Welcome to our blog.
Surviving cybersecurity until the end of 2026
After Binance, LiteLLM, PHP2Shell and eMudhra, here are six practices and a checklist to limit what the next compromise can reach before 2027.
Critical Linux kernel TCP vulnerability can allow remote code execution (CVE-2026-98432)
Under specific conditions, a remote attacker with no credentials can run code on an unpatched Linux server, and a proof of concept has been reported for servers with a multipath TCP listener. See who is affected, how to patch, and what to do if your vendor has no fix yet.
2026 State of AI in Pentesting
Our latest report captures the perspectives of 400 CISOs, CTOs, and senior engineering leaders across Europe and the US. It explores how AI is changing penetration testing, why traditional approaches are struggling to keep pace with modern software delivery, and what security leaders want from the next generation of penetration testing.
Shai-Hulud was the best thing to happen to supply chain security
npm Trusted Publishing sat near-idle for two years. Then Shai-Hulud and 14 more supply chain attacks pushed adoption 3.4x. Charlie looks at the data behind it.
Popular Rust crates arrayref, append-only-vec, and internment compromised in Supply Chain Attack
A supply chain attack compromised two popular Rust crates, arrayref and append-only-vec, injecting a dependency on the malicious proc-macro1 package that downloads and executes a remote payload at build time.
What is AI harness engineering?
Harness engineering is the code around an AI model that turns it into an agent. What a harness does, why it beats picking a model, and how to build one.
Who was behind the attack? Possibly nobody
Three summer disclosures documented AI agents attacking real organizations with no human intent in the chain. Incident response has no box for this yet.
Four incident-response decisions from the Hugging Face breach
Recon, stolen credentials, hidden C2, and rebuild-or-patch. Four Hugging Face breach decisions that show whether you can catch an attack in progress.
Better generic secrets detection starts with finding non-secrets
Some API keys are meant to be public. Betterleaks now removes them from generic secret findings, dropping thousands of false positives per scan.
Finding eight high-severity vulnerabilities in NodeBB in six hours
Eight high-severity NodeBB vulnerabilities, found by our AI Pentest in six hours. Full technical breakdown of the XSS chains, auth bypasses, and post hijacking.
SQL injection isn't dead
The fix for SQL injection is decades old and still works. So why did WordPress core just need an emergency patch for one? The data, and how to defend against it.
Aikido launches Noon: workforce security for every employee
Aikido launches Noon, a workforce security business. AI governance, device and email protection, and training against AI-powered phishing and deepfakes.
wfx-loot campaign pushes CI secret stealer to tens of thousands of repositories
A wave of compromised accounts are pushing a CI secret stealer. See if you’re affected, what it steals, and what to rotate.
Top 10 Software Composition Analysis (SCA) tools in 2026
SCA tools are our best line of defense for open-source security, this article explores the top 10 open-source dependency scanners for 2026
AI Pentesting Buyer's Guide: How to evaluate AI pentesting vendors
Learn how to evaluate AI pentesting vendors with practical buying criteria, research from 1,000+ AI pentests, and a downloadable evaluation checklist.
A practical CTO security checklist to be Mythos-ready
A practical checklist for SaaS CTOs navigating a world with Mythos and agentic AI threats. Built around the defender's advantage: you have context attackers have to work to get. Covers the controls, practices, and operational habits that determine whether your team finds and fixes issues before someone else does.
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system.
Connect a repo to discover what the reasoning agents find in your codebase.
