PentesterLab's Blog: Insights, weekly research highlights, and deep dives into web security, code review, and pentesting.

RSS
Filter: All Research APPSEC AuthZ CAREER Code Review Insight JWT PENTESTING
Weekly Research

Research Worth Reading - Week 36, 2026

❄️ When it Snows it Pours - Anatomy of a ServiceNow Red Team - MDSec • 🪤 Breaking Claude Code Opus 5 Auto Mode • ⛓️‍💥 Compromising Cleo Harmony: A SAML Bypass Chain to Arbitrary Code Execution

PentesterLab Sep 6, 2026
Weekly Research

Research Worth Reading - Week 35, 2026

💎 Ruby Marshal Kick-off Gadgets - elttam • ␛ VMs won't contain cyber-capable agents - The Trail of Bits Blog • ☕️ Escaping Google Cloud Application Integration Sandbox: Straight into Borg

PentesterLab Aug 31, 2026
Weekly Research

Research Worth Reading - Week 34, 2026

🤖 Patterns and problems in multiagent systems \ Anthropic • ⚒️ Staying Ahead of Adversarial AI Through Agentic Source Code Review | Google Cloud Blog • 💸 We burned 11.7bn tokens to find the best cyber AI model | GLM5.3 and DeepSeek are now frontier

PentesterLab Aug 23, 2026
Weekly Research

Research Worth Reading - Week 33, 2026

🏭 visa/visa-vulnerability-agentic-harness: Visa Vulnerability Agentic Harness • 🔀 LLM Heist: Hijacking LiteLLM for Traffic Interception, Key Theft, and Tool-Call Injection • 💎 Ruby 4.0 Universal RCE Deserialization Gadget Chain - elttam

PentesterLab Aug 17, 2026
Weekly Research

Research Worth Reading - Week 32, 2026

✅ AI Guardrails That Prove, Not Guess • 🧠 GitHub - Kritt-ai/open-kritt: Open-source, self-hosted AI vulnerability research tool that orchestrates agents to find and validate security issues in code. · GitHub • 🐚 Cruising for Shells in Flowise - elttam

PentesterLab Aug 13, 2026
Weekly Research

Research Worth Reading - Week 31, 2026

🪲 CVE-2026–44722: A Zip encryption downgrade caused by an incorrect operator • 🪲 Finding six NGINX vulnerabilities with open models • 🤗 Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident

PentesterLab Aug 4, 2026
Weekly Research

Research Worth Reading - Week 30, 2026

⚒️ ethiack / ethibench • ⚒️ capitalone / VulnHunter • 🪲 FastJson 1.2.83 Remote Code Execution

PentesterLab Jul 27, 2026
Weekly Research

Research Worth Reading - Week 29, 2026

🤖 Special Token Injection (STI) Attack Guide • 🪲 MAD Bugs: My Cousin Vinyl (CVE-2026-50052) • 🪲 From Indirect Prompt Injection to DNS Exfiltration in macOS Terminal

PentesterLab Jul 20, 2026
Weekly Research

Research Worth Reading - Week 28, 2026

🖥️ Local AI for Penetration Testing & Research • 🧠 The context an agent needs to find the next vulnerability. • 🤖 The Bug Bounty Singularity: Our Hackbot

PentesterLab Jul 13, 2026
Weekly Research

Research Worth Reading - Week 26, 2026

🩹 Introducing Patch the Planet • 🤖 Building an AI pentesting platform • 🤖 Comparing AI Application Security Testing Platforms

PentesterLab Jun 29, 2026
Weekly Research

Research Worth Reading - Week 25, 2026

🐴 DietrichGebert / ponytail • 🤯 curl summer of bliss • ⛓️ Chaining Security Bugs in Discuz! X5.0: from Race Condition to Pre-Auth RCE

PentesterLab Jun 24, 2026
Weekly Research

Research Worth Reading - Week 24, 2026

🪲 Jupyter Enterprise Gateway • 🤖 Measuring LLMs’ impact on N-day exploits • 🎆 Bypassing a 3 layer SVG sanitizer: Stored XSS in Mozilla

PentesterLab Jun 15, 2026