Notes on the practice of security.
Guides, opinion, and analysis of other people's incidents. Original research is in the lab.
Articles
5
All Articles
500 Websites on One Box: India's Shared Hosting Attack Surface
India's shared hosting market runs almost entirely on cPanel, and the entire stack lives on one box. In the last 30 days, cPanel's authentication was bypassed as a zero-day for two months (CVE-2026-41940), ProFTPD's SQL escaping logic was defeated with dollar-quoted payloads (CVE-2026-42167), and 2,100 Indian servers were confirmed compromised. We mapped the compound attack surface, the CERT-In advisory gap, and what the EIG/Newfold consolidation means for three of India's largest hosting brands sharing one patching decision.
Finding Vulnerabilities Doesn't Fix Them: The Penetration Testing Remediation Gap
Most penetration tests fail after delivery. Learn why most of breaches exploit known vulnerabilities and how to close the remediation gap that puts your organization at risk.
Inside OAuth Exploitation: How Attackers Chain Misconfigurations to Compromise Enterprise SSO
Technical analysis of OAuth and SAML exploitation techniques used in 2026 breaches. Learn how attackers chain misconfigurations for SSO compromise and how penetration testing reveals defensive gaps.
The AI Governance Gap: Why Security Testing Finds What Compliance Checklists Miss
AI adoption is outpacing security governance. Learn why compliance fails to catch AI vulnerabilities and how adversarial testing reveals real risks in 2026.
M&A Security Due Diligence: Why Security Audits Miss What Actually Matters
M&A security audits check compliance boxes but miss critical vulnerabilities. Explore why acquirers need penetration testing to reveal real risks before deals close.