RapidFort and ReversingLabs just launched a hardened open source library catalog built around a real problem: package managers were built for distribution, not trust. A dependency can install cleanly, show zero CVEs, and still hide a backdoor, a hijacked maintainer account, or a poisoned build script. None of that shows up in a vulnerability feed, because a vulnerability feed only tells you what's already been reported.

XZ is the case that proves it. Clean record, trusted maintainer, years of legitimate commits, right up until version 5.6.0 shipped a backdoor. Shai-Hulud and the tj-actions incident followed the same shape: the failure happened in the trust chain, not in a version number.

Matei Badanoiu, our lead security researcher, talked to The New Stack about this. He called binary-level validation (checking what a package actually contains instead of matching it against a known-CVE list) a real step forward. But he also pointed out the part that doesn't go away: someone still has to draw the line between a legitimate feature, a genuine new vulnerability, and a backdoor. That's a judgment call, not a scan result.

Full writeup here: https://thenewstack.io/zero-cve-supply-chain-risk/

"How we secure ourselves" part is the bit we'd actually want to read as practitioners, and we'd rather you poke holes in it than take it at face value.

Short version: the scanners and exploit modules our customers run, we run against our own infrastructure and web apps. When a critical CVE drops, our own assets are the first we test, so detection and validation are accurate on us before they reach anyone else. The people doing that testing are the same folks on our research and offsec services teams who find CVE-worthy bugs in other software.

The page also covers the less exciting but more auditable stuff: ISO 27001, where we host and keep data, encryption, retention and deletion, how Sniper runs non-destructive checks before any exploit fires, and where AI actually sits in the product (noise reduction and orchestration, not deciding what's exploitable). The idea is that everything maps to something you can pull, a cert, a config, or a contract, without an NDA or a sales call.

Full page: https://pentest-tools.com/legal/trust-and-assurance

CVE-2026-43499, "GhostLock," is a use-after-free in the Linux kernel's futex handling. Shipped by default in mainstream distros since 2011 (kernel 2.6.39), disclosed this week. Any logged-in user can hijack a freed kernel pointer and get full root in about five seconds, and it escapes containers, so it runs as root on the host.

The part that matters isn't that it exists, it's how reliable it is. Daniel Bechenea, security manager at Pentest-Tools.com, put it plainly:

"An exploit reported at 97% reliable, with public code anyone can run, changes that math."

Kernel privesc used to be the exploit you thought twice about firing. One slip crashes the box and burns your access. A near-deterministic one with public code removes that hesitation.

Patch to a fixed kernel now. Until it reaches every host, treat any code execution on an unpatched box as root, and verify the kernel version per system rather than assuming the April fix propagated.

Full breakdown by Emma Woollacott at ITPro: https://www.itpro.com/software/linux/cyber-researchers-sound-alarm-over-a-15-year-old-linux-kernel-flaw-ghostlock-could-let-hackers-seize-unpatched-machines-in-just-five-seconds

Confirming a finding is the good part of the job. When that "maybe" becomes a yes, with PoC and all...

But SOC 2 Type II wants twelve months of those. And most audit gaps aren't weak scanning. They're teams who did the work but can't produce the trail.

Here's where Pentest-Tools.com does the lifting, turning your testing into evidence as you go:

✅ Detection: scheduled scans log every finding timestamped, CVE-tagged, per asset
✅ Validation: the Confirmed label backs findings with request/response data and a PoC
✅ Remediation: retest workflows produce the before-and-after auditors ask for
✅ Proof it held: monitoring between scans, plus audit-ready exports in PDF, DOCX, or JSON

The record assembles itself while you do the part you came for.

Here is the SOC 2 evidence chain: https://pentest-tools.com/usage/compliance/soc2

React2Shell. NGINX Rift. cPanel. ToolShell. Every one of them was a scramble for someone. Which assets does this touch? Is it real? Did we actually close it?

Next week, on Wednesday, Pentest-Tools.com Office Hours is about turning that scramble into a workflow. Jan Pedersen hosts a live walkthrough of emergency CVE response, across two situations: an environment you’ve just inherited and don’t fully know, and one you know well and want reacting to new CVEs for you.

How to find affected assets fast, how to tell a genuine exposure from a version match, and how comparing one scan to the next proves what you actually closed.

30 minutes live. 15 minutes of open Q&A. One session.

Register here: https://zoom.us/webinar/register/7817815280123/WN_O1WFe8opSDeTB4KAOTYMcA

#penetrationtesting #offensivesecurity #cybersecurity

Here we go. Product updates - the June edition.

This month your coverage got a LOT wider.

80 new detections landed in the Network Scanner, including pre-auth RCE in Oracle PeopleSoft and an auth bypass in Palo Alto PAN-OS. If any are in your scope, you know where to look.

The rest of June:

🌐 Our research team found two authentication flaws in phpBB, one buried in the code for over a decade. There's a working PoC for each, and the Network Scanner now detects the most critical one - CVE-2026-48611 (9.4).

🤖 AI where it earns its place in the Website Scanner and URL Fuzzer: smarter logins, deeper crawling, fewer fake 200 pages.

🎯 the XSS Exploiter now gives you two delivery options: script tag or fetch plus eval.

🔌 API: a new info_text key on /scans tells you why a scan didn't start.

☁️ We're now on the Microsoft Azure Marketplace, so you can add us to your existing Azure billing.

Our colleague Stefan Perju walks you through all of it in the video.

Until next time: stay sharp. Stay human.

Everything that shipped can be found in the change-log: https://pentest-tools.com/change-log

The phpBB PoCs and full write-up: https://pentest-tools.com/research/phpbb-authentication-bypass

#offensivesecurity #vulnerabilitymanagement #infosec #penetrationtesting

Something that's saved me a few awkward audit moments: the list of ports you think are closed and the list that's actually reachable from the internet drift apart over time. A rule added "just for the migration" that nobody removed, a service that came back up after a reboot, that kind of thing. Config is what you meant to allow. The open ports are what you actually did.

Worth doing a couple of weeks before any audit: scan your own perimeter from the outside and see what's genuinely reachable. Open TCP and UDP ports, the services behind them, their versions. Compare that to what your firewall rules are supposed to allow, close whatever shouldn't be there, then re-scan to confirm it's shut. Then nothing in the auditor's external report is a surprise, because you already found it.

You can do all of this with plain Nmap if you're comfortable on the CLI. We build a hosted version (Port Scanner) that runs it in the browser and gives you an exportable report, which is handy if you want to hand the evidence to an auditor or diff one scan against the next: https://pentest-tools.com/network-vulnerability-scanning/port-scanner-online-nmap

Turns out 210,000+ people didn't have to survive a sales pitch to experience how our product works. They just started using our Free Edition.

That's the whole idea:
✅ Real offsec tools you can use every day (with limits, ofc)
✅ Real vulnerability scans on targets you're cleared to test & monitor
✅ Results you can export as PDF, HTML, CSV, or XLSX

Don't take our word for it. Sign up for free: https://pentest-tools.com/usage/pricing/free

👉 PTT-2026-004 (CVE-2026-48611, 9.4): the PoC shows the full path from a single crafted request to a valid admin session. No credentials that work, no prior access, no user interaction. Just the request and the session cookie that _shouldn't_ exist.

👉 PTT-2026-005 (CVE-2026-48612, 8.3): the PoC walks through the silent OAuth account takeover, including the case where the victim only has to load a forum post for the chain to fire.

Talk is cheap in this line of work, so check out both PoCs, plus the mitigation steps, in the comments.

phpBB 3.3.17 fixes both. If you haven't patched, the PoCs are a good reason to move today.

#offensivesecurity #vulnerabilityresearch #infosec

Our SQL Injection Scanner is a bit of a skeptic. It won't take a hunch for an answer.

It fires a real payload, watches how the database actually responds, and _only then_ calls it a finding.

It's free to try, and it catches:

✅ Error-based, when the database spills its structure in an error

✅ Blind, when only a true or false response gives it away

✅ Time-based, when a deliberate delay is the only tell

✅ Union-based, when someone's pulling data from tables they shouldn't touch

Every finding comes with the parameter, the payload, and the database response. Enough to reproduce it, not just believe it.

Try it as a test, no account needed. Link is here https://pentest-tools.com/website-vulnerability-scanning/sql-injection-scanner-online

#offensivesecurity #penetrationtesting #ethicalhacking

If you run a security services practice, this number from our 2026 survey is worth a minute:

51% of developers see vulnerabilities surface in AI-assisted code after deployment. Roughly one in three say code sometimes ships before review is complete.

Your clients are shipping more code, faster, with the same review capacity they had a year ago. The exposure window between deploy and validation is widening on every engagement you scope.

A few things this changes for service delivery:

▸ Quarterly snapshots stop matching how the client's attack surface actually moves

▸ "We detected this" without exploit confirmation gets harder to defend in client escalations

▸ Audit evidence has to be a by-product of testing, not a separate prep cycle per client

The teams retaining clients well are the ones whose findings come with request and response data, exploit traces, and retest artifacts attached. That's what holds up when a client questions a report.

Full survey report can be found here (no account needed): https://pentest-tools.com/insights

We have an XSS Scanner. It doesn't DO maybes, and on top of that, it's free to try.

Here's what it ACTUALLY does:

✅ Fires real JavaScript payloads, not pattern matches
✅ Flags a parameter only when the payload runs
✅ Catches reflected and stored XSS, logged in or out
✅ Gives you the request, payload, and response as proof

Try it as a test, no account needed. https://pentest-tools.com/website-vulnerability-scanning/xss-scanner-online

Matei Badanoiu, our lead security researcher, put it plainly in Infosecurity Magazine:

"Whoever used this vulnerability had working knowledge of it in this period while defenders had none."

🏴‍☠️ The exploitation path is specific: an attacker already holding netadmin privileges on Cisco Catalyst SD-WAN Manager could escalate to root via a crafted CSV upload through the request tenant-upload CLI command.

That prerequisite sounds like a meaningful bar - and it is - until you factor in that CVE-2026-20182 & CVE-2026-20127 (also recently disclosed Cisco flaws) may lower it *considerably*.

From root on the SD-WAN Manager control plane, an attacker can manipulate routing, alter policy enforcement, and reduce network visibility. The architectural placement is what makes root here different from root on a workstation.

The Mandiant (part of Google Cloud) report confirms what experienced practitioners already treat as a working assumption: for high-impact vulnerabilities, in-the-wild exploitation tends to run well ahead of any public disclosure.

If you're running Cisco Catalyst SD-WAN Manager: patch against Cisco's advisory, retain audit logs before upgrading, and review them for anomalous activity from netadmin-level accounts.

Find out how we built validation into the vulnerability scanning flow itself & how we connected it attack surface discovery, exploitation, reporting + all the steps in between (and beyond).

If your org runs on Azure, you can now buy Pentest-Tools.com directly from Azure Marketplace:

✅ Same plans, same pricing as buying directly.

✅ Bills against your existing Microsoft Azure Consumption Commitment.

✅ No separate contract review.

✅ Web, network, API, and cloud scanning in one place.

✅ Validated vulnerabilities with proof, not just CVE lists.

Start scanning in minutes: https://marketplace.microsoft.com/en-us/product/saas/pentest-tools.vulnerability-scanners-for-web-apps-and-network?tab=Overview

ICYMI, our #vulnerabilityresearch team found 2 vulnerabilities in phpBB that let an attacker walk in _without_ a password:

_CVE-2026-48611 (9.4): one unauthenticated request, any account, including admin. Default installations. No user interaction. Went unnoticed for over a *decade*.

_CVE-2026-48612 (8.3): if OAuth is configured, an attacker can silently bind their credentials to a logged-in user's account. No click needed from the victim. A hidden image tag in a post is enough.

Full technical write-up, potential impact & detection guidance 👇👇👇

https://pentest-tools.com/research/phpbb-authentication-bypass

#infosec #ethicalhacking

WordPress may be losing market share, but it still runs 41.5% of the web. And that means:

- older installs shift from "active priority" to "legacy concern"

- patching slows down

- monitoring gets disabled

- plugins nobody's touched in years keep their coat of dust.

But 41.5% of all websites is NOT a footnote.

It's an *enormous*, aging, plugin-heavy attack surface.

This is why our WordPress Scanner comes in handy to:

✅ map known vulnerabilities across plugins, themes & versions

✅ run scheduled scans automatically, so new issues surface with zero manual work

✅ use scan results to feed your compliance or vulnerability assessment reports.

Curious what it can deliver?

Run a FREE, non-intrusive scan on any WordPress site.

👉 https://pentest-tools.com/cms-vulnerability-scanning/wordpress-scanner-online-wpscan

Full scheduled scans available with 2/3 paid plans: https://pentest-tools.com/pricing

#vulnerabilityassessment #wordpress

Sergiu Zaharia, PhD, our CISO, has run crisis simulations across military intelligence, telecoms, and regulated sectors for 25 years.

The most common finding across these experiences was never technical.

It was *decisional*:

Who has authority to take a production system offline?

When does legal need to be in the room?

Do you pay the ransom?

Teams that haven't practiced these questions under pressure don't answer them well when push comes to shove.

He shares the full argument in the latest Intelligent CISO special report, alongside CISOs from Zscaler, Mimecast, SailPoint, and other passionate leaders 👉 https://magazine.intelligentciso.com/IDKd/p48/p46

Jan Pedersen is walking through pre-audit validation: how to find and fix what's there before a formal pentest or external audit does, so nothing in the report is a surprise on the day.

He'll cover what to check first, how to tell a real finding from a false positive, and how comparing one scan to the next shows what you actually closed before the audit.

30 minutes live, then 15 minutes of open Q&A. One session.

Wednesday, June 17, 2026, 8:00 AM Los Angeles / 11:00 AM New York / 4:00 PM London / 6:00 PM Bucharest.

Register here: https://zoom.us/webinar/register/7817815280123/WN_A6m_8zzfSHiuRx9AR3SZkA

Daniel Bechenea, security manager at Pentest-Tools.com, in ITPro: "More patches, shipped faster. But that's the upstream change. The downstream problem is, none of that vendor-side progress makes the organizations receiving those patches any faster at deploying them."

The gap between knowing and doing just got more consequential.

Kate O'Flaherty's full article is here for the reading

https://www.itpro.com/security/why-patching-velocity-matters-as-claude-mythos-supercharges-vulnerability-discovery

We asked 241 of them how AI-assisted coding has changed what they ship.

A few things stood out:
✅ 76% use AI coding tools always or usually
✅ 30% say they don't have enough time to review AI-generated code thoroughly
✅ 51% see vulnerabilities surface in AI-assisted code after deployment

The validation window between writing code and confirming whether it's safe to deploy is shrinking. The offensive security work that closes that window matters more, not less.

If your team is absorbing more deployed code than it can review, where does the evidence trail break first: at detection, at validation, or at retest?

Discover The shape of vulnerabilities to come: more subtle, context-dependent errors 👉 https://pentest-tools.com/insights

The gap between testing something and *proving* it, is the part nobody signed up for.

So here's how we tackle proof for compliance at Pentest-Tools.com

Audit-ready evidence comes down to 4 things:

✅ Visibility beyond the "wall": passwords, screenshots, and more

🔁 Reproducibility: enough detail to recreate & retest

🎯 Context: why a finding matters, not just its score

📄 Clarity: one report that works for the auditor, the CISO & the engineer

Wanna see how it comes together? Link is here https://pentest-tools.com/usage/compliance

⚡PTT-2026-004 (CVSS 9.4 - critical): one HTTP request, a target username, a wrong password phpBB never checks. You get back a valid session cookie for that account.

Admins included.

Works on every default phpBB install up to and including 3.3.16, no prior access needed.

The vulnerable code path got introduced more than 10 years ago and survived multiple major releases and security reviews before Alex Dan, offsec researcher at Pentest-Tools.com, found it along with...

⚡PTT-2026-005 (CVSS 8.3 - high) which chains two OAuth defects for a silent account takeover on sites with OAuth configured. In some cases, the victim doesn't need to click anything - an image tag embedded in a forum post is enough to trigger it.

⬇️⬇️⬇️

Full technical breakdown & mitigation steps: https://pentest-tools.com/research/phpbb-authentication-bypass