Insights on vulnerabilities, cloud security, API testing, compliance, and penetration testing - written by the consultants who do the work.
A crafted image upload can make Rails Active Storage read arbitrary files off the server - including config/master.key and secret_key_base - with no login required. It's rated 9.5 critical, fixes are already out, and full technical details are expected by 28 August 2026. Here's the briefing, the exposure test, and the action list.
Read article
An unauthenticated attacker can obtain a valid SmartConsole login token and sign in to Check Point Security Management with full administrative privileges. It's being exploited as a zero-day and CISA added it to the KEV catalog on 22 July 2026. Here's the briefing, the exposure test, and the action list.
Microsoft disclosed a critical unauthenticated-looking RCE in on-premises SharePoint Server on 14 July 2026 - a deserialization flaw exploited in the wild before patches shipped, now on CISA's KEV list with a 19 July remediation deadline. Here's the briefing, the compromise-hunt, and the action list.
SonicWall disclosed two zero-days in its Secure Mobile Access 1000 appliances on 15 July 2026 - a CVSS 10.0 unauthenticated SSRF and a post-auth command injection in the management console. Both are being exploited in the wild. Here's the briefing, the IoCs to hunt for, and the action list.
An unauthenticated path-traversal flaw in ColdFusion's Remote Development Services turns a single crafted HTTP request into full remote code execution as the service account. Disclosed 30 June 2026 (APSB26-68), weaponised within hours, and being exploited in the wild right now. Here's the five-minute briefing and the to-do list.
Three years on from CVE-2023-34362 (MOVEit Transfer SQLi) and the Cl0p mass-exploitation campaign that defined modern data-exfiltration ransomware. Plus the 2024-2025 ransomware retrospective: LockBit takedown, BlackCat exit-scam, and what survives them.
Two years after regreSSHion (CVE-2024-6387), the OpenSSH CVE that didn't quite weaponise globally - plus what CUPS, OpenSSL, and the rest of the critical OSS stack look like in April 2026.
It's been a year since CVE-2025-30066 (the tj-actions/changed-files compromise) and the XZ Utils backdoor (CVE-2024-3094) is two years old this month. Where supply-chain defence stands, what changed, and what most teams still haven't done.
Microsoft shipped fixes for more in-the-wild zero-days in 2024 than in any prior year - and the Windows MSHTML, TCP/IP, and Task Scheduler issues remain pre-prevalent on unpatched estate. A February inventory of the Microsoft CVEs you still need to verify are gone.
Two years after Snowflake, the credential-theft + SaaS-misconfiguration pattern is the most consistent breach vector we triage. A digest of the real incidents and CVEs that should anchor your January retrospective.