Blog

We chain returned-pixel ASLR disclosures with a libheif heap overflow through WordPress and ImageMagick, then validate RCE across exact Ubuntu and Debian profiles.

A fully remote CVE-2026-32740 RCE chain in a stock Next.js and sharp lab, using a pixel leak, chosen-address write and immediate memcpy GOT hijack.

Complete HTTP-only reconstruction of StyleSmuggler (CVE-2026-75650), from report poisoning and a guest billing-address parser flaw through Email Preview, AWS S3Client, ArrayScanner and the final PHP include. Includes the working lab PoC, Adobe hotfix analysis and investigation guidance.

Vulnerability research · CVE-2026-75604 A single un-escaped backslash in the Next.js incremental cache lets an unauthenticated attacker read and write files on Windows hosts, and, on the right versions and app shape, run commands. Here is…

Keycloak CVE-2026-18963: Account Takeover via Reset-Credentials Authentication Selector Bypass TL;DR An unauthenticated attacker can take over any Keycloak user account in Keycloak 26.7.1 by abusing the reset-credentials flow. The…

The report was delivered. Vulnerabilities were remediated. Compliance requirements were satisfied.

Cyber Essentials sets a useful UK security baseline, but it is not the same as penetration testing. This guide explains how penetration testing supports Cyber Essentials Plus, maps to the five controls, and provides deeper assurance for customer and compliance requirements.

Internal and external penetration testing assess your security from two different starting positions. First, an external pen test simulates an attacker on the internet targeting your public-facing systems – websites, APIs, email gateways…

We break down the WordPress 7.0.1 wp2shell chain: REST batch confusion, SQL injection, and how an unauthenticated attacker reaches RCE. Defensive analysis, no exploit code.

A practical firmware-research walkthrough showing how we parsed Philips Hue Bridge FW2 updates, decrypted firmware sections, rebuilt the filesystem, and booted the bridge services in a repeatable MIPS QEMU lab.

Red team, blue team, and purple team are three distinct approaches to security testing that serve different purposes. The red team attacks. The blue team defends. The purple team makes sure the two sides learn from each other. Most…

Penetration Testing as a Service (PTaaS) platforms promise continuous security testing through a self-service portal – on-demand scans, always-on dashboards, and faster turnaround than traditional engagements. Traditional pen testing…

A practical testing guide to the OWASP Top 10 for LLM Applications, covering prompt injection, data disclosure, excessive agency, supply chain risks, and real-world mitigation techniques.

A practical comparison of manual and automated penetration testing, explaining what each approach finds, where scanners fall short, and why both are needed for strong security assurance.

A clear breakdown of red teaming versus penetration testing, including scope, methodology, deliverables, and when each type of assessment is the right fit.

An explanation of where DAST tools help, where automated scanning ends, and why manual penetration testing is still needed for deeper application security assurance.

A practical guide for securing enterprise LLM deployments, covering RAG security, input and output controls, monitoring, access control, and model supply chain risks.

A guide to black box, white box, and grey box penetration testing, explaining the differences, trade-offs, and how to choose the right approach for your assessment.

A comparison of AI red teaming and traditional penetration testing, covering model-specific risks, prompt injection, adversarial testing, data leakage, and AI security tooling.

LiteLLM v1.82.2 security analysis: Two high-severity RCE vulnerabilities (Jinja2 SSTI and Unicode sandbox bypass). CVSS 7.2 HIGH, requires admin auth.

Learn the key differences between penetration testing and vulnerability scanning: scope, methodology, cost, compliance requirements, and when to use each for maximum security effectiveness.

A UK-focused guide to when penetration testing is legally or contractually required, including GDPR, NHS DSPT, FCA, NIS, PCI DSS, and sector-specific expectations.

A practical look at how prompt injection attacks are tested across chatbots, RAG systems, AI agents, copilots, and LLM APIs.

A practical guide to penetration testing frequency, covering annual testing, compliance requirements, major change triggers, and when more frequent testing is needed.

A complete guide to LLM penetration testing, covering prompt injection, data leakage, excessive agency, RAG risks, model abuse, and AI application security testing.

A practical breakdown of how long penetration testing usually takes, from scoping and active testing through to reporting, retesting, and final delivery.

A practical guide to when CREST-certified penetration testing is required, when it is optional, and how to decide based on client, regulatory, and assurance needs.

A UK-focused guide to penetration testing costs, covering typical pricing for web applications, infrastructure, APIs, cloud environments, and the factors that affect scope.

Security analysis of critical SGLang vulnerabilities involving unsafe pickle deserialization and unauthenticated remote code execution risk.

A practical guide to red teaming LLM web applications with Promptfoo, including custom providers, real-world API integration, RAG exploitation, and prompt injection testing.

A recap of Adrian Tiron’s February 2026 talks at DevSecOps London and OWASP London, covering AI security, LLM application risks, and lessons from real-world testing.

A practical guide to where penetration testing fits into TISAX readiness, VDA ISA expectations, technical validation, and common assessment pitfalls.

A practical guide to penetration testing for DiGA digital health applications, covering BSI TR-03161, GDPR, mobile app, API, backend, and cloud security requirements.

A complete guide to penetration testing for SOC 2 compliance, including Trust Services Criteria, Type I and Type II reports, control validation, and annual testing expectations.

A practical explanation of why cloud penetration testing matters, how shared responsibility changes security risk, and what organisations should test in modern cloud environments.

Reflections from DEF CON 33, including key talks, security research themes, community highlights, and lessons from one of the world’s largest hacker conferences.

The EU AI Act is now law. This guide covers risk classification, security requirements, enforcement fines, agentic AI regulatory gaps, and practical compliance steps – from a penetration testing perspective.

A practical guide to API penetration testing, covering common API vulnerabilities, testing methodology, authentication flaws, authorisation issues, and real-world attack paths.

Adrian Tiron’s review of the OSWE certification journey, including preparation approach, exam experience, key challenges, and practical advice for candidates.

A review of the OSEP exam journey, covering preparation, advanced penetration testing topics, Active Directory exploitation, exam strategy, and lessons learned.

Reflections from BlueHat IL 2025, including technical talks, security research themes, conference highlights, and lessons from Microsoft’s security community event.

A red team research post showing how small Sliver C2 code changes can alter detection behaviour and help security teams understand EDR evasion trade-offs.

A practical guide to penetration testing under the UK Telecoms Security Act, covering telecom provider obligations, network security, monitoring, access control, and supply-chain testing.

A guide to why penetration testing matters for HITRUST CSF compliance, covering healthcare security, maturity expectations, validated assessments, and technical risk validation.

A detailed guide to penetration testing for ISO/IEC 27001, including Annex A controls, risk treatment, audit evidence, and how testing supports ISMS assurance.

A practical guide to threat-led penetration testing, explaining how TLPT uses realistic threat intelligence and adversary simulation to assess resilience against targeted attacks.

A guide to using penetration testing to support NIST CSF 2.0 outcomes, covering governance, risk management, continuous monitoring, and practical security validation.

Research into a Vesta control panel admin takeover caused by reduced bash RANDOM entropy, including exploitation details and the security impact of weak randomness.

A healthcare-focused guide to HIPAA penetration testing, covering technical safeguards, risk analysis, audit controls, breach readiness, and protection of patient data.

Security research on the Feeld dating app showing how sensitive user data and private media became publicly accessible due to backend security weaknesses.

A practical guide to GDPR and penetration testing, explaining how security testing supports Article 32, data protection by design, breach readiness, and third-party assurance.

A clear comparison of penetration testing and bug bounty programmes, including strengths, limitations, cost models, coverage, and when each approach makes sense.

A guide to NIS 2 compliance and penetration testing, covering risk management, incident handling, governance, supply-chain security, and resilience testing expectations.

Announcement of FORTBRIDGE’s expansion of CREST-accredited penetration testing services across the EMEA region, supporting global application, cloud, and infrastructure security assurance.

A practical guide to PCI DSS 4.0.1 penetration testing, covering Requirement 11.4, segmentation testing, ASV scanning, remediation expectations, and payment security assurance.

An API hacking case study showing IDOR exploitation via HTTP parameter pollution, including why automated scans missed the issue and how manual testing found it.

A buyer’s guide to choosing a penetration testing provider, covering methodology, credentials, reporting quality, scoping, communication, and how to avoid weak assessments.

A mobile security case study assessing how banking apps protect users after phone theft, using Monzo as an example of real-world risk and defensive design.

A practical guide for penetration testers on configuring SPF, DMARC, DKIM, and MX records for Evilginx infrastructure to improve phishing simulation deliverability.

Security research into password reset vulnerabilities in Grav CMS, showing how weaknesses in account recovery flows can lead to account compromise.

A review of the Red Team Ops II exam, covering course content, preparation strategy, exam experience, operational tradecraft, and advice for future candidates.

A guide to PSTIA 2024 and UK product security requirements, covering default passwords, vulnerability disclosure, security updates, and compliance expectations for connected products.

A review of the Red Team Ops exam and RastaMouse course, covering preparation, Active Directory tradecraft, exam experience, and practical advice for candidates.

A guide to DORA and penetration testing, explaining how financial entities can use security testing and TLPT to support digital operational resilience requirements.

Security research on CVE-2024-1619, a reflected XSS vulnerability in Kaspersky Security for Linux Mail Server discovered during penetration testing.

Announcement of FORTBRIDGE’s DESC accreditation for penetration testing, supporting regulated security assurance for clients across application, API, cloud, and infrastructure environments.

Security research into compromising Plesk via its REST API, covering the attack path, exploitation approach, and lessons for securing hosting control panels.

One of our customers asked us to review one of their pentest reports where one of the issues was that a CSRF cookie was missing the secure flag. Interesting to see that some people are trying to fix the LOW severity findings as well, we didn’t expect that.

IoT security research into the Yunmai smart scale API, showing how chained mobile and backend vulnerabilities led to mass account takeover risk.

Part two of the Concrete CMS research series, covering multiple vulnerabilities including privilege escalation, SSRF, and other issues affecting real-world deployments.

Part one of the Concrete CMS research series, showing how a race condition in file upload functionality could be exploited to achieve remote code execution.

WordPress security research showing how two individually secure plugins could be chained together to create a serious compromise path when deployed on the same site.

Security research into multiple vulnerabilities in cPanel and WHM, covering exploitation paths, impact, and lessons for securing hosting administration platforms.

Announcement of FORTBRIDGE receiving CREST accreditation for penetration testing services, recognising independent assurance of methodology, staff capability, and secure delivery processes.

Drupal security research showing how an insecure default configuration could lead to password reset poisoning and account compromise in affected deployments.

Joomla security research showing how a password reset vulnerability and stored XSS could be chained to achieve full compromise of the underlying server.