurity insights, penetration testing best practices, and security tips from our team.
A single null byte hidden inside an event handler slipped a live XSS payload past HTMLPurifier at sign-up. An unescaped admin user list did the rest. An unauthenticated attacker could register an account and take over the platform administrator's session. CVSS 9.3 Critical.
Read MoreEvery app/Policies/ file in Coolify had the same comment: "Authorization temporarily disabled." That comment was live in production. Any authenticated user on a shared Coolify instance could access, modify, and redeploy services belonging to other teams — including container image swaps that led to code execution. CVSS 8.8 High.
Read MoreAny team member can implant a persistent XSS payload in a HeyForm rich-text field. It fires silently in the team owner's browser and enables full team ownership takeover. Fixed in a commit with no public advisory, no Dependabot alert, and no NVD entry.
Read MoreA CVE we recently published. A low-privilege user could lock every admin out of Snipe-IT through bulk user editing. How we found it, why scanners miss this class of bug, and how disclosure played out.
Read MoreA CVE we recently published. An authorization bypass in GLPI let a technician-level user delete any object in the instance — how we found it, why scanners miss this class of bug, and how disclosure played out.
Read More
PCI DSS 4.0 changed how organizations must approach penetration testing. Requirement 11.4 methodology rules, segmentation testing every six months, and what to ask your QSA — all laid out for organizations still operating on 3.2.1 habits.
Read More
The August 2, 2026 deadline for high-risk AI systems is twelve weeks away. Here's what Article 15 actually requires, who's in scope (including non-EU companies), and how to prepare in the time you have left.
Read More
Learn how penetration testing fits into SOC 2 compliance. Understand what auditors expect, which type of pentest satisfies SOC 2 requirements, and how to time it for your audit.
Read More
From the Brightspeed breach to a 44% surge in ransomware, North Carolina is under attack. Here's why Charlotte businesses face elevated risk.
Read More
Real pricing ranges by test type, the factors that drive cost up or down, and practical budgeting guidance for small and mid-sized businesses.
Read More
A clear, jargon-free guide explaining how penetration testing works, what to expect, and how it protects your organization.
Read More
Understand the key differences between penetration testing and vulnerability assessments. Learn which approach is right for your organization.
Read More