Welcome to our blog.

wfx-loot campaign pushes CI secret stealer to tens of thousands of repositories

A wave of compromised accounts are pushing a CI secret stealer. See if you’re affected, what it steals, and what to rotate.

Checkmarx vs Fortify: SAST, Custom Rules and Remediation

Checkmarx vs Fortify: Enterprise SAST Compared

Compare Checkmarx and OpenText Fortify across SAST depth, language support, scan performance, CI/CD integration, reporting and deployment options.

Orca Security vs Wiz: Cloud Risk, Remediation and Cost

Orca Security vs Wiz: CNAPP Platforms Compared

Explore Orca Security vs Wiz for agentless cloud scanning, attack paths, workload visibility, prioritization and enterprise rollout considerations.

Grype vs Trivy: Container Scanning and Remediation

Grype vs Trivy: Open-Source Scanners Compared

Grype or Trivy? Compare container and package CVE detection, SBOM support, IaC scanning, CI integration and maintenance for security teams.

Revenera vs Snyk: SCA, Licensing and Dependency Fixes

Revenera vs Snyk: SCA & Supply Chain Security

Compare Revenera FlexNet Code Insight with Snyk on open-source inventory, license compliance, vulnerability detection, SBOMs and remediation workflows.

Checkmarx vs Veracode: SAST, Workflows and Pricing

Checkmarx vs Veracode: SAST & AppSec Compared

See how Checkmarx and Veracode compare for SAST, SCA, developer workflows, deployment, triage and enterprise requirements before choosing a platform.

Burp Suite vs OWASP ZAP: Which Fits Your Testing Workflow?

Burp Suite vs OWASP ZAP: DAST Tools Compared

Explore Burp Suite vs OWASP ZAP for web app testing, automation, extensibility and pricing. See when commercial or open-source DAST fits.

Astrix Security vs GitGuardian: Secrets and NHI Security

Astrix Security vs GitGuardian: Secrets & NHI Security

Compare Astrix and GitGuardian on non-human identity security, secrets detection, exposure discovery, remediation and developer workflows.

Even gem list can run someone else's code

Ruby gems can run code on install and on every gem command, even gem list. Check for four data-exfiltrating gems and turn off install-time execution.

Deleting a leaked key from your repo doesn't protect you

Deleting your leaked key from your repo doesn't protect you

A leaked admin key on GitHub, deleted within hours, still led to a breach months later at LiteLLM. Learn why Git history keeps secrets and why you have to rotate.

Surviving cybersecurity until the end of 2026

After Binance, LiteLLM, PHP2Shell and eMudhra, here are six practices and a checklist to limit what the next compromise can reach before 2027.

CodeRabbit vs Greptile: Which AI Code Reviewer Fits Your Team?

CodeRabbit vs Greptile: AI Code Review Compared

Compare CodeRabbit and Greptile on PR review depth, codebase context, feedback quality, integrations and pricing to choose the right AI reviewer.

Critical Linux kernel TCP vulnerability can allow remote code execution (CVE-2026-98432)

Linux kernel TCP RCE vulnerability (CVE-2026-98432): fix

CVE-2026-98432 is a critical Linux kernel TCP flaw rated 9.8 that can allow remote code execution. See who is affected, how to patch and what to do now.

AI agent security in Kubernetes: Why prompt injection isn't the right term

AI agent security in Kubernetes | Aikido Security

Abdel Sghiouar, Google engineer and senior cloud developer advocate, thinks prompt injection should be called prompt poisoning

Abdel Sghiouar, Google engineer and senior cloud developer advocate, thinks prompt injection should be called prompt poisoning.

Binance hack: how a compromised developer laptop can lead to a $6.3 billion breach

Binance hack: how a developer laptop can put $6.3B in play

The Binance hack may have started with a compromised developer laptop, Binance says. See how that can lead to stolen funds and how to protect against it.

Binance says a compromised DevOps laptop may have started its $6.3 billion hack, and that it has since found additional points of breach. Here is how one laptop can lead to a service that moves money, and how to protect the devices at the start of that chain

What are shell vulnerabilities? PHP2Shell, Node2Shell (HTTP2Shell), React2Shell and Log4Shell explained

What are shell vulnerabilities? | Aikido Security

We explain what shell vulnerabilities are and how to manage them: PHP2Shell, Node2Shell (HTTP2Shell), React2Shell and Log4Shell

The day after tomorrow: After PHP2Shell, it gets worse, then defenders win

PHP2Shell and Brocolli2Shell may be harbingers of many vulnerabilities to come. But we can be ready

It’s been a tough week or so for security and dev teams. The forecast has gone from a vulnerability tsunami to every week feeling like the sky is falling. We agree things get worse, but we still think defenders have the edge.

Ghost in the PHP2Shell: Why coordinated disclosure and patching will start moving faster

PHP2Shell showed how fast AI turns a bug into an exploit. Here’s why the disclosure should never happen this way again, and why it will anyway.

Aikido launches external network pentesting

Aikido launches external network pentesting | Aikido Security

Aikido launches external network pentesting: AI agents attack your internet-facing systems from the outside and report only findings they actually exploit.

How to patch PHP2Shell with free Aikido Images

Patch PHP2Shell with free Aikido Images (PHP 5.5 to 8.5)

Patch PHP2Shell (CVE-2026-109618 and CVE-2026-109619) with free Aikido Images for PHP 5.5 to 8.5. Stay on your current version with backported fixes.

Product Updates

Adding Aikido AI pentesting to your existing security stack

Adding Aikido AI pentesting to your existing security stack | Aikido Security

Aikido Security's AI pentesting fits into the stack you already run. You can add AI pentesting on top to catch the complex logic flaws deterministic tools miss.

Aikido Security's AI pentesting fits into the stack you already run. Even if you're committed to your current code and cloud security tools, you can add AI pentesting on top to catch the complex logic flaws deterministic tools miss.

Node2Shell evolves to HTTP2Shell. Brotli flaw (CVE-2026-111497) blast radius affects many libraries & apps using HTTP.

Node2Shell Brotli vuln (CVE-2026-111497) evolves to HTTP2Shell, as libraries and apps using HTTP are affected.

The Brotli flaw behind Node2Shell (CVE-2026-111497) affects many libraries and applications using HTTP with Brotli or brotlicffi installed. Check your versions and upgrade to the fix.

The Brotli flaw behind Node2Shell (CVE-2026-111497) affects Python apps with Brotli or brotlicffi installed. Check your versions and upgrade to the fix.

Node2Shell: Node.js Brotli vulnerability allows remote code execution (CVE-2026-111497)

Node2Shell: Node.js Brotli vulnerability allows remote code execution (CVE-2026-111497) and the fix

Node.js CVE-2026-111497 (Node2Shell) is a Brotli flaw that can allow remote code execution. See who is affected, patched versions and the fix.

eMudhra CA compromise: eight private keys, and one of them is 4 - CVE-2026-111943

eMudhra CA Compromise: Eight Weak Private Keys - CVE-2026-111943

Eight eMudhra CA keys could be guessed in at most 256 tries, and one is just the number 4. Who is affected, why curl lagged browsers, and how to fix it.

Eight eMudhra intermediate CA keys were generated so weakly that they could be recovered in at most 256 guesses.

Software supply chain security best practices for 2026

Software supply chain security best practices for 2026 | Aikido Security

This guide walks through supply chain security best practices that would have stopped the attacks of the past 18 months.

LiteLLM compromised again: infostealer and RAT found in version 1.107.0

LiteLLM compromised: infostealer and RAT in PyPI 1.107.0

LiteLLM 1.107.0 contains an infostealer and RAT, and PyPI has quarantined the package. See if you’re affected, what it steals, and what to rotate.

LiteLLM 1.107.0 was compromised. All seven compiled wheels on PyPI contain a credential-stealing infostealer and a persistent remote access trojan.

PHP2Shell: Critical PHP vulnerabilities, affected versions and fixes | CVE-2026-109618 and CVE-2026-109619

PHP2Shell: How to fix PHP RCE with patches and free images

A critical PHP vulnerability lets attackers run code remotely on unpatched servers. See affected versions, patches, mitigations and how to check your exposure. Two PHP RCE flaws (CVE-2026-109618, CVE-2026-109619) are being exploited now. Here’s which versions to update to and what to do if you can’t patch today.

Two critical PHP RCE flaws (CVSS 9.2) now have patches available, and exploitation has been reported. Every unpatched PHP version is affected. Read how to update and use free patched Aikido Images.

The 10 best email security software platforms in 2026

10 Best Email Security Software Platforms in 2026

Compare 10 email security platforms for phishing, BEC and automated response, plus workforce protection across training, devices and AI use.

The 9 best phishing simulation tools in 2026

9 Best Phishing Simulation Tools in 2026

Compare nine phishing simulation tools for realistic email, voice, SMS and deepfake exercises, adaptive training and broader workforce protection.

The 9 best KnowBe4 alternatives in 2026

9 Best KnowBe4 Alternatives and Competitors in 2026

Compare nine KnowBe4 alternatives for awareness training, phishing simulations, AI governance and workforce protection, plus practical migration advice.

The 8 best security awareness training platforms in 2026

8 Best Security Awareness Training Platforms in 2026

Compare eight security awareness training platforms for role-based learning, AI threats, phishing simulations and protection across your workforce.

The 8 best Mimecast alternatives in 2026

The 8 Best Mimecast Alternatives and Competitors in 2026

Compare eight Mimecast alternatives for email security, AI governance, employee training and archiving, with practical advice for planning your switch.

Aikido launches Noon: workforce security for every employee

Aikido launches Noon, a workforce security business. AI governance, device and email protection, and training against AI-powered phishing and deepfakes.

We built Aikido to secure developers. Today we launch Noon to protect everybody else, from AI-powered phishing and deepfakes to the AI tools security teams can’t see.

Yearly pentests can’t keep up. Test more on the same budget

Yearly pentests can’t keep up. Test more on the same budget | Aikido Security

76% of teams ship major changes weekly, but only 21% test every release. Here’s how AI pentesting closes that gap without raising your security budget

AI pentesting lets security teams test more often without raising the budget. Learn how upfront pricing and forecasts keep costs predictable.

Your CVE is reachable. But is it exploitable?

Reachable CVEs can still be safe in your app. See how reachability vs exploitability analysis helps you decide which dependency vulnerabilities to fix first.

Top Escape.tech alternatives for offensive security in 2026

Top Escape.tech alternatives in 2026

We compare the top Escape.tech alternatives for offensive security in 2026: Aikido Security, XBOW, RunSybil, Terra, Burp Suite Professional, Invicti, StackHawk, Hadrian, and Pentera

Top Horizon3 alternatives in 2026

Top Horizon3 alternatives in 2026 for AI pentesting | Aikido Security

We compare the top Horizon3 alternatives for AI pentesting in 2026: Aikido Security, Pentera, RidgeBot, XBOW, Hadrian, RunSybil, and Terra

Drata and Aikido: audit-ready pentesting, built into your compliance workflow

Drata and Aikido bring AI pentesting into your compliance workflow. Get verified findings, auditor-ready reports, and up to $4,000 in free pentest credits.

Drata and Aikido bring AI pentesting into your compliance workflow, with verified findings, auditor-ready reports, and up to $4,000 in free pentest credits for new Drata customers.

Aikido Security is now CREST accredited

Aikido Security is now CREST accredited for penetration testing | Aikido Security

Selling to banks or government? Aikido now offers CREST-accredited penetration testing, plus AI pentesting between audits.

What is vulnerability remediation?

What is vulnerability remediation? | Aikido Security

Learn how vulnerability remediation works for each type of flaw and what to do when upgrading a dependency breaks your build or isn't an option.

Top 6 developer security tools for enterprise teams in 2026

Top 6 developer security tools for enterprise teams in 2026 | Aikido Security

We compare the top developer security tools for enterprise teams on signal quality, governance, and remediation: Aikido Security, Snyk, GitHub Advanced Security, SonarQube, Checkmarx, and Endor Labs

Top FedRAMP-compliant security tools in 2026

Top FedRAMP-compliant security tools in 2026 | Aikido

We compare the top FedRAMP-compliant security tools in 2026: Aikido for Government, Checkmarx One for Government, Qualys, Rapid7 InsightGovCloud, Snyk for Government, Tenable, Wiz for Government

tensorlake NPM package compromised with Shai Hulud worm

malicious code detected in tensorlake 0.5.144

How Aikido helps you meet SOC 2 Type 1 and Type 2

SOC 2 Type 1 and Type 2 Compliance with Aikido

Learn how Aikido maps to SOC 2 Type 1 and Type 2 audits, with SLA tracking, CI/CD gates, and cloud checks that produce exportable audit evidence.

Top vulnerability remediation tools in 2026

Top Vulnerability Remediation Tools in 2026 | Aikido

We compare the top vulnerability remediation tools in 2026: Aikido Security, Snyk, GitHub Advanced Security, Tenable, Qualys, and Wiz

Top threat intelligence feeds in 2026

Top Threat Intelligence Feeds in 2026 | Aikido Security

We compare the top threat intelligence feeds in 2026: Aikido Intel, Socket Threat Feed, Snyk Security Database, OSV.dev, and Spectra Intelligence (ReversingLabs)

Top endpoint security tools for developers in 2026

Top Endpoint Security Tools for Developers in 2026 | Aikido

Comparing the top endpoint security tools for developers in 2026. We look at Aikido Security, GitGuardian Developer Endpoint Protection, Koi Security, Socket, and CrowdStrike Falcon

Aikido funds Node.js security

Aikido joins OpenJS's push to fund Node.js security work

Aikido is an inaugural partner in OpenJS's Security Stewardship Program, funding bug bounties and maintainer support for Node.js.

Aikido joins OpenJS's Security Stewardship Program as an inaugural partner, funding bug bounties and maintainer support to secure Node.js.

Aikido Security achieves FedRAMP Moderate authorization

Aikido has achieved FedRAMP Moderate authorization, bringing AI-native, automated vulnerability remediation to U.S. federal agencies.

Top CodeQL alternatives in 2026

Top CodeQL alternatives in 2026 | Aikido

Top CodeQL alternatives compared on noise, fixes, cost, and more: Aikido Security, Semgrep, Snyk Code, SonarQube, Checkmarx, and Veracode

Top Greptile alternatives in 2026

Top Greptile alternatives in 2026 | Aikido

We compare the top Greptile alternatives in 2026 on coverage, noise, review depth and more: Aikido Security, CodeRabbit, Qodo, Graphite, SonarQube and CodeAnt AI

Novel supplychain.local Go worm appears

MemTensor npm and PyPI hit by "supplychain.local" malware

"supplychain.local": malicious code found in MemTensor's npm plugin (0.1.21, 0.1.23) and PyPI's MemoryOS (2.0.34).

Cyber Resilience Act is here! Myth busting and first impressions

The Cyber Resilience Act's first deadline just came up on September 11, 2026. What the new Single Reporting Platform looks like, and four common CRA myths debunked.

Send GitLab an email, push to main

GitLab gives you a private email address to create issues. If leaked, anyone who has it can push code, execute CI/CD jobs, and bypass IP restrictions across all of your public and private projects.

Graphalgo campaign spreads to Terraform providers and Go Modules

Graphalgo Malware Spreads to Terraform and Go

Aikido found Graphalgo-linked Go malware in Terraform providers and Go Modules, using targeted triggers, Slack, and blockchain C2.

Graphalgo malware has now spread to Go, showing up in two Terraform providers and two Go modules.

Aikido and Deel: set up once, secure every hire

Code, cloud, and devices, covered automatically once someone's hired through Deel.

Introducing Aikido Altar: the model that makes sovereign security intelligence possible

Aikido Altar: open-weight AI for sovereign security

Aikido Altar is a compressed, open-weight AI model built for sovereign security intelligence, powering Aikido Machine's on-prem, air-gapped pentesting.

Altar is our first open-weight AI model, and the first step toward sovereign security intelligence. It runs entirely inside a customer's own infrastructure, powering Aikido Machine's autonomous pentesting without any code ever leaving the building.

Top on-prem AI pentesting tools in 2026

Top On-Prem AI Pentesting Tools 2026 | Aikido Security

The best on-prem AI pentesting tools of 2026 for regulated teams, compared on air-gap support, whitebox depth, and application coverage

The best on-prem AI pentesting tools of 2026 for regulated teams, compared on air-gap support, whitebox depth, and application coverage. See where each fits

Aikido achieves AWS Security Competency for Application Security

AWS has recognized Aikido with its Security Competency for Application Security, validating how Aikido secures applications from code to cloud to runtime.

AWS checked our homework: we're officially an AWS Security Competency Partner for Application Security.

Top Qodo Alternatives for AI-Powered Code Assistance

Best Qodo alternatives in 2026 compared

The best Qodo alternatives for AI code review in 2026, compared across noise, security, and cost, so you can pick the tool that fits your team.

Top Aqua Security alternatives for cloud-native security in 2026

Top 6 Aqua Security alternatives in 2026 compared

Compare the best Aqua Security alternatives in 2026: Aikido, Wiz, Prisma Cloud, Sysdig, Orca, and CrowdStrike, on coverage, deployment, pricing, and fit.

Dependabot vs Renovate (2026): Which to Use?

Dependabot vs Renovate

Dependabot vs Renovate compared on setup, monorepos, platforms, and security, plus why auto-updating misses what's actually exploitable

The CVE spike across major software companies is a remediation problem

CVE volume is climbing across major software companies, and a federal audit shows even NIST couldn't keep up. Here's why remediation speed, not disclosure count, is the number that actually matters.

A viral chart this month showed CVEs climbing sharply across 21 major software companies, and the industry split into two camps arguing about what it means. Both are missing the number that actually determines risk: how fast the vulnerabilities that matter get fixed.

Jason Haddix: Stop fearing AI pentesting

Jason Haddix: 90% of Pentests Will Be Done by AI

Jason Haddix on why manual pentesting can't keep up, what disappears first, and why human methodology is what makes AI pentesting work

Compromised Flutter package on pub.dev contains XCSSET malware

We detected XCSSET malware inside a compromised Flutter package on pub.dev. Here is a full breakdown of the infection chain, propagation modules, and stealer logic we found inside.

Shai-Hulud Rises From the Dead after 111 days

A Shai-Hulud npm payload came back 111 days later

A known Shai-Hulud worm payload sat dormant for 111 days, then republished to npm, right past the malware scanning meant to catch it.

A Shai-Hulud payload from May just reappeared on npm, same hash, unchanged, straight past the publish-time scanning that should have caught it.

StyleSmuggler fix: patch the Magento and Adobe Commerce RCE

StyleSmuggler fix: patch Magento and Adobe Commerce RCE

StyleSmuggler is an unauthenticated RCE hitting Magento and Adobe Commerce, with no CVE and no Adobe patch yet. Aikido already has the fix.

StyleSmuggler is hitting Magento and Adobe Commerce right now, and Adobe still hasn't shipped a fix. Here's the patch we already have, and how it works.

Dirty Frag (CVE-2026-43284): the Linux kernel bug that turns read access into root

Dirty Frag (CVE-2026-43284): Linux Root Escalation | Aikido

Dirty Frag turns low-privileged Linux access into root, and can escape containers. The affected CVEs, how to check if you're exposed, and how to fix it.

Top Trivy alternatives for container and cloud scanning in 2026

Best Trivy Alternatives in 2026: Compared

Six Trivy alternatives compared for 2026 on container scanning, IaC, SAST, prioritization, and fixes, with where each one actually fits.

Stop breaking SLAs: how to patch vulnerabilities before the fix even ships

Your SLA Is About to Breach and the Dependency Has No Patch

How to use Aikido Libraries to patch vulnerable dependencies and meet security SLAs.

Learn how to meet security SLAs for dependency vulnerabilities with Aikido Libraries by using delivering secure, backported patches.

MECCHA CHAMELEON can't hide from the RCE

We found a second delayed RCE in MECCHA CHAMELEON: a malicious custom map could write files anywhere on your system and run code after a restart. Now patched in 4.0.0.

Top DSPM Tools in 2026: Compared and Ranked

Top DSPM tools in 2026

Compare the top DSPM tools of 2026: Aikido, Wiz, Cyera, Varonis, and Orca, on data access, remediation, and how they find exposure

Compare the top DSPM tools of 2026, Aikido, Wiz, Cyera, Varonis, and Orca, on data access, remediation, and how they find exposure

The dark figure of supply chain detection

String-based rules only catch malware that's already been seen. Behavioral detection is how you find the supply chain attacks.

A supply chain worm was found hiding in @7nohe/openapi-react-query-codegen, a popular code generator for TanStack Query, stealing credentials and spreading itself to every package the victim maintains.

Securing Docker images: harden, patch, and maintain them

Securing Docker images

Most of a container's vulnerabilities come from the base image. How to harden Docker images, why hardening is ongoing, and how to patch the base you already run.

Good riddance, TeamPCP. Now for the hard part.

TeamPCP arrests don't fix the supply chain risk they exposed

The AFP, FBI, and WA Police charged two men allegedly behind TeamPCP. Charlie Eriksen on why the arrest doesn't close the gap TeamPCP exposed.

Two men have been charged as alleged TeamPCP members after months of cross-border work by the AFP, FBI, and WA Police. Aikido's Charlie Eriksen on why that doesn't close the gap TeamPCP exposed in software supply chains.

Top Minimus alternatives in 2026

Top Minimus Alternatives in 2026

Minimus is shutting down. Compare Aikido, Chainguard, Docker Hardened Images, RapidFort, and Echo, and pick a hardened-image replacement that won't lock you in again.

Aikido Security achieves ISO 42001:2023 certification for AI governance

Aikido Achieves ISO 42001 Certification | AI Governance

Aikido Security has achieved ISO 42001 certification, the global standard for AI governance, covering AI pentesting, Code Security Audit, and Deep PR Review.

Software supply chain security requires decisions rather than defaults

Software Supply Chain Security: Decisions, Not Defaults

Most software runs on decisions nobody made. We talk about why gating, pinning, backporting, and SBOM upkeep only work if someone actually owns them.

A backdoor in xz-utils. A broken build in lodash. Both trace back to the same habit: treating a version number as a fact instead of a choice. Here's what we think it actually takes to make decisions rather than trust defaults.

Aikido launches agentic pentesting for Android apps

Android pentesting, now agentic and autonomous | Aikido

Aikido's agents pentest your Android app and its backend in a single whitebox assessment. You get reproducible findings, AutoFix, and retests for every issue.

Aikido now runs autonomous pentests on Android apps the way an attacker would, covering the app and its backend in one assessment, with AutoFix and retests built in.

Could OpenClaw have actually hacked that Australian gym? We decided to test it.

We recreated the viral AI gym hack in a controlled environment. Running Opus 4.6 on OpenClaw, the model exploited the booking flaw in nine of ten runs.

How Aikido finds more vulnerabilities than Mythos at half the cost

How Aikido finds more vulnerabilities than Claude Security with Mythos at half the cost

Aikido AI Code Audit found 8 more vulnerabilities than Claude Security with Mythos at less than half the cost. How harness design drives coverage per dollar.

Aikido Code Security Audit found 8 more vulnerabilities than Claude Security with Mythos at less than half the cost. Find out how harness design drives coverage per dollar.

Shai-Hulud was the best thing to happen to supply chain security

npm Trusted Publishing sat near-idle after it was released. Then Shai-Hulud and 14 more supply chain attacks pushed adoption 3.4x. Charlie looks at the data behind it.

npm Trusted Publishing sat near-idle for two years. Then Shai-Hulud and 14 more supply chain attacks pushed adoption 3.4x. Charlie looks at the data behind it.

Top image hardening tools in 2026

Top Image Hardening Tools 2026: 7 Compared

Image hardening tools compared for 2026: Aikido, Chainguard, Docker, RapidFort, Echo, Minimus, and Wiz

Best enterprise AI pentesting tools for application security in 2026

Best Enterprise AI Pentesting Tools in 2026

Compare the top enterprise AI pentesting tools of 2026: Aikido, XBOW, NodeZero, Pentera, Hadrian, and Cobalt.

What is CVE remediation in 2026?

What Is CVE Remediation in 2026?

CVE remediation is fixing known flaws in the software you run. Why upgrading often fails, what remediation actually involves, and how backporting fixes it.

We burned 11.7bn tokens to find the best cyber AI model

We burned 11.7bn tokens to find the best cyber AI model | GLM5.3 and DeepSeek are now frontier

We tested 10 AI models on 32 fresh CVEs. DeepSeek V4 Pro found 28, and three cheap runs beat one pass of Opus 5 or Grok on total coverage.

A supply chain attack compromised popular Rust crates, arrayref, append-only-vec, and internment, injecting a dependency on the malicious proc-macro1 package that downloads and executes a remote payload at build time.

A supply chain attack compromised two popular Rust crates, arrayref and append-only-vec, injecting a dependency on the malicious proc-macro1 package that downloads and executes a remote payload at build time.

AI pentesting evaluation checklist: What to look for in an AI pentesting vendor

AI Pentesting Vendor Checklist: What to Look For

A checklist for scoring AI pentesting vendors on validation, code access, scope control, and reliability, plus the red flags that separate a real platform from a strong demo.

Yet another RCE in Gogs, but it's fixed this time!

CVE-2026-52813 | An Aikido pentesting agent flagged a path traversal in Gogs. We escalated it to full RCE and reported two more bugs, all fixed in 0.14.3.

Top enterprise SCA tools in 2026

Top Enterprise SCA Tools 2026 | Aikido

Compare enterprise SCA tools for 2026: Aikido, Sonatype, Snyk, Endor Labs, Checkmarx, Black Duck, and Veracode on intelligence, remediation, and compliance.

Top enterprise DAST tools in 2026

Top DAST tools for enterprises in 2026 | Aikido

Compare the top enterprise DAST tools of 2026 on authenticated coverage, API discovery, exploit validation, governance, compliance, and AI pentesting

Compare the top enterprise DAST tools of 2026 on authenticated coverage, API discovery, exploit validation, governance, compliance, and AI pentesting.

Top unified security tools in 2026

Top unified security tools in 2026 | Aikido

Compare the top unified security tools of 2026: Aikido, Cortex Cloud, Wiz, Checkmarx, Snyk, and Orca, across coverage, correlation, governance, and cost.

From Hugging Face to Fable: this summer shows AI control matters more than trust

AI security: why control matters more than trust

An autonomous AI breach at Hugging Face and Anthropic's Fable suspension show the same thing: trusting a vendor isn't the same as being in control

One AI agent broke into Hugging Face on its own. One AI vendor's access vanished overnight. Here's what they have in common.

Finding vulnerabilities at every stage: what to run, and when

Which security testing tool do you actually need?

SAST, Deep PR Review, Code Security Audit and AI Pentest each catch different vulnerabilities at different stages. Here's when to use each, and why

SAST, Deep PR Review, Code Security Audit, and AI Pentest each catch vulnerabilities at different stages. Here's when to use each, and why.

What is AI harness engineering?

What is harness engineering? | AI harnesses and how they impact AI security

Harness engineering is the code around an AI model that turns it into an agent. What a harness does, why it beats picking a model, and how to build one.

Who was behind the attack? Possibly nobody

Who was behind the attack? Possibly nobody | Anthropic, OpenAI, and AISI's autonomous agent attacks

Three summer disclosures documented AI agents attacking real organizations with no human intent in the chain. Incident response has no box for this yet.

The Aikido Machine: on-prem AI pentesting that never leaves your network

Aikido Machine: on-prem AI pentesting server | Aikido Security

Continuous AI pentesting for teams that can't use the cloud. The Aikido Machine keeps models, code, and results entirely inside your network.

Continuous AI pentesting delivered inside the network of highly-regulated organizations. Belfius, the Belgian bank-insurer is the first to deploy it.

Keyv and friends compromised in active Shai-Hulud supply chain attack

Keyv and friends compromised in npm supply chain attack

Mini Shai-Hulud malware was injected into keyv and eight related npm packages on August 4, 2026 after an attacker compromised the maintainer's GitHub account

Thank you! Your submission has been received!

Oops! Something went wrong while submitting the form.

October 17, 2023

•

Vulnerabilities & Threats

What is a CVE?

CVEs are the security world's shared language for known vulnerabilities, but in 2026, the system is under serious strain. This guide covers how CVEs work, how they're scored with CVSS, and why the databases teams rely on are no longer complete. It also covers what to do about it, including how Aikido Intel surfaces vulnerabilities that never make it into any public database.

Tags/

#Vulnerabilities

#AI

#open-source

September 27, 2023

•

Vulnerabilities & Threats

Top 3 web application security vulnerabilities in 2024

Tags/

#Vulnerabilities

#AppSec

August 22, 2023

•

Company Updates

New Aikido Security Features: August 2023

In the last few weeks, we’ve released many new features and expanded support for different tool stacks. We’ve upgraded our reachability engine to fully support PNPM, expanded AWS rules, pointed Autofix toward Python, and increased support for containers registries.

Tags/

#AppSec

#DevSecOps

August 10, 2023

•

Guides & Best Practices

Aikido’s 2025 SaaS CTO Security Checklist

SaaS companies have a huge target painted on their backs when it comes to security. Aikido's 2024 SaaS CTO Security Checklist gives you over 40 items to enhance security 💪 Download it now and make your company and code 10x more secure. #cybersecurity #SaaSCTO #securitychecklist

Tags/

#AppSec

August 10, 2023

•

Guides & Best Practices

Aikido’s 2024 SaaS CTO Security Checklist

Tags/

#AppSec

July 25, 2023

•

Guides & Best Practices

15 Top Cloud and Code Security Challenges Revealed by CTOs

CTOs all face challenges in securing their product. We wanted to find the trends and discover the needs and concerns of SaaS CTOs. We consulted 15 CTOs from cloud-native software companies about their cloud and code security challenges. Priorities, blockers, flaws, desired outcomes!

Tags/

#AppSec

#Cloud

July 12, 2023

•

Vulnerabilities & Threats

What is OWASP Top 10?

The OWASP Top 10 serves as a vital checklist, identifying the most critical web application security risks and guiding developers in mitigating these vulnerabilities. By adhering to the OWASP Top 10, not only do you protect sensitive data, but you also foster a culture of security awareness, ensuring your application remains resilient in the face of emerging threats.

Tags/

#OWASP

#Vulnerabilities

July 11, 2023

•

Guides & Best Practices

How to build a secure admin panel for your SaaS app

Avoid common mistakes when building a SaaS admin panel. We outline some pitfalls and potential solutions specifically for SaaS builders!

Tags/

No items found.

July 5, 2023

•

Guides

How to prepare yourself for ISO 27001:2022

ISO 27001:2022 replaces ISO 27001:2013. Aikido helps you quickly comply with the new security controls so you and your customers can sleep at night. This blog post walks you through the new requirements and how Aikido supports you.

Tags/

No items found.

June 19, 2023

•

Guides

Preventing fallout from your CI/CD platform being hacked

CI/CD is a prime target for hackers, so take steps that prevent fallout. Aikido Security identifies if your cloud is actively defending your CI/CD.

Tags/

#AWS

#Codeship

#Cloud

#CircleCI

June 12, 2023

•

Guides & Best Practices

How to Close Deals Faster with a Security Assessment Report

Tags/

#AppSec

#DevSecOps

June 5, 2023

•

Guides

Automate Technical Vulnerability Management [SOC 2]

How to become compliant without imposing a heavy workload on your dev team

Tags/

No items found.

product & company updates

October 20, 2026

•

Company Updates

Aikido launches Noon: workforce security for every employee

Aikido launches Noon, a workforce security business. AI governance, device and email protection, and training against AI-powered phishing and deepfakes.

October 6, 2026

•

Company Updates

Aikido Security achieves FedRAMP Moderate authorization

Aikido has achieved FedRAMP Moderate authorization, bringing AI-native, automated vulnerability remediation to U.S. federal agencies.

September 21, 2026

•

Company Updates

Introducing Aikido Altar: the model that makes sovereign security intelligence possible

Aikido Altar is a compressed, open-weight AI model built for sovereign security intelligence, powering Aikido Machine's on-prem, air-gapped pentesting.

Vulnerabilities & Threats

November 12, 2026

•

Vulnerabilities & Threats

wfx-loot campaign pushes CI secret stealer to tens of thousands of repositories

A wave of compromised accounts are pushing a CI secret stealer. See if you’re affected, what it steals, and what to rotate.

Malware

November 2, 2026

•

Vulnerabilities & Threats

Critical Linux kernel TCP vulnerability can allow remote code execution (CVE-2026-98432)

CVE-2026-98432 is a critical Linux kernel TCP flaw rated 9.8 that can allow remote code execution. See who is affected, how to patch and what to do now.

October 22, 2026

•

Vulnerabilities & Threats

eMudhra CA compromise: eight private keys, and one of them is 4 - CVE-2026-111943

Eight eMudhra CA keys could be guessed in at most 256 tries, and one is just the number 4. Who is affected, why curl lagged browsers, and how to fix it.

DevSec Tools & Comparisons

August 28, 2026

•

DevSec Tools & Comparisons

Top 10 Software Composition Analysis (SCA) tools in 2026

SCA tools are our best line of defense for open-source security, this article explores the top 10 open-source dependency scanners for 2026

Tools

SCA

August 25, 2026

•

DevSec Tools & Comparisons

Top SonarQube Alternatives in 2026

Explore top SonarQube alternatives for static code analysis, bug detection, and clean code in 2026.

Tools

August 19, 2026

•

DevSec Tools & Comparisons

Top 10 Dynamic Application Security Testing (DAST) Tools in 2026

Discover the 10 top best Dynamic Application Security Testing (DAST) tools in 2026. Compare features, pros, cons, and integrations to choose the right DAST solution.

Tools

DAST

Guides & Best Practices