Welcome to our blog.
The day after tomorrow: After PHP2Shell, it gets worse, then defenders win
It’s been a tough week or so for security and dev teams. The forecast has gone from a vulnerability tsunami to every week feeling like the sky is falling. We agree things get worse, but we still think defenders have the edge.
2026 State of AI in Pentesting
Our latest report captures the perspectives of 400 CISOs, CTOs, and senior engineering leaders across Europe and the US. It explores how AI is changing penetration testing, why traditional approaches are struggling to keep pace with modern software delivery, and what security leaders want from the next generation of penetration testing.
Adding Aikido AI pentesting to your existing security stack
Aikido Security's AI pentesting fits into the stack you already run. Even if you're committed to your current code and cloud security tools, you can add AI pentesting on top to catch the complex logic flaws deterministic tools miss.
Node2Shell: Node.js Brotli vulnerability allows remote code execution (CVE-2026-111497)
Node.js CVE-2026-111497 (Node2Shell) is a Brotli flaw that can allow remote code execution. See who is affected, patched versions and the fix.
LiteLLM compromised again: infostealer and RAT found in version 1.107.0
LiteLLM 1.107.0 was compromised. All seven compiled wheels on PyPI contain a credential-stealing infostealer and a persistent remote access trojan.
Drata and Aikido: audit-ready pentesting, built into your compliance workflow
Drata and Aikido bring AI pentesting into your compliance workflow, with verified findings, auditor-ready reports, and up to $4,000 in free pentest credits for new Drata customers.
Yearly pentests can’t keep up. Test more on the same budget
AI pentesting lets security teams test more often without raising the budget. Learn how upfront pricing and forecasts keep costs predictable.
Your CVE is reachable. But is it exploitable?
Reachable CVEs can still be safe in your app. See how reachability vs exploitability analysis helps you decide which dependency vulnerabilities to fix first.
Aikido Security is now CREST accredited
Selling to banks or government? Aikido now offers CREST-accredited penetration testing, plus AI pentesting between audits.
How Aikido helps you meet SOC 2 Type 1 and Type 2
Learn how Aikido maps to SOC 2 Type 1 and Type 2 audits, with SLA tracking, CI/CD gates, and cloud checks that produce exportable audit evidence.
Aikido and Deel: set up once, secure every hire
Code, cloud, and devices, covered automatically once someone's hired through Deel.
Aikido launches Noon: workforce security for every employee
Aikido launches Noon, a workforce security business. AI governance, device and email protection, and training against AI-powered phishing and deepfakes.
eMudhra CA compromise: eight private keys, and one of them is 4
Eight eMudhra CA keys could be guessed in at most 256 tries, and one is just the number 4. Who is affected, why curl lagged browsers, and how to fix it.
LiteLLM compromised again: infostealer and RAT found in version 1.107.0
LiteLLM 1.107.0 contains an infostealer and RAT, and PyPI has quarantined the package. See if you’re affected, what it steals, and what to rotate.
PHP2Shell: Critical PHP vulnerabilities, affected versions and fixes
A critical PHP vulnerability lets attackers run code remotely on unpatched servers. See affected versions, patches, mitigations and how to check your exposure. Two PHP RCE flaws (CVE-2026-109618, CVE-2026-109619) are being exploited now. Here’s which versions to update to and what to do if you can’t patch today.
Top 10 Software Composition Analysis (SCA) tools in 2026
SCA tools are our best line of defense for open-source security, this article explores the top 10 open-source dependency scanners for 2026
AI Pentesting Buyer's Guide: How to evaluate AI pentesting vendors
Learn how to evaluate AI pentesting vendors with practical buying criteria, research from 1,000+ AI pentests, and a downloadable evaluation checklist.
A practical CTO security checklist to be Mythos-ready
A practical checklist for SaaS CTOs navigating a world with Mythos and agentic AI threats. Built around the defender's advantage: you have context attackers have to work to get. Covers the controls, practices, and operational habits that determine whether your team finds and fixes issues before someone else does.
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system.
Connect a repo to discover what the reasoning agents find in your codebase.
