PentesterLab's Blog: Insights, weekly research highlights, and deep dives into web security, code review, and pentesting.

RSS
Filter: All Research APPSEC AuthZ CAREER Code Review Insight JWT PENTESTING

The Inner Circle

A few years ago, a friend stayed at my place during Ruxcon and gave me a bottle of rum called Inner ...

Louis Nyffenegger Oct 2, 2026 · 4 min read
Weekly Research

Research Worth Reading - Week 37, 2026

🧩 From Padding Oracle to Shell: Unauthenticated RCE in Telerik UI for ASP.NET AJAX • 🔥 Out of Bounds, Out of Sandbox: RCE in Go JavaScript Engine • 🏭 Countering misuse of AI: September 2026 / Anthropic

PentesterLab Sep 15, 2026

JWT Security: How to Secure JWTs and Avoid Common Vulnerabilities

JSON Web Tokens (JWTs) are everywhere in modern authentication, and for good reason: they are compact, self-contained and easy to pass ...

Louis Nyffenegger Sep 8, 2026 · 11 min read
Weekly Research

Research Worth Reading - Week 36, 2026

❄️ When it Snows it Pours - Anatomy of a ServiceNow Red Team - MDSec • 🪤 Breaking Claude Code Opus 5 Auto Mode • ⛓️‍💥 Compromising Cleo Harmony: A SAML Bypass Chain to Arbitrary Code Execution

PentesterLab Sep 6, 2026

What Has Always Been the Moat in Pentesting?

Artificial intelligence has prompted a question our industry should have asked long ago: what is the moat in pentesting? For years, ...

Louis Nyffenegger Sep 1, 2026 · 4 min read
Weekly Research

Research Worth Reading - Week 35, 2026

💎 Ruby Marshal Kick-off Gadgets - elttam • ␛ VMs won't contain cyber-capable agents - The Trail of Bits Blog • ☕️ Escaping Google Cloud Application Integration Sandbox: Straight into Borg

PentesterLab Aug 31, 2026
Weekly Research

Research Worth Reading - Week 34, 2026

🤖 Patterns and problems in multiagent systems \ Anthropic • ⚒️ Staying Ahead of Adversarial AI Through Agentic Source Code Review | Google Cloud Blog • 💸 We burned 11.7bn tokens to find the best cyber AI model | GLM5.3 and DeepSeek are now frontier

PentesterLab Aug 23, 2026
Weekly Research

Research Worth Reading - Week 33, 2026

🏭 visa/visa-vulnerability-agentic-harness: Visa Vulnerability Agentic Harness • 🔀 LLM Heist: Hijacking LiteLLM for Traffic Interception, Key Theft, and Tool-Call Injection • 💎 Ruby 4.0 Universal RCE Deserialization Gadget Chain - elttam

PentesterLab Aug 17, 2026
Weekly Research

Research Worth Reading - Week 32, 2026

✅ AI Guardrails That Prove, Not Guess • 🧠 GitHub - Kritt-ai/open-kritt: Open-source, self-hosted AI vulnerability research tool that orchestrates agents to find and validate security issues in code. · GitHub • 🐚 Cruising for Shells in Flowise - elttam

PentesterLab Aug 13, 2026

SAML Vulnerabilities and Attacks: A Practical Guide

Security Assertion Markup Language (SAML) is a widely deployed standard for Single Sign-On (SSO) in the enterprise, and a recurring source ...

Louis Nyffenegger Aug 12, 2026 · 32 min read
Weekly Research

Research Worth Reading - Week 31, 2026

🪲 CVE-2026–44722: A Zip encryption downgrade caused by an incorrect operator • 🪲 Finding six NGINX vulnerabilities with open models • 🤗 Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident

PentesterLab Aug 4, 2026

The AI Pentesting Winners May Not Be AI Startups

Every few weeks, another startup announces an AI pentester. Looking at the market, it feels as though the future of AI ...

Louis Nyffenegger Aug 3, 2026 · 6 min read