CVE Deep Dives
Original vulnerability discoveries and CVE analyses authored by our security engineers and reviewed for technical accuracy and reproducibility before publication.
About
About Ostorlab Blog
Ostorlab Blog is the official cybersecurity research and news publication of Ostorlab. We share practical guidance, technical insights, and product updates to help engineers, security professionals, and product teams build and secure mobile and web applications without slowing down.
Our Mission
We believe in clear, evidence-based writing.
Our goal is to make complex security topics understandable, actionable, and relevant to both developers and security specialists. All content is based on original research, carefully reviewed for technical accuracy and reproducibility, ensuring teams have reliable guidance on the latest developments in mobile and web security testing.
Security Testing Guides
Hands-on guides, workflow advice, and compliance-oriented content to help teams improve mobile and web security testing practices.
Security Topics
Coverage of platform security, device risk, ecosystem changes, and emerging threats that matter to modern engineering and security teams.
Ostorlab Product Updates
New features, integrations, and platform improvements that keep readers informed about how Ostorlab evolves for mobile and web security testing.
Highlights
A selection of the research and engineering work we are proudest of.
Benchmark
Ostorlab Neutron Leads UC Berkeley CyberGym: 100% Detection and 96.75% Verified Exploitation
A technical deep-dive into how Ostorlab Neutron achieved 100% vulnerability detection and a 96.75% verified exploit solved rate (1,458/1,...
Vulnerability research
From Signal to the Android SDK: Chaining Path Traversal, Mimetype Confusion, Security Check Bypass and File Descriptor Bruteforce for Arbitrary File Access
This technical analysis reveals how sophisticated attack chains—combining path traversal, symbolic link manipulation, and Android SDK qui...
New disclosure
New Roundcube Webmail Vulnerabilities Disclosed : IMAP Command Injection and SSRF via CSS Proxying.
A deep dive into two critical vulnerabilities uncovered in Roundcube Webmail (< 1.6.14, 1.5.14, 1.7 RC4) during a source code review. OVE...
AI research
Going Beyond: Ostorlab AI Engine Discovers Unknown Vulnerability Classes
Ostorlab’s reasoning-driven AI engine breaks past rule-based limits to surface previously unknown and hard-to-detect vulnerabilities—incl...
Reverse engineering
Bypassing Obfuscation in Android Apps: A Dual Approach with DalvikFLIRT and LLM-Powered Rewrites
This research introduces a pioneering dual approach that combines signature-based matching (DalvikFLIRT) with LLM-powered code transforma...
Industry report
Banking Report 2025: Security at the Core of Mobile Finance
Large-scale security analysis of 500+ top mobile banking apps reveals widespread vulnerabilities, decade-old codebases, and concerning ba...
Get in touch
Have questions, suggestions, or ideas for collaboration? We welcome feedback on our articles, guest article proposals, and inquiries related to our research and platform.
General inquiries
Questions, partnerships, article feedback, and collaboration ideas: contact@ostorlab.co
Security research
Vulnerability research and technical security topics: security@ostorlab.dev