FireCompass
Agentic AI Penetration Testing for Web and API
- Website
- firecompass.com · all feeds from this site
- Feed URL
https://www.firecompass.com/feed/
Read it in your FeedListing reader
Or add to: Feedly Inoreader Raw feed
Latest posts
-
Weekly Cybersecurity Intelligence Report: Cyber Threats and Breaches 19 Oct to 25 Oct 2026
This weekly cybersecurity report covers 19 to 25 October 2026, a week in which the thing attackers wanted was usually access to someone else’s AI. A master key leaked in May let attackers ship a credential-stealing LiteLLM release on 21 October. An intruder at the cloud platform…
-
Weekly Report: New Hacking Techniques and Critical CVEs 19 Oct to 25 Oct 2026
CISA added 8 vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog between 19 and 25 October 2026, 6 on 20 October and 2 on 23 October. All eight are confirmed exploited in the wild, two carry a CVSS base score of 9.0 or above from their CNA, and four have public…
-
PHP2Shell Was Not the First. The Next One Is Already in Someone’s Queue
PHP2Shell took six days to go from a leaked CVE number to CISA’s exploited list. The fix shipped ten hours after the first exploit tooling was seen scanning. A week later, FireCompass research across 1,000,000+ assets found that 65 percent of organisations still had at least one…
-
PHP2Shell (CVE-2026-109618, CVE-2026-109619): The Complete Guide to Exposure, Exploitation, Remediation, and Verification
Executive summary PHP2Shell is the name given to two critical vulnerabilities in the PHP engine, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on CVSS 4.0. Either one allows an unauthenticated attacker to execute code on the web server with the PHP process’s privileges,…
-
The Most Dangerous Action May Be Perfectly Legitimate
Agentic AI Security · Part 3 of 3 An agent can do something quite reasonable, with valid permissions, and still cause harm because of what happened before it or what another agent is doing at the same time. A runtime control reduces risk while an AI agent is acting, by checking…
-
Weekly Cybersecurity Intelligence Report: Cyber Threats and Breaches 12 Oct to 18 Oct 2026
This weekly cybersecurity report covers 12 to 18 October 2026, a week in which attackers got in through third-party, vendor and unmonitored access rather than through the perimeter. Attackers took over internet-exposed refrigeration controllers in about 700 French supermarkets.…
-
Weekly Report: New Hacking Techniques and Critical CVEs 12 Oct to 18 Oct 2026
This weekly cybersecurity report covers 12 to 18 October 2026, a week in which attackers got in through third-party, vendor and unmonitored access rather than through the perimeter. Attackers took over internet-exposed refrigeration controllers in about 700 French supermarkets.…
-
Weekly Cybersecurity Intelligence Report: Cyber Threats and Breaches 05 Oct to 11 Oct 2026
This weekly cybersecurity report covers 05 to 11 October 2026, a week defined by attackers reaching through trusted access paths rather than breaking down the front door. Denmark’s national population register was mined for 8.8 million residents’ data through a legitimate…
-
Weekly Report: New Hacking Techniques and Critical CVEs 05 Oct to 11 Oct 2026
The critical CVEs this week all arrived in one batch: CISA added five vulnerabilities to its Known Exploited Vulnerabilities catalog on 08 October 2026, tied to a Chinese state-linked espionage campaign. One of the five, a CVSS 9.8 path traversal flaw in ONLYOFFICE Document…
-
API Penetration Testing in 2026: Why Scanners Miss What Attackers Exploit
API penetration testing that stops at scanning misses the flaws attackers actually exploit: broken authorization, forgotten endpoints, and chained attack paths. Here is what makes APIs exploitable, why traditional testing misses it, and how agentic AI pentesting finds and proves…
-
Field Notes from Black Hat and DEF CON 2026: What Changed in the Attacker Playbook?
Almost nothing in the attacker’s toolkit is new. The vulnerability classes on display at Black Hat USA 2026 and DEF CON 34 were the same ones security teams have tracked for a decade: request smuggling, SQL injection, SSRF, broken object level authorization. What changed is the…
-
Why Traditional ASM and CTEM Tools Will Fail in the Next 12 Months
Talk recap: why ASM and CTEM tools are about to fall behind At the September 17, 2026 CISO Platform Turbo Talk, FireCompass founder and CEO Bikash Barai argued that traditional ASM and CTEM tools will fail in the next 12 months. His reason is economics. A vendor can afford about…
-
What Recent Autonomous Hacking Incidents Mean for Web App and API Security
At Black Hat USA 2026 and DEF CON 34, one theme was ever-present in both the briefings and the hallway conversations alike: autonomous AI threat actors are actively executing multi-stage attacks. Under permissive evaluation conditions, AI agents have already demonstrated the…
-
Old Web Bugs, New Blast Radius: What Vegas 2026 Means for API Testing
Three vulnerability classes I’ve spent most of my career testing for turned up at Black Hat and DEF CON this year, wearing AI costumes. CSP bypass. SSRF. HTML injection race conditions. Every one of them was written off as solved; every one of them was reachable again. The…
-
Guardrails Are Not a Safety Architecture
Agentic AI Security · Part 2 of 3 Deterministic controls are essential when AI agents can act. They also have a precise limit: they can enforce what we have specified and can observe. The rest of the safety problem does not disappear. The FireCompass AI Safety and Governance…
-
Your AI Agent Is Safe. Until It Starts Acting.
Agentic AI Security · Part 1 of 3 Model safety is not agent safety. Confusing the two may become one of the more consequential mistakes we make as AI moves from answering questions to taking actions. Agentic AI security is the practice of keeping an autonomous AI agent safe…
-
Weekly Report: New Hacking Techniques and Critical CVEs 21 Sep to 27 Sep 2026
CISA added at least 11 vulnerabilities to its Known Exploited Vulnerabilities catalog between 21 and 27 September 2026, five of them carrying a CVSS score of 9.0 or higher, and all eleven confirmed under active exploitation at the time of addition. At least three of the week’s…
-
Weekly Cybersecurity Intelligence Report: Cyber Threats and Breaches 21 Sep to 27 Sep 2026
The week of 21 to 27 September 2026 was defined by attackers monetizing access faster than victims could detect it. Bitget lost 351.6 million dollars to a suspected North Korean crew that spoofed its own wallet approvals, ShinyHunters claimed a breach of FBI job applicant data…
-
Why an LLM Alone Cannot Run an AI Penetration Test
The model is the reasoning component. Everything that makes a test real lives outside it. Every AI penetration testing pitch now leads with the model. Point the strongest frontier LLM at your application, the story goes, and pentest quality follows. Buyers have started…
-
Weekly Cybersecurity Intelligence Report: Cyber Threats and Breaches 07 Sep to 13 Sep 2026
The week of 07 to 13 September 2026 was defined by identity compromise, not software exploits. Five incidents drove the week: a Cisco Secure Firewall Management Center authentication bypass under simultaneous nation-state and ransomware exploitation, a confirmed breach at…