All articles

Deep Dive

A non-admin Cronicle user can inject environment variables through event params and run code in another job's context...

Deep Dive

A SonicOS SSLVPN flaw lets an account with valid alternate-method credentials skip SAML and its MFA; exploited, fixed...

Deep Dive

Kubeflow Pipelines before 2.18.0 skips authorization for shared pipeline uploads, letting a low-privilege tenant run ...

Deep Dive

Any signed-in OpenEMR user can move another patient's document to a record they can read, bypassing document access c...

Deep Dive

kaniko before 1.25.20 sends the build's Azure Resource Manager token to any registry host containing .azurecr.io, inc...

Deep Dive

A SIP MESSAGE to a stock FreeSWITCH profile can run FreeSWITCH API and OS commands; fixed in 1.11.3 and exploited in ...

Deep Dive

OpenSSH on musl libc without PAM accepts a 257-byte password for locked accounts; fixed in 10.6p2 and Alpine's packages.

Deep Dive

Keycloak's SAML redirect binding verifies a different parameter than it processes, letting an attacker log in as any ...

Deep Dive

GPUStack before 2.2.0 trusts a loopback request source, so a same-host reverse proxy turns a remote request into admi...

Deep Dive

A copycat ARTEX Docker image added a hidden login handler that runs shell commands as root, and 62 internet consoles ...

Deep Dive

APT29 compromised Plerdy's analytics script and legitimate sites to serve patched iOS and Android exploit chains; CIS...

Deep Dive

Apache OFBiz before 24.09.08 loads a screen definition from an attacker-chosen file descriptor on the login page and ...

Deep Dive

APT on Debian and Ubuntu can install an attacker's package after a redirect and a retry, giving an on-path attacker r...

Deep Dive

Attackers modified four official NIKKE PC launcher scripts on Level Infinite's CDN to install the K2F remote-access a...

Deep Dive

Stanza 1.14.0 loads an inner gzip pickle from a lemma checkpoint with no restriction, so a crafted model runs code; f...

Deep Dive

Zyxel GS1900 switches before 2.90 patch 3 take an unauthenticated HTTP request that runs root commands, and attackers...

Deep Dive

FreeRDP before 3.32.2 accepts a server certificate on two hand-rolled identity checks, so a trusted-CA man-in-the-mid...

Deep Dive

Two grant-copy validation flaws let a malicious Xen guest read and write the memory of other domains, including Dom0;...

Deep Dive

Rails Active Storage before 8.0.5.2 and 8.1.4.1 lets crafted uploads make ImageMagick or FFmpeg write or read server ...

Deep Dive

Unauthenticated Channel Access messages corrupt memory in EPICS Base 7.0.10 and earlier; the batch is fixed in 7.0.11...

Deep Dive

Malicious Hugging Face model repositories ran cryptominers and backdoors on GPU hosts that loaded them; the campaign ...

Deep Dive

Telerik UI for ASP.NET AJAX reads web.config unauthenticated and chains to RCE on sites with static keys; both flaws ...

Deep Dive

Attackers stole Bitcoin and Litecoin from hot wallets on BTCPay Server 2.4.1 and earlier through the flaw fixed in 2....

Deep Dive

An unauthenticated Node-RED interface on Siemens SIMATIC IoT2050 gateways lets attackers run commands; fixed in V4.3....

Deep Dive

libexpat through 2.9.0 detects some billion-laughs attacks too late. Learn the affected parser paths, four flaws, and...

Deep Dive

Control Web Panel before 1.12 exposes user-panel code without login; learn the three-CVE chain, affected versions, an...

Deep Dive

A pre-authentication bypass in Email Security Gateway chains with a root command injection across six Barracuda produ...

Deep Dive

One malformed WAP Push SMS crashes Android telephony and drops calls with no tap from the victim; the fix ships at th...

Deep Dive

A malicious TeamViewer host runs code on the viewer that connects to help it, through one truncated screen-size multi...

Deep Dive

A malicious VNC server runs code on the TightVNC Viewer before any password prompt; upgrade the Viewer to 2.8.90 and ...

Deep Dive

An oversized ICMP error message corrupts memory while a server PXE-boots, running attacker code before the OS loads. ...

Deep Dive

LXD and Incus mTLS authentication bypass lets network attackers impersonate trusted clients using public certificates...

Deep Dive

CakePHP window offsets and collation names allow SQL injection when fed untrusted input. Check exposure and upgrade t...

Deep Dive

A shared ChatGPT link ran attacker JavaScript inside the victim session through MathLive unchecked messages; OpenAI f...

Deep Dive

Stolen GitHub tokens pushed 72,026 malicious commits to 22,964 repositories in nine days; revoke the tokens and hunt ...

Deep Dive

A three-flaw chain gives unauthenticated root on Ivanti Connect Secure; upgrade to 22.8R2.6 or 25.1.1.3 and audit for...

Deep Dive

imgproxy 4.0.0 to 4.0.15 allocates ICO data with a wrapping size that unauthenticated crafted-image requests turn int...

Deep Dive

pgAdmin 4 before 9.19 lets any Import/Export user run a psql TO PROGRAM command on the host, and lockout bypasses ope...

Deep Dive

WordPress 4.7 to 7.1.3 can expose an installer during core updates that unauthenticated attackers race to run code; i...

Deep Dive

Langflow OSS 1.0.0 to 1.12.8 hands any caller a superuser session that reaches RCE through its MCP tools; fixed in 1.13.0.

Deep Dive

An npm worm stole credentials, planted AI-tool hooks in 42 real GitHub repositories and hid a package publisher; trea...

Deep Dive

A malicious Claude Code extension 2.1.313 on the Cursor Marketplace added an SSH backdoor; at most 5,000 users instal...

Deep Dive

Drupal Commerce before 2.41 and 3.3.13 lets limited users take over other vendors' variations and coupons via JSON:AP...

Deep Dive

A newline in a PDF metadata key runs ExifTool Perl code as a command on unauthenticated Gotenberg servers before 8.31...

Deep Dive

A race in Linux IPv4 TCP handshakes since 4.4 frees socket options in use; kernel team scores 9.8, RHEL fixed, Ubuntu...

Deep Dive

Telegram for Android 8.6.2 to 12.10.3 let a caller run code once the victim answered a voice call. No known exploitat...

Deep Dive

An unauthenticated crafted request reloads Cisco ASA and FTD firewalls using secondary authentication on a tunnel gro...

Deep Dive

GoAhead loads the CRL but never checks it, so revoked client certificates pass mTLS; fixed in 6.1.1, shipped to devic...

Deep Dive

Unauthenticated RCE in PeopleTools 8.61 and 8.62 through an SSRF chain into PSEMHUB: exploited as a zero-day by Shiny...

Deep Dive

CVE-2026-86950, an exploited CoreGraphics out-of-bounds write, is in CISA KEV; iOS and iPadOS 26.7.1 and 18.7.11, mac...

Deep Dive

CVE-2026-116692 (CVSS 9.8) lets any caller of a default MLflow 3.12.0-3.16.x tracking server upload and run Python co...

Deep Dive

PolyShell (CVE-2026-48356) is an unauthenticated file upload in Magento's REST API, mass-exploited since March 2026; ...

Product

Ostorlab reports more critical findings, shorter testing time, and assessment costs of one-tenth to one-fortieth of m...

Deep Dive

Before 6.2606.4246, Microsoft Authenticator for Android handed work-account tokens to any app posing as an installed ...

Deep Dive

Authlib up to 1.8.0 treats a JWS JSON object with empty signatures as verified without checking the key: Critical CVE...

Product

A five-step mobile app vetting checklist for security teams (permissions, trackers, malware, data flows, store reputa...

Product

Precheck verifies that a mobile app installs, launches, logs in and runs its UI prompts on a real device. When a bloc...

Deep Dive

The OpenHands Software Agent SDK exposes its sandbox agent port on every interface with auth off by default, allowing...

Deep Dive

Tailscale SSH's root daemon dials and replaces unix sockets for approved users, reaching root on permitted servers; u...

Deep Dive

Swapped archives on five OVHcloud CLI releases delivered a secret-stealing build for 94 minutes on October 19, 2026; ...

Deep Dive

In OpenCode 1.0.137 to 1.18.32 on Windows and WSL, a malicious MCP server's OAuth sign-in URL reaches PowerShell and ...

Deep Dive

Linux KSMBD flaws are rated CVSS 9.0 by ZDI, one reachable before authentication. Linux 7.2.15 fixes the race; check ...

Deep Dive

FortiSIEM 7.5.0's unauthenticated gRPC service on TCP 27918 lets an attacker overwrite files for RCE; fixed in 7.5.1,...

Product

Ostorlab offers free security scans for mobile apps, websites and source code, with the report emailed to you. Securi...

Product

Scan a .zip or a GitHub, GitLab, Bitbucket or Azure DevOps repository for free with Ostorlab: static analysis of your...

Product

Run a free, production-safe website security scan with Ostorlab: TLS, security headers and known-vulnerable component...

Deep Dive

In self-hosted Postiz 2.23.0 to 2.25.2 any registered user can read server files, and in 2.15.0 to 2.25.2 they can fo...

Deep Dive

Pillow 2.6.0 to 12.3.0 passes an attacker-controlled EPS or PostScript filename to Ghostscript unsanitized, allowing ...

Deep Dive

CVE-2026-110264, a 10.0 integer overflow, exposes every self-managed GitLab since 7.0 to unauthenticated RCE; fixed O...

Deep Dive

CVE-2026-111497 (CVSS v4.0 9.2): Brotli decoder overflow in Node.js, Bun, .NET, Python, Envoy and Istio, now in CISA'...

Deep Dive

Four chained flaws in Plex Media Server before 1.43.3.10861 let an unauthenticated attacker run code as the Plex user...

Deep Dive

Eight eMudhra intermediate CA private keys are computable from their public certificates, enabling site forgery; abou...

Deep Dive

A threat actor hijacked LiteLLM's release pipeline with a leaked, never-revoked master key and pushed a malicious 1.1...

Deep Dive

PAN-OS is actively exploited; separately, a chain rooted 25 servers via an undisclosed vendor's firewalls: PHP RCE fi...

Deep Dive

Rejected WebSocket upgrades through Echo's Proxy middleware leave a raw tunnel open to the upstream, and later HTTP r...

Deep Dive

Laravel rates CVE-2026-114509 as Critical, CVSS v4.0 9.2: an unauthenticated attacker can sign in as an existing user...

Deep Dive

Decoding a crafted FlashPix image in Pillow 12.3.0 or older with olefile installed lets an attacker run commands; Pil...

Deep Dive

Collabora rates CVE-2026-110447 as Critical, CVSS v4.0 9.2: an unauthenticated attacker can run operating-system comm...

Deep Dive

Sentry rates CVE-2026-114139 as Critical, CVSS v4.0 9.1: the @sentry/nextjs SDK skips the application middleware for ...

Deep Dive

CVE-2026-115889 is a Critical Wasmtime sandbox escape: Cranelift packs indices into 24-bit fields that a crafted modu...

Product

See how Ostorlab detects LLM vulnerabilities through banking chatbot examples of private statement leaks, unauthorize...

Deep Dive

Vercel rates GHSA-2464-fhr4-w9xw Critical, CVSS v4.0 9.5: an unauthenticated attacker can run code on a Next.js 10.0....

Deep Dive

GHSA-673q-mjm6-r5xr is rated Critical, CVSS v4.0 9.5, in the GitHub Advisory Database: an unauthenticated attacker ca...

Deep Dive

DOMPurify 3.4.4–3.4.16 lets split ${...} expressions survive SAFE_FOR_TEMPLATES inside attached shadow roots (Critica...

Product

Agentic scans can now ask for your approval before a risky action. Choose how the agent handles it, answer from the A...

Product

Choose the hours and days your Ostorlab scans may run. Scans wait outside the window; scans that support pausing resu...

Security

Ostorlab vs MobSF (Mobile Security Framework) for mobile app security testing: static and dynamic analysis, device re...

Security

Ostorlab vs Oversecured for mobile app security testing: iOS and Android coverage, exploit proof, authenticated testi...

Product

The best Checkmarx alternatives and Snyk alternatives for SAST in 2026: how Ostorlab compares with Snyk Code, Checkma...

Product

How a small agent that turned bug tickets into pull requests became Ostorlab's ticket agent: an AI teammate you give ...

Engineering

False positives are an engineering-capacity problem, not only a scanner-quality problem. Learn how to measure their c...

Product

Ostorlab fits teams testing connected mobile, web, API, and code assets on every release. Where it fits, which plan t...

Security

Ostorlab vs. pentesting firms: cost, testing frequency, depth and remediation, and when to use AI pentests, consultan...

Security

API-only scanners miss attack chains that start with secrets or routes in mobile apps, web bundles, or code. Two real...

Security

Compare Ostorlab, XBOW, Aikido, Intruder, Escape and Penti for SOC 2 pentests on exploit evidence, human review, samp...

Security

Manual app pentests cost $3,000–$50,000+ in 2026; published AI pentests run $499 to about $8,000. What drives price, ...

Security

Compare Apktool, JADX, Ghidra, Frida, Objection and LLDB for manual tests with Ostorlab’s automated Android and iOS m...

Product

How Ostorlab's Deep Agentic Scan uncovers and empirically proves complex vulnerabilities across web, mobile, and sour...

Security

Static analysis flags possible bugs but cannot prove them. Runtime validation proved a Langflow authenticated RCE and...

Security

See how Ostorlab's Agentic Deep Scan chained a Medium-severity OpenAPI disclosure and an SSRF vulnerability to bypass...

Security

The best API security testing tools in 2026: StackHawk, 42Crunch, Escape, and Ostorlab compared on DAST, BOLA/BFLA te...

Security

A technical post-mortem on an AI agent that wandered outside its testing scope during an authorized API assessment, w...

Security

Learn how B2B SaaS startups bypass the 4-week consultancy delay to generate audit-ready SOC 2 pentest reports and Let...

Security

A technical deep-dive into how Ostorlab Neutron reached a 97.1% verified exploit solve rate (1,463/1,507 tasks) and l...

Product

Compare Ostorlab, Invicti, Burp Suite DAST, HCL AppScan and Fortify for on-premises AppSec testing: deployment model,...

Security

Ostorlab Neutron reached a 97.1% verified exploit solve rate on CyberGym, producing working differential proofs of co...

Product

Compare 7 external attack surface management platforms, such as Ostorlab, Defender EASM, Cortex Xpanse and CyCognito,...

Product

Compare Ostorlab, Burp Suite DAST, Invicti, InsightAppSec, AppScan, XBOW and OWASP ZAP, plus when DAST is enough and ...

Product

Compare Ostorlab, NowSecure, Quokka, Zimperium, Appknox and Data Theorem for Android and iOS app vetting: operating m...

Product

Compare leading AI pentesting platforms in 2026 by asset coverage, autonomous exploitation, attack chaining, evidence...

Security

Compare traditional pentests, PTaaS and autonomous AI testing: where agents win on coverage and evidence, where human...

Product

Multi-Asset Deep Agentic Scan assesses related mobile, web, API, network, source-code, and documentation assets in on...

Security

Detection and enforcement are different security properties. Across five production banking apps protected by four co...

Security

A comprehensive guide on what penetration testing is, how much it costs for startups in 2026, the 5-step testing proc...

Product

Ostorlab now supports MCP, giving AI assistants and agents permission-controlled access to security data and workflows.

Product

Introducing Risk Reruns for Agentic Deep Scans—rerun specific risk investigations with customized effort levels, AI m...

Security

AI can produce a convincing exploit story in seconds. Runtime proof, negative controls, and human review determine wh...

Security

SOC 2 doesn't name a required testing method, so auditors judge evidence, not tools. Here's what an AI-conducted pene...

Product

Agentic Scan Knowledge gives Ostorlab security agents persistent application context, allowing every scan to build on...

Product

Ostorlab Mobile Shielding Scan tests Android and iOS protections against real bypasses, including root detection, ant...

Product

Announcing the general availability of the Ostorlab On-Premises Vulnerability Scanner, designed to identify and conte...

Security

Ostorlab vs Aikido on SAST, web and API pentesting, mobile binary testing, cloud posture, BYOK and remediation, with ...

Security

Ostorlab responds to the Appknox 'Top 10 MAST Tools' list: what it got wrong, KnoxIQ vs Agentic Deep Scan, full-stack...

Security

XBOW and Ostorlab compared on target scoping, mobile and API coverage, cross-asset exploit chaining, CI/CD testing, e...

Security

Discover how agentic AI catches business logic flaws rule-based scanners miss. See a real exploit chain escalating a ...

Security

Ostorlab vs NowSecure in six areas: cost and scale, CI/CD integration, business-logic coverage, framework support, ta...

Security

The best SAST and source code scanning tools in 2026, Ostorlab, GitHub Code Security (CodeQL), Semgrep, Snyk Code, Ch...

Product

Ostorlab Threat Center now brings EUVD intelligence alongside NVD data, giving security teams broader vulnerability v...

Security

A practical guide to designing AI-assisted security testing workflows that turn scoped evidence into reviewable findi...

Engineering

Learn what separates AI-powered scanning from AI pentesting and how Ostorlab Deep Agentic Scan follows evidence to va...

Engineering

Learn how source code security testing works, why traditional SAST creates false positives, and how agentic analysis ...

Security

A technical assessment of the latest version of GoPhish that examines how the platform handles trust: identity, untru...

Security

Ostorlab vs Quokka Q-mast for mobile DAST: authenticated flows, TLS pinning bypass, PCAP evidence, geo-restricted app...

Product

Source Code Scanning helps you identify security vulnerabilities directly in your source code before they reach produ...

Product

The latest Deep Agentic Scan release introduces faster mobile testing, improved reverse engineering, stronger vulnera...

Product

Ostorlab has launched Mobile Shielding Scan, an automated, AI-powered testing solution designed specifically for shie...

Engineering

Agentic harnesses change what an LLM can do in mobile app security testing. On its own, a model can name likely risks...

Product

Ostorlab has launched Cyber Models, a managed, prepaid AI infrastructure tier for Agentic Deep Scans. It gives securi...

Security

Walk the floor of any major cybersecurity conference today and you will hear about the promise of autonomous AI-power...

Security

This comprehensive guide covers the architecture, risk methodologies, and deployment frameworks required to architect...

Product

Ostorlab has launched App Vetting, a mobile application risk assessment solution that helps teams evaluate Android an...

Engineering

We built an AI-powered pull request reviewer, shut it down after hallucinations and false positives eroded developer ...

Product

Ostorlab is launching a powerful, highly targeted AI orchestration engine accessible through two distinct UI workflow...

Security

A technical breakdown of CVE-2026-42208, a CVSS 9.3 critical unauthenticated SQL Injection vulnerability in the LiteL...

Security

A technical breakdown of DirtyFrag, a pair of Linux kernel local privilege escalation vulnerabilities (CVE-2026-43284...

Security

A technical breakdown of CVE-2026-44109, a CVSS 9.2 Critical authentication bypass vulnerability in OpenClaw (< 2026....

Security

A deep dive into a critical Server-Side Request Forgery (SSRF) vulnerability in Chatwoot's upload endpoint (≤ v4.12.1...

Security

A DORA compliance checklist helps banking and fintech organizations evaluate operational resilience across core areas...

Security

Static analysis of TV_V_23.apk, BeatBanker/BTMOB Android banking malware disguised as a flashlight app: four-stage ch...

Security

How HarmonyOS Next security testing differs from Android: ArkTS, DSoftBus, testing tools, SafetyDetect, ArkGuard, com...

Security

How intent redirection lets attackers reach unexported Android components, leak data via setResult() and abuse Pendin...

Product

Find a vulnerability scanner for HarmonyOS apps and Huawei AppGallery releases: Ostorlab adds automated, repeatable s...

Security

Mobile game security testing stops cheating, bots and tampering across client, network and backend layers: threats, t...

Security

Mobile AppSec testing for teams shipping iOS and Android fast: MAST vs SAST vs DAST, a testing checklist, CI/CD patte...

Security

How to security test patient portals, medical apps, APIs and SaMD: ePHI risks, HIPAA and GDPR duties, SDLC testing, c...

Security

Protecting mobile banking apps requires more than securing the client alone. This guide explores the risks across dev...

Security

A technical breakdown of CVE-2026-26720, a CVSS 9.8 Critical authenticated Remote Code Execution vulnerability in Twe...

Security

Manage DORA third-party risk in mobile apps with per-release SDK inventories and diffs, approval and ban rules, patch...

Security

App shielding explained: how mobile application shielding prevents reverse engineering and tampering on untrusted dev...

Security

A deep dive into two critical vulnerabilities uncovered in Roundcube Webmail (< 1.6.14, 1.5.14, 1.7 RC4) during a sou...

Product

Ostorlab now integrates with Harness CI to run automated mobile application security scans inside CI pipelines. Using...

Security

A technical breakdown of CVE-2026-27971, a CVSS 9.2 critical unauthenticated remote code execution vulnerability in Q...

Product

Why scanners stop at the login page and how Ostorlab automates testing behind SMS, email and TOTP 2FA, with a manual ...

Product

Ostorlab now integrates with Bitrise to run automated mobile application security scans inside CI workflows. Using a ...

Security

A technical breakdown of CVE-2026-2599, a CVSS 9.8 Critical unauthenticated PHP Object Injection vulnerability in the...

Security

A mobile-first guide to DORA compliance for BFSI teams. Learn how to define your scope, simplify your release process...

Product

Ostorlab has launched Agentic Deep Scan, a next-generation vulnerability scanner that validates real-world risks in i...

Security

CVE-2025-68461 (CVSS 7.2) lets SVG animate tags slip past the Roundcube sanitizer via namespace prefixes. PoC, patch ...

Security

Analysis of GHSA-cr3w-cw5w-h3fj, a CVSS 9.7 critical XSS-to-RCE vulnerability in Saltcorn (≤ 1.5.0-beta.19). Two chai...

Security

A mobile-first guide to DORA regulation and DORA compliance for BFSI teams. Learn how to define your scope, simplify ...

Security

A technical breakdown of CVE-2026-26019, a CVSS 4.1 medium Server-Side Request Forgery vulnerability in the LangChain...

Security

A mobile-first guide to DORA regulation and DORA compliance for BFSI teams. Learn how to define your scope, simplify ...

Security

The 10 tools our team uses to pentest mobile apps, from Frida, Ghidra and Jadx to mitmproxy and Nuclei, with best use...

Security

A technical breakdown of CVE-2025-64712, a CVSS 9.8 critical path traversal remote code execution vulnerability in th...

Security

A technical breakdown of CVE-2026-1357, a CVSS 9.8 critical unauthenticated remote code execution vulnerability in th...

Security

PentestGPT, PentAGI, HexStrike AI, Strix, CAI, Nebula, NeuroSploit, Deadend CLI and RedAmon compared: key features of...

Product

2025 marked the turning point where AI in cybersecurity graduated from experimental prototypes to production-grade en...

Security

From 2026, certified Android devices can block apps from unverified developers. What changes for sideloading, who is ...

Security

An AI-assisted analysis uncovered a 30-year-old uninitialized buffer vulnerability in glibc's _nss_dns_getnetbyaddr_r...

Security

Case study: Ostorlab's AI pentest engine finds an Android WebView JavaScript bridge reachable via deep links and chai...

Product

Compare Ostorlab, NowSecure, Appknox, Data Theorem, Quokka, Zimperium and MobSF for Android and iOS, with a feature m...

Security

How Android's FLAG_SECURE blocks screenshots, screen recording and recent-apps previews, with code samples, use cases...

Security

Ostorlab's AI Pentest Engine systematically uncovered a critical Broken Function-Level Authorization (BFLA) vulnerabi...

Security

Methodical analysis beats blind fuzzing as Ostorlab's AI engine discovers cross-version password reset weakness and a...

Security

How a second-order client-side data exfiltration chain was discovered in a modern SPA, transforming a simple open red...

Security

Ostorlab’s reasoning-driven AI engine breaks past rule-based limits to surface previously unknown and hard-to-detect ...

Security

The first open-source benchmark suite featuring 93 realistic vulnerable mobile apps that mirror actual CVE and bug bo...

Security

Large-scale security analysis of 500+ top mobile banking apps reveals widespread vulnerabilities, decade-old codebase...

Security

Precision beats payload spray using Ostorlab's AI engine to systematically land RCE on Titiler and proves exfiltratio...

Security

This article showcases Ostorlab's AI Pentest Engine's process for analyzing an Android application for Intent Redirec...

Security

This article presents a thorough, hands-on analysis and real-world exploitation of a hardcoded GCP service account wi...

Security

This technical analysis reveals how sophisticated attack chains—combining path traversal, symbolic link manipulation,...

Security

This article presents a thorough, hands-on analysis and proof of concept for exploiting an OOB XXE vulnerability CVE-...

Product

Ostorlab’s AI Monkey Tester transforms mobile app security testing by using natural language prompts and generative A...

Security

This article presents a thorough, hands-on analysis and proof of concept for exploiting the stored XSS vulnerability ...

Product

Ostorlab's Privacy Scan automatically detects mismatches between what your app's privacy policy says and what it actu...

Product

The Ostorlab Security Scanner GitHub Integration enhances mobile app development workflows by embedding automated sec...

Product

This article announces the new integration between Ostorlab and Vanta, explains how it works, outlines the setup proc...

Security

This research introduces a pioneering dual approach that combines signature-based matching (DalvikFLIRT) with LLM-pow...

Product

This article outlines our journey in implementing ostorlab copilot, the challenges we encountered, and the lessons we...

Product

This article announces Ostorlab's vulnerability ticketing system V2 and how it automates and streamlines the entire p...

Product

This article explores AI-automated attack surface management, its impact on cybersecurity, and how it automates asset...

Security

A technical analysis of a vulnerability in CyberPanel, a Pre-Auth Root RCE, including confirmed exploitation paths, i...

Security

This article is an in-depth look at the most common GraphQL vulnerabilities, why they occur, and how they can be mitigated.

Security

This article assesses the large-scale exposure of systems to multiple CVEs affecting the CUPS printing service, which...

Engineering

The Threat Center provides essential updates for organizations to stay informed about security threats, offering acti...

Security

An in-depth look at the CVE-2024-47374 vulnerability affecting LiteSpeed Cache plugin for WordPress, its impact, and ...

Security

How CVE-2022-21445, an actively exploited Oracle ADF deserialization flaw, gives unauthenticated attackers remote cod...

Security

The article uncovers an Arbitrary File Read vulnerability in VigorConnect that lets attackers access sensitive files....

Engineering

OXO Titan UI encapsulates OXO's capabilities within an accessible interface, democratizing advanced security scanning...

Security

Bypass 403 Forbidden responses by altering host and proxy headers, HTTP methods, parameters and URL paths, or by chec...

Product

Introducing the AI-powered Monkey Tester in the Ostorlab mobile vulnerability scanner, significantly boosting test co...

Security

CVE-2024-5315, an actively exploited Dolibarr SQL Injection with in incorrect patched-in version.

Security

E.V.A Information Security uncovered critical vulnerabilities in CocoaPods, leading to immediate patches, and develop...

Engineering

OXO version 1.0, is 10x times faster, supports ARM64 architectures, and is packed with improved capabilities like sca...

Engineering

This article offers a guide to Privacy Manifest files in Apple's ecosystem, stressing their importance for transparen...

Engineering

The article introduces a new method for detecting PostMessage Cross-Site Scripting (XSS) vulnerabilities using JavaSc...

Security

New vulnerabilities added to Ostorlab known exploited vulnerabilities catalog

Product

The article introduces Ostorlab Attack Surface Discovery as a solution for discovering and continuously monitoring mo...

Security

This article examines the security of mobile banking applications in North America, uncovering widespread vulnerabili...

Engineering

Article on Swift Dynamic Instrumentation. The article explains the steps to perform dynamic analysis of Swift-based a...

Security

New vulnerabilities added to Ostorlab known exploited vulnerabilities catalog

Security

New vulnerabilities added to Ostorlab known exploited vulnerabilities catalog

Security

The article delves into dependency confusion vulnerabilities and introduces a novel detection and exploitation techni...

Security

In this article we will Discover essential tools and empirical insights for identifying critical, high-severity, and ...

Product

As 2023 has concluded, it's time to reflect and prepare for an optimistic 2024.

Security

Release of new OWASP Mobile Top 10 with improvements, updates and a behind the scenes.

Product

Ostorlab clinches the top spot in the Swiss Cyber defense Security Challenge, showcasing their commitment to advancin...

Security

How a malicious app can hijack a custom URL scheme to take over OAuth accounts, with Google, Facebook, Cognito and Ok...

Security

Recent in-depth investigations reveal serious vulnerabilities discovered in widely-used zip packages in Flutter and S...

Security

Common Flutter app vulnerabilities, from weak cryptography and cleartext traffic to insecure WebViews, demonstrated i...

Security

This article is a technical deep dive, showing how a 100M+ installation image application can expose its user’s image...

Product

The new release brings a new AI Engine for improved recommendations, powerful new additions to Flutter detection and ...

Security

In this Article, we define a secure implementation of mobile biometric authentication and provide detailed implementa...

Security

Article on Static and Dynamic analysis techniques for Reverse engineering Flutter Applications. The article goes over...

Engineering

In this article, we look at different ways to improve the performance of Python which is an interpreted language.

Product

An overview of all the new features of the Ostorlab platform and its detection capabilities.

Security

In This article, we analyze the GodFather Android malware, which continues to appear in various formats and primarily...

Product

Ostorlab has successfully completed its SOC2 Type 2 audit, demonstrating its commitment to security and data protection.

Engineering

Ostorlab's Fix it! practice is one of our most successful engineering practices helping us eradicate bugs and kill te...

Product

Ostorlab’s new features are laser-focused on helping teams understand, track and search their attack surface, what at...

Product

Ostorlab has been selected as one of the top 10 vulnerability management innovators of 2023 by GRC Viewpoint.

Product

2022 is a year that brings with it many global challenges, including war, economic uncertainty, and rising inflation ...

Product

This article will cover the main challenges when implementing a CI/CD pipeline for mobile applications. We will also ...

Security

CVE-2022-42889 is a vulnerability in the Apache Commons Text Library caused by string interpolation abusing powerful ...

Product

As a reflection of the many new capabilities and changes we have made, we have released a new dashboard providing bet...

Product

The Mobile Application Security Verification Standard is an important step toward building secure Mobile Applications...

Engineering

Tips and tricks to make your life easier when developing & debugging OXO Agents.

Product

Largest release with improvements to Attack Surface, Open-Source, Mobile and Web scanning and much much more.

Engineering

This article talks about how OXO works under the hood.

Security

Attack Surface is not just about open ports and services; this article covers key insights beyond the standard techni...

Security

Attack surface mapping has become the number one headache of CISO's of most large organization, this article goes ove...

Engineering

This article talks about the experience of Rabson Phiri who works as a Software Engineer at Ostorlab.

Product

This article provides a comprehensive view of the security mobile security scanning solutions, while at the same time...

Product

This is a major release open-sourcing Ostorlab and announcing tons of new features and capabilities.

Security

What is the impact of Log4j vulnerability on mobile applications

Product

Wanna learn a bit more about Ostorlab? We answered Aviva Zack’s questions for Safety Detective about the Company, our...

Product

Vulnerability management is a hard journey, the help enable fixing of vulnerabilities urgently, diligently and effici...

Product

Vulnerability management is a hard journey, the help enable fixing of vulnerabilities urgently, diligently and effici...

Product

Ostorlab released the UI call coverage in the analysis environment to show the UI flow exercised during the dynamic s...

Product

Health Tech, Compromises and attacks, Instrumentation, Black Hat conferences, eBPF and more….

Security

This article is about bypassing SSL pinning without needing to. Sounds confusing? We will go over the theory, build a...

Security

This article is about WebViews and the security notions we need to have in mind when using these component in both An...

Security

Dependency Confusion is a new attack with high severity impact. This article is an overview of the vulnerability as w...

Security

The following article is a technical deep dive into how genetic algorithms can be leveraged to create superhuman XSS ...

Security

This weeks is marked by multiple high profile data breaches affecting Cashalo, Npower, Kia, T-Mobile and Clubhouse.

Product

Ostorlab is adding Web Security Scanner to its arsenal with novel approaches to vulnerability discovery.

Product

New Analysis Environment with access to disassembly, decompiled source, call trace, function tagging and many other features.

Security

Hardcoded secrets are easy to find and might open a gate to sensitive data or privileged access. This makes them a gr...

Security

The article introduces the term Autonomous Security in the context of security scanning and defines 5 tiers of maturity.

Product

Whether we are developing a mobile application or assessing its security, we need to continuously review it with ever...

Product

Ostorlab now supports creating scans directly from Android Play Store and iOS App Store

Security

Mobile security testing of Covid-19 Contact Tracing Application BeAware

Security

Mobile security testing of Covid-19 Contact Tracing Application Wiqaytna

Security

Mobile applications assessments, automation of 3rd party dependency review

Product

Xamarin decompilation, deprecated TLS protocols, hardcoded secrets and even more, Owasp top 10

Engineering

Overview of the detection capabilities provided by Ostorlab

Product

Better management of scan lifecycle, export scan results and subscriptions

Product

Announcement on changes in the management of scan accessibility

Product

Ostorlab Mobile Security Scanner Release of a new portal to track scans progress and access scan history.

Engineering

How to debug Nuxt.js application on Webstorm

Engineering

We took Cloud Run for a Test Drive, these are we what learnt.

Security

This article describes the usage of Ostorlab Insecure Application.

Security

How to perform security checks of an iOS application file on a non-jailbroken iPhone from a Linux Machine.

Product

In a mission to build the best security scanning technologies, Ostorlab team is proud to announce that the community ...

Security

Use the start of the year to contemplate how the previous year went, and prepare for the upcoming is an important exe...

Security

XSS are still by far the most common type of vulnerabilities, this article presents strategies to automate the search...

Security

This article is about how to manage AWS access keys when using AWS services in your mobile application.

Engineering

dynamic analysis

Product

The last few months, Ostorlab team has been hard at work adding exciting new features. Some of these have already hit...

Security

I will be sharing through a series of blog posts our past experimentations with the use of reinforcement learning for...

Security

the Attack Surface of mobile applications.

Security

Ostorlab is a community effort to build a mobile application vulnerability scanner to help developers build secure mo...

Security

We have been for the last few months hard at work developing a new scan engine to identify new classes of vulnerabili...

Security

Hybrid frameworks like Cordova offers the advantage of building one app for multiple platform (support for Android, i...

Security

Before we get into SQL injections and what might go wrong, we'll start by covering some technical information on Cont...

Engineering

For an Android developer, it has become standard practice to use external libraries to easily extend the functionalit...

Security

Google will start identifying security weaknesses in Apps pushed to the Play Store...

Engineering

At Ostorlab we scan hundreds of Mobile Applications each day, each scan is very resource intensive but at the same ti...

Security

In Android, the permission system was one of the major security concerns of the platform for many reasons...

Security

Implement SSL pinning on Android with Network Security Config, OkHttp and Retrofit, then test it and rotate pins safe...

Security

Apparently Facebook is crashing their apps intentionally in order to test users reaction and evaluate their adherence...

Security

The last years have come with meaningful changes in the way IT professionals operate and the way we approach security...

Product

We are pleased to release the Beta version of our online mobile application security scanner.

Security

This article will reference the best current resources on SSL/TLS.