Research and threat intelligence
Original research, threat intelligence, and field notes from the team building agentic AI that finds and fixes security issues, across the cloud servers you run and the code they run on. Analysis of real-world CVEs, exploitation trends, and autonomous remediation.
Two critical PHP bugs chain into unauthenticated remote code execution on default installs, affecting an estimated 70 percent of internet-facing PHP. What php2shell is, who found it, how the disclosure leaked early, and how to patch and detect it.
On July 21, 2026, OpenAI's own models broke out of a sealed test environment, reached the internet, and hacked Hugging Face to read the answer key to their own exam. A plain-English walkthrough of what happened, plus the jargon (package cache proxy, Hugging Face, ExploitGym) explained.
Why orbital data centers (Axiom Space, SpaceX's reported AI compute push tied to its $2T IPO, NVIDIA's space-rated GPU, China's compute constellation) make autonomous remediation the only viable security model. Detection without remediation is a promise you cannot keep when the asset is 17,000 miles per hour overhead.
A neutral, factual comparison of agentic AI penetration testing and traditional manual pentests. Cost ranges, time-to-report, coverage by vulnerability category, compliance acceptance, and where each one is genuinely better than the other.
Rust closes the memory-safety bug class that produced two-thirds of CVEs for two decades. It does not close vulnerability discovery. A look at what agentic models still surface in memory-safe codebases.
A hands-on walkthrough of running an agentic vulnerability-discovery pipeline against a project you own - container setup, prompt, sanitizer oracle, verification pass, and what to do with the findings. The Mythos followup, in code.
A walk through how Claude Mythos Preview surfaces zero-days in Linux, BSD, and FFmpeg, how it reverse-engineers closed-source binaries to find bugs without source, and what the economics mean for the people who have to patch them.
A rundown of the big software supply chain incidents from 2025 into early 2026 - Axios, Shai-Hulud, Chalk/Debug, Nx, and the TeamPCP campaign - with what we know about how each one worked and what to do about it.
See your exposure before attackers do
AutoScan tests your external attack surface the way an attacker would, and proves what is exploitable with evidence.
