After PHP2Shell: What a Web Application Pentest Finds
On 26 October 2026, CISA added two unauthenticated PHP remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, together nicknamed PHP2Shell, to the Known Exploited Vulnerabilities catalog…
When EDR Misses: Infostealers and the Dark Web Gap
Infostealers bypass endpoint protection far more often than most security teams expect. According to the SpyCloud 2026 Annual Identity Exposure Report , 40% of the 13.2 million infostealer infections…
Non-Human Identity Risks Your Cloud Review Misses
A Terraform state file sits in a Google Cloud storage bucket. One service account can read it. That account’s key has not rotated in eighteen months. From that single credential, an attacker lists…
What Internal Pentests Miss in Hybrid Identity Environments
Most internal network pentests still run against a scope written when the environment was Active Directory on its own. In organisations that have since federated Okta or Entra ID to AD, that scope…
External Network Pentest Scope: Beyond VPN Appliances
On September 10, 2026, CISA added two MikroTik RouterOS SSH vulnerabilities to its Known Exploited Vulnerabilities Catalog, confirming what CERT Polska had already published a week earlier: attackers…
Mobile App Security Testing: What AI Code Gets Wrong
Two releases in mid-2026 have reset the ground under mobile application security work. On July 29, Zimperium’s 2026 Global Mobile Threat Report projected that “by 2027, 25% of software defects will…
Web Application Pentest Methodology: What Testers Find
The 2026 Verizon Data Breach Investigations Report confirmed a shift the report itself calls a first in its 19-year history: “Using software flaws (31%) has surpassed stolen credentials for the first…
NTLM Relay in Active Directory: What Pentests Find
An NTLM relay attack inside an Active Directory pentest remains the most reliable critical-severity finding CTDefense reproduces during internal engagements. LLMNR poisoning captures an NTLMv2 hash.…
Cloud Workload Vulnerability Testing: What CSPM Misses
Two H2 2025 threat reports converged on the same finding: known, well-catalogued weaknesses on cloud-hosted workloads have overtaken misconfiguration and credential abuse as the most common way…
Machine credentials on the dark web: what infostealers steal
The dominant mental model for dark web monitoring is still built around one credential type: a human email address paired with a password, appearing in a paste, a combolist, or an infostealer log.…