Technical research for real attack paths.
Offensive-security research covering application, API, cloud, desktop and AI security—including workload-identity ransomware paths, authorisation chains and agentic attack surfaces—with practical testing methodology and defensive guidance.
- 46 published technical studiesResearch library
- 26 threat-intel notesPatch, hunt and verify
- 6-part Electron seriesPlus a deep dive
- Attack paths and fixesTesting method and defensive guidance
SSRF in web applications: how it is found, what it leads to, and how to prevent it
Server-side request forgery turns an application's own "fetch this URL" features into a route past the firewall. This is what it is, where it appears, what it leads to, and the controls that stop it.
Read research →
Research library
Threat intel and patch guidance
- Threat intel
SSRF in web applications: how it is found, what it leads to, and how to prevent it
Server-side request forgery turns an application's own "fetch this URL" features into a route past the firewall. This is what it is, where it appears, what it leads to, and the controls that stop it.
5 MIN READ↗ 
Threat intelSonicWall SonicOS SSL VPN CVE-2026-19868: exploited SAML and MFA bypass, patch now
SonicWall has fixed CVE-2026-19868, a flaw in the SonicOS SSL VPN service that can let someone holding valid credentials for a different login method get past SAML authentication, including SAML-enforced MFA. SonicWall says it investigated a report of exploitation, and CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalogue on 6 November 2026. Only SSL VPNs with SAML login enabled are affected. There is no workaround: upgrade Gen7 firewalls to SonicOS 7.3.4-7013 and Gen8 to 8.2.3-8015, then review recent VPN sessions.
3 MIN READ↗
Threat intelCERT-In CIAD-2026-0058 and CRAFTY FALCON: Six Assumptions Indian BFSI Teams Should Test Now
CERT-In says the payout-API campaign has escalated and has re-hit firms that already remediated. Six assumptions it breaks, and how to test each one safely.
10 MIN READ↗
Threat intelAirbyte Connector Builder RCE (GHSA-g35w-6r6v-h4r7): exploitation confirmed, upgrade self-managed deployments
JVN has confirmed in-the-wild exploitation of an arbitrary-code-execution flaw in Airbyte's Connector Builder and Manifest Server (GHSA-g35w-6r6v-h4r7 / JVN#12040144). Self-managed Airbyte before 2.2.0 is affected; Airbyte Cloud customers do not need to take action. Upgrade to 2.2.0 or later, restrict network access to Builder/Manifest Server, and tighten Reader roles until you are on a fixed build.
5 MIN READ↗
Threat intelZyxel GS1900 switches: zero-day CVE-2026-107441 was behind the 996-switch compromise, and the June patch did not stop it
Attackers compromised 996 Zyxel GS1900 switches in 48 countries from around mid-August 2026. The activity was first blamed on CVE-2026-7273, fixed in June, but Binarly found the exploit worked against the June firmware by abusing a separate flaw, now CVE-2026-107441. Zyxel shipped fixed firmware in late October and published its advisory on 3 November. If you patched in June and stopped there, your switches may have stayed exposed until late October.
4 MIN READ↗
Threat intelNode2Shell (CVE-2026-111497): Brotli decoder flaw now in CISA KEV – what to patch and how to cut exposure
CVE-2026-111497 in Google's Brotli decoder is in CISA KEV and ELLIO has reported exploit traffic. Update Node.js, Bun, .NET, Envoy, Istio and Python Brotli, restart, and cut exposure while you patch.
6 MIN READ↗
Threat intelFragnesia (CVE-2026-46300): Linux kernel flaw now exploited with PHP2Shell to root firewalls
CISA lists the Linux kernel flaw Fragnesia as exploited, and Dream Research reports it chained with PHP2Shell to root firewalls. Capture evidence before you reboot, then patch the kernel and PHP.
8 MIN READ↗
Threat intelGitLab CVE-2026-97229: exploited CI/CD regex flaw, and why upgrading GitLab alone may not fix it
CISA lists GitLab CVE-2026-97229 as exploited. Patch GitLab, check the Ruby it actually runs on, and look for signs of compromise, because upgrading GitLab alone may not close the hole.
8 MIN READ↗
Threat intelBlack October: AI Developer Platforms Breached for Customer AI Keys. What to Rotate and How to Test
Attackers went after the platforms that hold your AI keys. What to rotate now, and the six paths to test if you run a platform that stores customer secrets.
9 MIN READ↗
Threat intelNode-RED CVE-2026-58115 exploited in the wild: lock down unauthenticated editors on OT and IoT gateways
VulnCheck has confirmed in-the-wild exploitation of CVE-2026-58115, a CVSS 10.0 missing-authentication flaw in Node-RED on Siemens SIMATIC IoT2050 Advanced gateways, from 30 October 2026. Attackers are deploying flows that drop Linux implants or leave webshells. Update to Industrial OS V4.3.4.1, enforce Node-RED admin authentication everywhere, remove internet exposure, and review deployed flows.
4 MIN READ↗
Threat intelWordPress Core CVE-2026-119977: exploited upgrade-window flaw, and why the order of your update steps matters
CISA added WordPress Core CVE-2026-119977 to its Known Exploited Vulnerabilities catalogue on 3 November 2026, with a federal due date of 6 November and forensic triage required. The flaw affects WordPress 4.7.0 to 7.1.3 and can let an unauthenticated attacker run code on the server during the few seconds a full core upgrade is in progress, because the upgrade stages files in a predictable, web-reachable folder. Update to 7.1.4 or your branch's fixed release, block web access to wp-content/upgrade/ before you update, and check logs for activity during past update windows.
3 MIN READ↗
Threat intelArista VeloCloud Orchestrator Zero-Day CVE-2026-114625: Patch On-Prem VCO and Check for Compromise
Arista has fixed an actively exploited critical flaw (CVSS 9.9) in on-premises VeloCloud Orchestrator, now in CISA KEV. Upgrade to 5.2.3.18, 6.1.3.10 or 6.4.2.12, restrict access to the portal, and review logs before and after patching.
6 MIN READ↗
Threat intelNextcloud Built-in CODE Server (Collabora) CVE-2026-110447: exploited since September, now in CISA KEV
CVE-2026-110447 in Nextcloud's Built-in CODE Server app has been exploited since September and is in CISA KEV. Update to 26.4.303 or remove the app, then check for web shells.
5 MIN READ↗
Application security · Threat intelPHP2Shell (CVE-2026-109618 and CVE-2026-109619): Patch the PHP Runtime, Harden What You Can’t
Two critical flaws in the PHP engine itself allow unauthenticated remote code execution and memory disclosure. Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, restart every worker, and isolate or harden end-of-life PHP.
8 MIN READ↗
Cloud security · Threat intelCitrix NetScaler CVE-2026-88771 and CVE-2026-88779 Chained for Root: Patch, Hunt, Rotate
Attackers are chaining two KEV-listed NetScaler flaws for root access, web shells and internal reconnaissance. Patch both, hunt for compromise and rotate secrets.
5 MIN READ↗
Threat intelPAN-OS GlobalProtect CVE-2026-0257 Now Used by Ransomware Crews: Patch, Fix the Certificate, Hunt
Ransomware operators are using PAN-OS GlobalProtect CVE-2026-0257 to get past MFA onto corporate VPNs, then moving to vCenter and ESXi. Patch or apply the mitigation, and review VPN logs back to May.
5 MIN READ↗
Threat intelBeyondTrust Remote Support CVE-2026-102764: Zero-Day Exploited by a China-Nexus Actor, Patch and Hunt Now
A China-nexus actor exploited BeyondTrust Remote Support CVE-2026-102764 as a zero-day from late August. Patch with BT26-05, get logs off the appliance, hunt, and rotate brokered credentials if you find anything.
5 MIN READ↗
Threat intelAhsayCBS CVE-2026-105133 / CVE-2026-105134: Apply Hotfix and Hunt After Confirmed Exploitation
Attackers are chaining two AhsayCBS flaws for unauthenticated RCE, and the first fix was incomplete. Hotfix to v10.3.4.45, then hunt.
5 MIN READ↗
Cloud security · Threat intelNetScaler CVE-2026-107406: The SAML Builds That Fixed Last Week’s Zero-Day Need Another Upgrade
Patched for last week’s NetScaler SAML zero-day? If you are a SAML IdP on those builds, you still need another upgrade for CVE-2026-107406.
8 MIN READ↗
Application security · Threat intelAtlassian Data Center CVE-2026-21589 Is Under Attack: Patch, Hunt Your Logs, Rotate Secrets
Exploitation attempts against an unauthenticated file-read flaw in eight self-hosted Atlassian Data Center products began within hours of public details. Patch, check your access logs, and rotate secrets if config files were read.
4 MIN READ↗
Cloud security · Threat intelExchange Server CVE-2026-96940: Why You Need the September V2 Update Even If You Already Patched
Microsoft re-released its September 2026 Exchange Server security updates as V2 to fix CVE-2026-96940. Servers that installed the original September update are still exposed until V2 is applied.
4 MIN READ↗
Cloud security · Threat intelFortiMail CVE-2026-104286: Patch, Then Prove You Weren’t Compromised
Fortinet's critical FortiMail flaw (CVE-2026-104286, CVSS 9.8) is being exploited in the wild, and CISA's federal deadline passed on October 4. Here is what's affected, how to mitigate, and how to check whether your appliance was touched before you patched.
4 MIN READ↗
API security · Threat intelWSO2 API Manager CVE-2026-5430: Forged Admin JWTs at the Gateway
An exploited JWT bypass in WSO2 API Manager and its gateways. Patch to the fixed update level, hunt for forged admin sessions, then rotate the secrets the gateway held.
9 MIN READ↗
Cloud security · Threat intelCitrix NetScaler SAML Zero-Day (CVE-2026-88779): What Defenders Should Do Before October 7
An actively exploited SAML flaw that hit appliances already patched for CVE-2026-88771/88772. Upgrade to 14.1-73.41 or 13.1-64.28, then check for compromise, not just crashes.
9 MIN READ↗
Application security · Threat intelWhen the Helpdesk Is the Launch Point: Reading the DIVD Zammad Case
An agentic intrusion through a helpdesk, in DIVD’s own words. Test exposure, local privilege and segmentation. Do not rebuild the chain.
8 MIN READ↗
Cloud security · Threat intelCitrix NetScaler CVE-2026-88771 and CVE-2026-88772: Defender Checklist, Then Assume Breach
CISA added Citrix NetScaler CVE-2026-88771 and CVE-2026-88772 to KEV on 27 September 2026, after exploitation since early September. Inventory, preserve evidence, hunt, upgrade to fixed builds, then rotate and re-validate—patch ≠ clean.
12 MIN READ↗
Electron and desktop
Desktop security · Electron series, part 1Electron Threat Model and Architecture for Penetration Testers
Part 1 of PoCForge’s Electron penetration-testing series: main, preload and renderer privilege maps, attacker stories, and how desktop impact differs from web XSS.
8 MIN READ↗
Desktop security · Electron series, part 6Fuzzing and Systematically Testing Electron IPC and Preload Surfaces
Part 6: inventory-first IPC/preload testing, dangerous sink wordlists, and a constrained PoCForge Electron lab fuzz harness for authorised training.
9 MIN READ↗
Desktop security · Electron series, part 5Electron Penetration Testing Checklist and Engagement Methodology
Part 5: field checklist and engagement lifecycle for Electron desktop assessments, aligned with PoCForge’s desktop application penetration testing service.
8 MIN READ↗
Desktop security · Electron series, part 4ASAR, Updates and Local Privilege Paths in Electron Apps
Part 4: ASAR static review, auto-update staging, openExternal and custom protocols, secrets on disk, and integrity/fuse considerations for authorised tests.
8 MIN READ↗
Desktop security · Electron series, part 3Abusing the Preload Bridge and IPC in Electron Applications
Part 3: contextBridge over-exposure, ipcMain validation gaps, and safe demos using the PoCForge intentionally vulnerable Electron lab.
8 MIN READ↗
Desktop security · Electron series, part 2Common Electron Misconfigurations That Turn XSS into RCE
Part 2: nodeIntegration, contextIsolation, sandbox, webSecurity, DevTools and CSP—how preference regressions turn renderer bugs into desktop code execution.
8 MIN READ↗
Desktop security · Electron deep diveElectron Security Deep Dive: Renderer-to-Node Trust Boundaries
A practical Electron security methodology covering renderer isolation, preload bridges, IPC, navigation, file handling, plugin loading and desktop impact.
18 MIN READTECHNICAL DEEP DIVE↗
AI security
AI security · PlatformSelf-Hosted GitLab AI Gateway: Trust Boundary After CVE-2026-90970
A CVSS 9.9 template-sandbox escape on the self-hosted AI Gateway. GitLab-hosted gateways are already fixed. Yours is a separate asset, with its own keys.
8 MIN READ↗
AI securityWhen AI Agents Become the Attack Surface
A practical offensive-security guide to prompt injection, tool abuse, identity boundaries, data access and high-impact actions in agentic AI systems.
12 min read↗
AI security · Lab guideAI Agent Security Lab: Testing Prompt Injection Through Tool Abuse
A controlled lab methodology for testing indirect prompt injection, tool authorisation, excessive agency and identity boundaries in AI agents.
17 MIN READTECHNICAL DEEP DIVE↗
Cloud security
Cloud security · AI control planeLoom for AWS and SageMaker Spaces: Test the Agent Control Plane After October 2026
Unauthenticated super-admin on the Loom agent control plane, write-scope token and SSRF issues, and a SageMaker Space startup flaw. Upgrade, then assume breach.
11 MIN READ↗
Cloud security · Deep diveAgentic Cloud Destruction: Compromised Service Principals as Ransomware
How Storm-3168-style agentic attackers abuse Azure service principals for rapid cloud destruction—and how Indian SaaS teams should test workload identities, secrets and recovery controls.
9 MIN READ↗
Cloud security · Deep diveCloud IAM Attack Paths: From a Low-Privilege Identity to Sensitive Data
A practical cloud penetration-testing methodology for tracing identity relationships, role assumptions, permissions and resource exposure into a measurable attack path.
16 MIN READTECHNICAL DEEP DIVE↗
Cloud securityCloud Attack Paths: Identity Before Configuration
A practical method for tracing cloud weaknesses from an entry identity through role assumptions and permissions to sensitive resources and measurable impact.
12 min read↗
API security
08 / INDIA VAPT · FINTECH API TESTINGTesting Payout and Disbursement APIs in Indian Fintech: What CERT-In’s CIAD-2026-0046 Means for Your Next VAPT
Attackers are calling payout APIs directly with stolen partner credentials, from inside the lender’s own whitelisted servers. Test whether your money-moving endpoints enforce their own checks.
13 MIN READ↗
API securityBOLA: Testing Object-Level Authorisation in APIs
A hands-on methodology for finding broken object-level authorisation across REST and GraphQL APIs, with a focus on authorisation decisions rather than parameter guessing.
11 min read↗
API security · Deep diveAPI Authorisation Attack Chains: From BOLA to Cross-Tenant Impact
A deep-dive methodology for validating API authorisation boundaries, chaining object-level and function-level access control failures, and measuring tenant impact safely.
16 MIN READTECHNICAL DEEP DIVE↗
Application security
Application security · Patch debtSelf-Managed GitLab File Read: Three Weeks On from CVE-2026-85706
Unauthenticated arbitrary file read on self-managed GitLab, still the right finding if the build is below the 10 and 23 September fixes. Not an appliance hunting guide.
9 MIN READ↗
Application securityBusiness Logic Flaws: The Bugs Scanners Miss
How offensive security testers model workflows, state transitions, replay, race conditions and client-controlled state to find vulnerabilities that signature-based tools rarely understand.
13 min read↗
