Practical guides on penetration testing, vulnerability research, and AI-powered security tools.
184 articles
A threat actor claims to hold a massive iFood customer database and is demanding payment to suppress it. The pay-or-leak model, why CPF and contact data is dangerous, and concrete steps for businesses and customers.
How attackers use AI across the kill chain, what new risks AI adoption creates, why traditional pentests fall short, and how pentesty.co tests against AI-driven TTPs.
Misconfigurations still dominate cloud incidents. Hybrid sprawl, IAM as a frontline, and why checklist security misses real attack paths. Plus how cloud-aware pentesting closes the gap.
White-on-white text in a labor court petition targeted Brazil's judicial AI (Galileu). The judge called it prompt injection, imposed a fine, and referred the lawyers for discipline , a field lesson in indirect injection for any org that feeds external documents to LLMs.
Five phases from access to leak, why exfiltration-only extortion scales, what makes detection hard, and concrete controls , from cloud permissions to continuous pentesting.
After ShinyHunters leaked internal analytics in April 2026, the case became a textbook argument against paying extortion: scope, optics, legal risk, and what to build before the deadline hits.
The bank confirmed unauthorized access to international-account data after a cyberattack. Why finance is targeted, what clients should do today, assume-breach design, LGPD/GDPR angles, and why compliance is not the same as security.
ShinyHunters claimed 1.4M users hit with a pay-or-leak ultimatum. What was exposed, why learning platforms are targeted, credential reuse risk, and concrete steps for users and defenders.
A CVSS 9.8 CRLF injection in cPanel & WHM session loading granted unauthenticated admin access. Patch table, suspected zero-day timeline, and what to run on your servers today.