Ostorlab

Ostorlab vs MobSF: Analyst-Driven vs AI-Driven Mobile Security Testing (2026)

Abir Jelti — Wed, 07 Oct 2026 10:00:00 +0200

Ostorlab vs MobSF (Mobile Security Framework) for mobile app security testing: static and dynamic analysis, device requirements, exploit proof, authenticated testing, integrations, deployment and cost, with alternatives and an FAQ.

Ostorlab vs Oversecured: Mobile App Security Testing Compared (2026)

Abir Jelti — Wed, 07 Oct 2026 10:00:00 +0200

Ostorlab vs Oversecured for mobile app security testing: iOS and Android coverage, exploit proof, authenticated testing, APIs, integrations, deployment and pricing, with a side-by-side table, alternatives and an FAQ.

Snyk and Checkmarx Alternatives: Ostorlab vs Snyk Code, Checkmarx One and GitHub Advanced Security (2026)

Abir Jelti — Wed, 07 Oct 2026 10:00:00 +0200

The best Snyk Code, Checkmarx One and GitHub Advanced Security alternatives for SAST in 2026, and how Ostorlab compares on languages, developer workflow, false positives, exploit proof, logic bugs, deployment and pricing.

We Built an AI Agent for Our Own Backlog. Now It's Yours.

Bilal Harras — Tue, 06 Oct 2026 09:00:00 +0200

How a small agent that turned bug tickets into pull requests became Ostorlab's ticket agent: an AI teammate you give a job, a model, and rules for when it runs.

The True Cost of False Positives: Calculating the Engineering Tax of Noisy Scanners

Sohaib Harraoui — Mon, 28 Sep 2026 10:00:00 +0200

False positives are an engineering-capacity problem, not only a scanner-quality problem. Learn how to measure their cost and evaluate the ROI of proof-of-exploit testing.

Who Should Use Ostorlab? Best-Fit Teams, Use Cases, and When to Choose Something Else

Abir Jelti — Mon, 28 Sep 2026 08:00:00 +0200

Ostorlab fits teams testing connected mobile, web, API, and code assets on every release. Where it fits, which plan to pick, and when another tool is better.

Ostorlab vs. Pentesting Firms: 2026 Cost & Depth Comparison

Youssef Mabrouk — Fri, 25 Sep 2026 16:00:00 +0200

Ostorlab vs. pentesting firms: cost, testing frequency, depth and remediation, and when to use AI pentests, consultants, or both.

Why API Security Testing Misses Cross-Asset Attack Chains

Bilal Harras — Fri, 25 Sep 2026 14:00:00 +0200

API-only scanners miss attack chains that start with secrets or routes in mobile apps, web bundles, or code. Two real chains and an 8-step test checklist.

AI Pentesting for SOC 2: 6 Providers Compared

Youssef Mabrouk — Fri, 25 Sep 2026 10:00:00 +0200

Compare Ostorlab, XBOW, Aikido, Intruder, Escape and Penti for SOC 2 pentests on exploit evidence, human review, sample reports, retesting and pricing.

How Much Does an Application Penetration Test Cost in 2026?

Abir Jelti — Fri, 25 Sep 2026 08:00:00 +0200

Manual app pentests cost $3,000–$50,000+ in 2026; published AI pentests run $499 to about $8,000. What drives price, what quotes exclude, how to compare.

Best Tools for Testing Mobile App Shielding Bypass

Youssef Mabrouk — Wed, 23 Sep 2026 12:00:00 +0200

Compare Apktool, JADX, Ghidra, Frida, Objection and LLDB for manual tests with Ostorlab’s automated Android and iOS mobile shielding and RASP assessment.

How Deep Agentic Scan Catches Tricky Real-World Vulnerabilities

Oussama Bakri — Wed, 23 Sep 2026 10:00:00 +0200

How Ostorlab's Deep Agentic Scan uncovers and empirically proves complex vulnerabilities across web, mobile, and source code, in four real case studies.

Can an AI Agent Prove SAST Findings at Runtime?

Mohammed Lachhab — Wed, 23 Sep 2026 10:00:00 +0200

Static analysis flags possible bugs but cannot prove them. Runtime validation proved a Langflow authenticated RCE and corrected a libxml2 use-after-free's stated trigger conditions.

The Map and the Window: How an Agentic Scan Chained a Documentation Leak Into Stolen Credentials

Aziz Elbelaychy — Wed, 23 Sep 2026 10:00:00 +0200

See how Ostorlab's Agentic Deep Scan chained a Medium-severity OpenAPI disclosure and an SSRF vulnerability to bypass a loopback restriction and extract database credentials.

Best API Security Testing Tools in 2026: 4 Compared

Bilal HARRAS — Tue, 22 Sep 2026 14:00:00 +0200

The best API security testing tools in 2026: StackHawk, 42Crunch, Escape, and Ostorlab compared on DAST, BOLA/BFLA testing, API discovery, and CI/CD.

Post-Mortem: Why Autonomous AI Agents Escape Scope and How to Contain Them

Bilal Harras — Fri, 18 Sep 2026 12:00:00 +0200

A technical post-mortem on an AI agent that wandered outside its testing scope during an authorized API assessment, what caused it, and how we contain autonomous agents.

The Fastest Way to Get an Audit-Ready Pentest Report for SOC 2 Compliance

Sohaib Harraoui — Wed, 16 Sep 2026 10:00:00 +0200

Learn how B2B SaaS startups bypass the 4-week consultancy delay to generate audit-ready SOC 2 pentest reports and Letters of Attestation in days rather than weeks.

Ostorlab Neutron on UC Berkeley CyberGym: 97.1% Verified Exploitation (1,463/1,507 Tasks)

Sohaib Harraoui — Tue, 15 Sep 2026 17:00:00 +0200

A technical deep-dive into how Ostorlab Neutron reached a 97.1% verified exploit solve rate (1,463/1,507 tasks) and localized the flaw in all 1,507 tasks on UC Berkeley's CyberGym benchmark, combining pure source reverse engineering with deterministic protocol modeling.

Best On-Premises AppSec Testing Platforms (2026)

Abir Jelti — Tue, 15 Sep 2026 10:00:00 +0200

Compare Ostorlab, Invicti, Burp Suite DAST, HCL AppScan and Fortify for on-premises AppSec testing: deployment model, data control and private target access.

Ostorlab Neutron Reaches 97.1% on the CyberGym Benchmark

Abir Jelti — Mon, 14 Sep 2026 17:42:00 +0200

Ostorlab Neutron reached a 97.1% verified exploit solve rate on CyberGym, producing working differential proofs of concept for 1,463 of the benchmark's 1,507 vulnerability reproduction tasks.

7 Best External Attack Surface Management Tools (2026)

Abir Jelti — Fri, 11 Sep 2026 10:00:00 +0200

Compare 7 external attack surface management platforms, such as Ostorlab, Defender EASM, Cortex Xpanse and CyCognito, on discovery, validation and remediation.

Best Web App Security Testing Tools in 2026

Abir Jelti — Fri, 11 Sep 2026 10:00:00 +0200

Compare Ostorlab, Burp Suite DAST, Invicti, InsightAppSec, AppScan, XBOW and OWASP ZAP, plus when DAST is enough and when you need agentic pentesting.

Best Enterprise Mobile App Vetting Platforms 2026

Abir Jelti — Thu, 10 Sep 2026 10:00:00 +0200

Compare Ostorlab, NowSecure, Quokka, Zimperium, Appknox and Data Theorem for Android and iOS app vetting: operating model, risk scoring and monitoring.

Best AI Pentesting Platforms in 2026

Abir Jelti — Wed, 09 Sep 2026 00:00:00 +0200

Compare leading AI pentesting platforms in 2026 by asset coverage, autonomous exploitation, attack chaining, evidence, compliance, and deployment.

Autonomous Pentesting vs Traditional Pentesting

Sohaib Harraoui — Tue, 08 Sep 2026 14:00:00 +0200

Compare traditional pentests, PTaaS and autonomous AI testing: where agents win on coverage and evidence, where humans still lead, and how to combine them.

New Dashboard UI, On-Premises Scanner, Agentic Scan Knowledge, Multi-Asset Scanning, Linear & MCP Integrations, and New Model Support

Ostorlab Team — Wed, 02 Sep 2026 19:00:00 +0200

This release adds a redesigned Dashboard UI (Cockpit, Focus Mode, and Custom Dashboards), keyboard shortcuts for ticket management, an on-premises vulnerability scanner for internal networks, persistent scan knowledge across runs, an MCP server for AI tools, multi-asset scanning, remediation streams with timeline tracking, Threat Center EUVD intelligence, and expanded AI model support.

Introducing Multi-Asset Deep Agentic Scan: Connected Testing Across the Application

Abir Jelti — Wed, 02 Sep 2026 10:00:00 +0200

Multi-Asset Deep Agentic Scan assesses related mobile, web, API, network, source-code, and documentation assets in one connected agentic investigation.

Bypassing Mobile App Shielding: Where Detection Ends and Enforcement Fails

Mohammed Lachhab — Wed, 12 Aug 2026 10:20:00 +0200

Detection and enforcement are different security properties. Across five production banking apps protected by four commercial shielding products, the detection was sophisticated and the enforcement was fragile.

The 2026 Guide to Penetration Testing for Startups (Costs, Process, and Vendor Selection)

Bilal Harras — Sun, 09 Aug 2026 10:30:00 +0200

A comprehensive guide on what penetration testing is, how much it costs for startups in 2026, the 5-step testing process, and how to choose the right vendor for your tech stack.

Introducing the Ostorlab Platform MCP Server

Abir Jelti — Sat, 08 Aug 2026 15:55:00 +0200

Ostorlab now supports MCP, giving AI assistants and agents permission-controlled access to security data and workflows.

Introducing Risk Reruns: Granular Control for Agentic Deep Scans

Bilal Harras — Fri, 07 Aug 2026 18:50:00 +0200

Introducing Risk Reruns for Agentic Deep Scans—rerun specific risk investigations with customized effort levels, AI models, or parameters without re-uploading assets or starting over.

AI Can Run the Attack. Can You Trust the Result?

Mohammed Lachhab — Thu, 06 Aug 2026 13:35:00 +0200

AI can produce a convincing exploit story in seconds. Runtime proof, negative controls, and human review determine whether that story becomes a finding a security team can trust.

Can SOC 2 Accept an AI-Conducted Penetration Test?

Aziz Elbelaychy — Thu, 06 Aug 2026 10:00:00 +0200

SOC 2 doesn't name a required testing method, so auditors judge evidence, not tools. Here's what an AI-conducted penetration test actually needs to satisfy a SOC 2 Type II audit.

Introducing Agentic Scan Knowledge: The Scanner That Never Forgets

Abir Jelti — Wed, 05 Aug 2026 09:58:00 +0200

Agentic Scan Knowledge gives Ostorlab security agents persistent application context, allowing every scan to build on previous tests instead of starting again from zero.

Introducing Ostorlab Mobile Shielding Scan

Abir Jelti — Tue, 04 Aug 2026 18:39:00 +0200

Ostorlab Mobile Shielding Scan tests Android and iOS protections against real bypasses, including root detection, anti-tampering, certificate pinning, and obfuscation.

Announcing Ostorlab’s On-Premises Vulnerability Scanner

Bilal Harras — Tue, 04 Aug 2026 13:37:00 +0200

Announcing the general availability of the Ostorlab On-Premises Vulnerability Scanner, designed to identify and contextualize security flaws within your local infrastructure.

Ostorlab vs Aikido: AppSec Platform Comparison

Bilal HARRAS — Mon, 03 Aug 2026 18:00:00 +0200

Ostorlab vs Aikido on SAST, web and API pentesting, mobile binary testing, cloud posture, BYOK and remediation, with a side-by-side table and an FAQ.

Ostorlab vs Appknox: Setting the Record Straight

Bilal HARRAS — Wed, 29 Jul 2026 14:00:00 +0200

Ostorlab responds to the Appknox 'Top 10 MAST Tools' list: what it got wrong, KnoxIQ vs Agentic Deep Scan, full-stack coverage, deployment and pricing.

XBOW vs Ostorlab: AI Pentesting Compared

Bilal HARRAS — Tue, 28 Jul 2026 11:29:00 +0200

XBOW and Ostorlab compared on target scoping, mobile and API coverage, cross-asset exploit chaining, CI/CD testing, evidence and remediation workflows.

How AI Catches Complex Vulnerabilities: Inside Agentic Pentesting and Exploit Chaining

Aziz Elbelaychy — Tue, 28 Jul 2026 10:00:00 +0200

Discover how agentic AI catches business logic flaws rule-based scanners miss. See a real exploit chain escalating a fixed finding to tenant-wide compromise.

Ostorlab vs NowSecure: Mobile AppSec Comparison

Bilal HARRAS — Mon, 27 Jul 2026 16:47:00 +0200

Ostorlab vs NowSecure in six areas: cost and scale, CI/CD integration, business-logic coverage, framework support, targeted scans and geo-restricted apps.

Best SAST Tools in 2026: Source Code Scanning Tools Compared

Youssef Mabrouk — Mon, 27 Jul 2026 10:00:00 +0200

The best SAST and source code scanning tools in 2026, Ostorlab, GitHub Code Security (CodeQL), Semgrep, Snyk Code, Checkmarx One, SonarQube, Veracode, Black Duck Coverity and OpenText Fortify, compared on languages, CI/CD, false positives, AI fixes and pricing.

The Ostorlab Threat Center Now Supports the EU Vulnerability Database

Abir Jelti — Fri, 24 Jul 2026 09:09:00 +0200

Ostorlab Threat Center now brings EUVD intelligence alongside NVD data, giving security teams broader vulnerability visibility as they prepare for the EU Cyber Resilience Act.

AI Pentesting Prompts That Produce Evidence, Not Just Findings

Mohammed Lachhab — Thu, 23 Jul 2026 16:00:00 +0200

A practical guide to designing AI-assisted security testing workflows that turn scoped evidence into reviewable findings through structured outputs, validation gates, and controlled execution.

When Does an AI Scanner Become an AI Pentest?

Abir Jelti — Wed, 22 Jul 2026 17:50:00 +0200

Learn what separates AI-powered scanning from AI pentesting and how Ostorlab Deep Agentic Scan follows evidence to validate real attack paths.

Source Code Security: From Signal to Validated Risk | Ostorlab

Abir Jelti — Thu, 16 Jul 2026 12:13:00 +0200

Learn how source code security testing works, why traditional SAST creates false positives, and how agentic analysis turns scanner signals into actionable findings.

Breaking Down the Latest Version of GoPhish: Source-Code Assessment with Ostorlab Agentic Deep Scan

Sohaib Harraoui — Thu, 16 Jul 2026 10:00:00 +0200

A technical assessment of the latest version of GoPhish that examines how the platform handles trust: identity, untrusted content, object ownership, credential lifecycle, and outbound requests. Source-code analysis with Ostorlab Agentic Deep Scan established the eight report-level findings, PoCs, and remediation priorities.

Ostorlab vs Quokka Q-mast: Mobile DAST Comparison

Bilal HARRAS — Wed, 15 Jul 2026 18:00:00 +0200

Ostorlab vs Quokka Q-mast for mobile DAST: authenticated flows, TLS pinning bypass, PCAP evidence, geo-restricted apps, API scanning and Agentic Deep Scan.

Introducing Ostorlab Source Code Scanning

Youssef Mabrouk — Tue, 07 Jul 2026 18:00:00 +0200

Source Code Scanning helps you identify security vulnerabilities directly in your source code before they reach production. Connect your repositories, run scans on demand, and review actionable findings from within Ostorlab.

App Vetting, Scan Coverage Heatmap, Mobile Shielding Scan, Deep Agentic Scan Improvements, Cyber Models & Source Code Scanning

Ostorlab Team — Tue, 07 Jul 2026 00:00:00 +0200

This release introduces App Vetting, Scan Coverage Heatmap, Mobile Shielding Scan, Deep Agentic Scan improvements, Cyber Models, additional model support, and source code scanning.

Deep Scan Improvements: Faster Execution, Better Decisions, and Incremental Testing

Youssef Mabrouk — Tue, 30 Jun 2026 19:00:00 +0200

The latest Deep Agentic Scan release introduces faster mobile testing, improved reverse engineering, stronger vulnerability detection, incremental coverage through historical scan processing, improved vulnerability chaining, and managed Cyber Models for mobile and web assessments.

Introducing Mobile Shielding That Can Resist AI Attacks

Kawtar Boumaan — Thu, 25 Jun 2026 16:00:00 +0200

Ostorlab has launched Mobile Shielding Scan, an automated, AI-powered testing solution designed specifically for shielding detection and validation. It gives security teams streamlined, continuous validation of critical iOS and Android runtime protections, identifying whether security shields are actually present and if they can withstand real-world attacks. This empowers organizations with an automated, scalable, and powerful way to continuously validate RASP tools and mobile self-defense layers across every release.

The App Was Never Opened

Abir Jelti — Thu, 25 Jun 2026 09:02:00 +0200

Agentic harnesses change what an LLM can do in mobile app security testing. On its own, a model can name likely risks such as insecure storage, exposed secrets, risky permissions, vulnerable SDKs, backend issues, and privacy exposure, but the app may remain untouched. With the right tools, context, memory, prompts, execution loops, and runtime feedback around it, the model can inspect the app package, observe behavior, follow traffic, connect signals, and leave behind evidence a security team can review. From permission analysis to GEF-powered native exploitation, the difference is visible in the trace: app evidence, tool output, runtime proof, and reproducible steps instead of report-shaped text.

Introducing Ostorlab Cyber Models

Kawtar Boumaan — Tue, 23 Jun 2026 16:00:00 +0200

Ostorlab has launched Cyber Models, a managed, prepaid AI infrastructure tier for Agentic Deep Scans. It gives security teams streamlined access to specialized models like GPT-5.5 Cyber and Opus 4.8 with Cyber Verification Program through approved provider channels. This bypasses the need to manage external API keys, provider rate limits, or fragmented billing dashboards.

There Is No Magic Box: Why AI-Era AppSec Needs a Stack

Bilal HARRAS — Mon, 22 Jun 2026 10:00:00 +0200

Walk the floor of any major cybersecurity conference today and you will hear about the promise of autonomous AI-powered platforms. But AI-only testing doesn't scale. A resilient AppSec program requires a cost-aware, tiered stack combining rapid traditional scanners, private semantic reviews, and selective orchestration of frontier models.

The Definitive Guide to Mobile App Vetting: Securing the Enterprise App Ecosystem

Bilal HARRAS — Fri, 19 Jun 2026 10:08:00 +0200

This comprehensive guide covers the architecture, risk methodologies, and deployment frameworks required to architect an enterprise mobile app vetting strategy that protects corporate data assets without creating operational friction.

Introducing Ostorlab App Vetting for the Agentic Era

Abir Jelti — Tue, 16 Jun 2026 08:47:00 +0200

Ostorlab has launched App Vetting, a mobile application risk assessment solution that helps teams evaluate Android and iOS apps before approval. It combines static analysis, dynamic testing, and secure sandbox execution with continuous monitoring, weighted risk scoring, and agentic workflows to identify vulnerabilities, privacy risks, malware indicators, telemetry behavior, and trust issues while helping teams prioritize what matters most.

Building an AI PR Reviewer Engineers Actually Trust

Abir Jelti — Mon, 08 Jun 2026 10:30:00 +0200

We built an AI-powered pull request reviewer, shut it down after hallucinations and false positives eroded developer trust, then rebuilt it with better models, broader context, and a more conservative agent architecture. This article shares what we learned about automated code review, why trust matters more than coverage, and how AI reviewers can help engineering teams reduce repetitive review work without replacing human judgment.

Introducing Ostorlab’s Single Vulnerability Assessment and Dig Deeper

Kawtar Boumaan — Tue, 02 Jun 2026 16:00:00 +0200

Ostorlab is launching a powerful, highly targeted AI orchestration engine accessible through two distinct UI workflows: Single Vulnerability Assessment (SVA) and Dig Deeper. While both features share the exact same underlying AI logic, capabilities, and "Bring-Your-Own-Key" structure, they are tailored for different entry points in your workflow. SVA is launched as a fresh, standalone scan for targeted, cost-efficient assessments, fix validations, or bug bounty verifications. Dig Deeper is triggered directly from an existing finding within a scan report to instantly investigate false positives or trace exploit paths. Together, they give teams surgical control over how they test and validate individual vulnerabilities.

Single Vulnerability Assessment (SVA), Dig Deeper, Scan Report PDF Design Improvement & Multilanguage Support

Ostorlab Team — Mon, 01 Jun 2026 00:00:00 +0200

This release introduces Single Vulnerability Assessment (SVA) for targeted validation, Dig Deeper for granular root-cause investigation, Live Attack Scenario Risk & Status Tracking, Scan Report PDF Design Improvement, full multilanguage localization, and new compliance whitelisting support.

Exploit CVE-2026-42208: LiteLLM Unauthenticated SQL Injection via Bearer Token

Sohaib Harraoui — Fri, 22 May 2026 14:00:00 +0200

A technical breakdown of CVE-2026-42208, a CVSS 9.3 critical unauthenticated SQL Injection vulnerability in the LiteLLM Proxy API. Improper parameterization of the Bearer token within raw SQL queries used for complex multi-table joins allows blind boolean-based timing attacks, enabling unauthenticated attackers to exfiltrate sensitive data including virtual API keys, user information, and LLM spend logs directly from the database.

DirtyFrag: Universal Linux Local Privilege Escalation via Page-Cache Write

Aziz Elbelaychy — Wed, 13 May 2026 14:00:00 +0200

A technical breakdown of DirtyFrag, a pair of Linux kernel local privilege escalation vulnerabilities (CVE-2026-43284 and CVE-2026-43500, CVSS 7.8 HIGH) that allow any unprivileged local user to obtain root on most major Linux distributions. By chaining an xfrm-ESP and an RxRPC in-place decryption path flaw, both rooted in the same page-cache write primitive as Dirty Pipe and Copy Fail, the exploit overwrites read-only page cache pages without a race condition, achieving near-100% reliability.

CVE-2026-44109: OpenClaw Feishu Auth Bypass to RCE

Mohammed Lachhab — Thu, 07 May 2026 14:00:00 +0200

A technical breakdown of CVE-2026-44109, a CVSS 9.2 Critical authentication bypass vulnerability in OpenClaw (< 2026.4.15). Two fail-open logic inversions in the Feishu/Lark plugin — one in the webhook signature validator and one in the card-action replay guard — allow an unauthenticated attacker to inject arbitrary events into OpenClaw's command dispatch engine. When the bot has execution tools enabled, this translates directly to unauthenticated remote code execution on the host machine with the privileges of the OpenClaw process.

CVE-2026-5205: Critical SSRF in Chatwoot Uploads

Mohammed Lachhab — Wed, 29 Apr 2026 14:00:00 +0200

A deep dive into a critical Server-Side Request Forgery (SSRF) vulnerability in Chatwoot's upload endpoint (≤ v4.12.1). The /api/v1/accounts/:id/upload endpoint accepts an external_url parameter validated only by a scheme check, allowing any authenticated agent to force the server to fetch arbitrary internal URLs. The full response body is returned in-band through ActiveStorage blobs — turning the upload endpoint into a full-read proxy. Live exploitation on a DigitalOcean droplet confirmed in-band exfiltration of cloud metadata including droplet ID, hostname, SSH public keys, and full metadata bundles. Fixed in v4.13.0.

DORA Compliance Checklist for Banking & Fintech: Audit-Ready Operational Resilience Validation

Abir Jelti — Wed, 29 Apr 2026 09:23:00 +0200

A DORA compliance checklist helps banking and fintech organizations evaluate operational resilience across core areas like ICT risk, incident response, resilience testing, third-party governance, and oversight, while tracking implementation progress and supporting audit readiness.

BeatBanker/BTMOB Android Banking Malware Analysis

Aziz ELBELAYCHY — Tue, 28 Apr 2026 14:00:00 +0200

Static analysis of TV_V_23.apk, BeatBanker/BTMOB Android banking malware disguised as a flashlight app: four-stage chain, anti-analysis, attribution and IOCs.

HarmonyOS Next Security Testing: Tools and Risks

Youssef Mabrouk — Tue, 28 Apr 2026 12:00:00 +0200

How HarmonyOS Next security testing differs from Android: ArkTS, DSoftBus, testing tools, SafetyDetect, ArkGuard, common flaws and OWASP MASVS mapping.

Android Intent Redirection: Attacks and Fixes

Bilal Harras — Thu, 23 Apr 2026 10:30:00 +0200

How intent redirection lets attackers reach unexported Android components, leak data via setResult() and abuse PendingIntents, plus six ways to prevent it.

Introducing HarmonyOS App Scans + Huawei AppGallery Scans

Bilal Harras — Mon, 20 Apr 2026 16:00:00 +0200

Find a vulnerability scanner for HarmonyOS apps and Huawei AppGallery releases: Ostorlab adds automated, repeatable security scans so teams can continuously assess Huawei-distributed mobile apps and fix issues faster.

Mobile Game Security Testing: Stop Cheats and Hacks

Youssef Mabrouk — Mon, 20 Apr 2026 10:30:00 +0200

Mobile game security testing prevents cheating, hacks, and revenue loss by securing client, network, and backend layers. This guide covers the latest threats, testing methodologies, and best practices for mobile security teams and mobile game developers looking to keep their game safe, fair, and compliant.

Mobile AppSec Testing Best Practices at Scale

Bilal Harras — Thu, 16 Apr 2026 18:00:00 +0200

Mobile AppSec testing for teams shipping iOS and Android fast: MAST vs SAST vs DAST, a testing checklist, CI/CD patterns and severity-based release gating.

Healthcare Application Security Testing Guide

Kawtar Boumaan — Thu, 16 Apr 2026 16:00:00 +0200

How to security test patient portals, medical apps, APIs and SaMD: ePHI risks, HIPAA and GDPR duties, SDLC testing, continuous monitoring and incident response.

Mobile Banking App Security Testing Guide

Abir Jelti — Thu, 16 Apr 2026 09:59:00 +0200

Protecting mobile banking apps requires more than securing the client alone. This guide explores the risks across devices, networks, and backend systems, and explains why continuous mobile security testing is essential for protecting financial data and transactions.

Twenty CRM Serverless Functions Expose Critical RCE and Permanent Unauthenticated Backdoor Risk (CVE-2026-26720) - PoC & Exploit

Mohammed Lachhab — Wed, 15 Apr 2026 09:00:00 +0200

A technical breakdown of CVE-2026-26720, a CVSS 9.8 Critical authenticated Remote Code Execution vulnerability in Twenty CRM (≤ v1.15.0). Any workspace member can create and execute serverless functions that run unsandboxed with full access to process.env, leaking APP_SECRET, PG_DATABASE_URL, and all server-side credentials. When combined with webhook-triggered workflows exposed via PublicEndpointGuard, a single authenticated attacker can install a permanent unauthenticated RCE backdoor accessible from anywhere on the internet.

DORA Third-Party Risk: Mobile SDK Governance

Bilal Harras — Tue, 14 Apr 2026 18:00:00 +0200

Manage DORA third-party risk in mobile apps with per-release SDK inventories and diffs, approval and ban rules, patch SLAs and audit-ready evidence packs.

Mobile App Shielding: What It Is, How It Works

Youssef Mabrouk — Mon, 13 Apr 2026 12:00:00 +0200

App shielding explained: how mobile application shielding prevents reverse engineering and tampering on untrusted devices, and what to look for in tools.

Roundcube IMAP Command Injection and SSRF Flaws

Aziz Elbelaychy — Wed, 08 Apr 2026 18:00:00 +0200

A deep dive into two critical vulnerabilities uncovered in Roundcube Webmail (< 1.6.14, 1.5.14, 1.7 RC4) during a source code review. OVE-2026-8 allows authenticated attackers to inject arbitrary IMAP commands via the _filter parameter due to missing CRLF sanitization. OVE-2026-9 enables Server-Side Request Forgery (SSRF) by exploiting the CSS proxying mechanism, allowing access to internal network resources and cloud metadata.

Announcing Ostorlab for Harness: Mobile Security Scanning in CI Pipelines

Abir Jelti — Mon, 06 Apr 2026 16:51:00 +0200

Ostorlab now integrates with Harness CI to run automated mobile application security scans inside CI pipelines. Using Harness Secrets and a simple Run step, teams can install the Ostorlab CLI and run ostorlab ci-scan run against the same build artifacts produced by the pipeline (e.g., Android APK, Android AAB, or iOS IPA). The integration helps bring security into CI by improving feedback speed and catching vulnerabilities earlier, with options to tailor scans via profiles (fast, full) and optional inputs like test credentials, SBOM, and UI prompts.

CVE-2026-27971 : Qwik server$ Unauthenticated Remote Code Execution

Aziz Elbelaychy — Wed, 01 Apr 2026 14:00:00 +0200

A technical breakdown of CVE-2026-27971, a CVSS 9.2 critical unauthenticated remote code execution vulnerability in Qwik (< 1.19.1). Unsafe deserialization in the server$ RPC flow allows attacker-controlled QRL objects to be reconstructed from application/qwik-json requests, enabling arbitrary module path and symbol resolution and, where require() is available,remote code execution via crafted server-side function invocation.

Security Testing Behind Login Walls: 2FA and MFA

Abir Jelti — Mon, 30 Mar 2026 16:44:00 +0200

Why scanners stop at the login page and how Ostorlab automates testing behind SMS, email and TOTP 2FA, with a manual fallback and secured credentials.

Announcing Ostorlab for Bitrise: Mobile security scans in your CI

Bilal Harras — Fri, 27 Mar 2026 14:44:00 +0100

Ostorlab now integrates with Bitrise to run automated mobile application security scans inside CI workflows. Using a Bitrise Secret plus a simple Script step, teams can install the Ostorlab CLI and run ostorlab ci-scan run against the same build artifacts produced by the pipeline (e.g., Android APK, Android AAB, or iOS IPA). The integration helps shift security left by shortening feedback loops and catching vulnerabilities earlier, with options to tailor scans via profiles (fast, full, agentic deep scan) and optional inputs like test credentials, SBOM, and UI prompts.

Deep Agentic Scan (BYOK), New CI Integrations, Scan Filters & Performance

Ostorlab Team — Fri, 27 Mar 2026 00:00:00 +0100

This release highlights Agentic Deep Scan with BYOK (Bring Your Own AI Key), adds Harness + Bitrise CI documentation, introduces scan filtering by tags and owners, and delivers major performance improvements across tickets and scans.

CVE-2026-2599: WordPress PHP Object Injection to RCE

Mohammed Lachhab — Wed, 25 Mar 2026 14:00:00 +0100

A technical breakdown of CVE-2026-2599, a CVSS 9.8 Critical unauthenticated PHP Object Injection vulnerability in the "Contact Form Entries" WordPress plugin (≤ 1.4.7). The download_csv function deserializes untrusted user input without allowed_classes restrictions. When combined with WordPress 6.4.0-6.4.1, the built-in WP_HTML_Token class provides a complete all-public POP chain leading to full Remote Code Execution via two unauthenticated HTTP requests.

Mobile Operational Resilience Under DORA: The simplest drill library for BFSI journeys

Bilal Harras — Tue, 24 Mar 2026 14:44:00 +0100

A mobile-first guide to DORA compliance for BFSI teams. Learn how to define your scope, simplify your release process, and avoid the traps that create unnecessary compliance work.

Ostorlab Launches Agentic Deep Scan: The next-generation vulnerability scanner

Ostorlab Team — Thu, 19 Mar 2026 11:00:00 +0100

Ostorlab has launched Agentic Deep Scan, a next-generation vulnerability scanner that validates real-world risks in iOS, Android (soon harmonyOS), and web applications. With Bring Your Own Key (BYOK) support, teams can safely explore its powerful scanning capabilities while keeping full control of their data and costs.

CVE-2025-68461: Roundcube SVG Animate XSS Bypass

Aziz Elbelaychy — Tue, 17 Mar 2026 14:00:00 +0100

CVE-2025-68461 (CVSS 7.2) lets SVG animate tags slip past the Roundcube sanitizer via namespace prefixes. PoC, patch analysis, Nuclei detection and mitigation.

GHSA-cr3w-cw5w-h3fj: 1-Click RCE in Saltcorn

Mohammed Lachhab — Wed, 11 Mar 2026 13:00:00 +0100

Analysis of GHSA-cr3w-cw5w-h3fj, a CVSS 9.7 critical XSS-to-RCE vulnerability in Saltcorn (≤ 1.5.0-beta.19). Two chained flaws, reflected XSS in route parameters and command injection in backup generation, enable remote code execution via administrator phishing.

DORA Compliance for Mobile Releases: The easiest baseline, verdict, and exceptions model

Bilal Harras — Tue, 10 Mar 2026 14:44:00 +0100

A mobile-first guide to DORA regulation and DORA compliance for BFSI teams. Learn how to define your scope, simplify your release process, and avoid the traps that create unnecessary compliance work.

CVE-2026-26019 : LangChain RecursiveUrlLoader Server-Side Request Forgery Vulnerability

Aziz Elbelaychy — Wed, 04 Mar 2026 14:00:00 +0100

A technical breakdown of CVE-2026-26019, a CVSS 4.1 medium Server-Side Request Forgery vulnerability in the LangChain Community JavaScript package (< 1.1.14). The RecursiveUrlLoader class uses a naive string prefix check to validate crawled URLs, allowing an attacker to bypass the default preventOutside restriction with a suffixed domain and redirect the crawler to internal network assets, potentially exposing sensitive credentials and metadata endpoints.

DORA Compliance for Mobile Teams: Understanding scope and what you need to do

Bilal Harras — Tue, 03 Mar 2026 11:00:00 +0100

A mobile-first guide to DORA regulation and DORA compliance for BFSI teams. Learn how to define your scope, simplify your release process, and avoid the traps that create unnecessary compliance work.

Top 10 Mobile App Penetration Testing Tools (2026)

Youssef Mabrouk — Fri, 27 Feb 2026 16:00:00 +0100

The 10 tools our team uses to pentest mobile apps, from Frida, Ghidra and Jadx to mitmproxy and Nuclei, with best uses, strengths and limits for each one.

CVE-2025-64712: Path Traversal RCE in Unstructured Library MSG Processing

Aziz Elbelaychy — Mon, 23 Feb 2026 08:00:00 +0100

A technical breakdown of CVE-2025-64712, a CVSS 9.8 critical path traversal remote code execution vulnerability in the Unstructured Python library (< 0.18.18). Unsanitized attachment filenames in Outlook MSG processing allow for path traversal, enabling an attacker to overwrite arbitrary files via a crafted MSG file and achieve code execution.

CVE-2026-1357: Unauthenticated RCE in WPvivid Backup Plugin

Mohammed Lachhab — Fri, 20 Feb 2026 08:00:00 +0100

A technical breakdown of CVE-2026-1357, a CVSS 9.8 critical unauthenticated remote code execution vulnerability in the WPvivid Backup & Migration plugin (≤ 0.9.123). Two chained flaws, a cryptographic fail-open and an unsanitized path traversal, allow arbitrary file write and shell upload without credentials.

9 Open-Source AI Pentesting Tools Compared (2026)

Youssef Mabrouk — Fri, 30 Jan 2026 08:20:00 +0100

PentestGPT, PentAGI, HexStrike AI, Strix, CAI, Nebula, NeuroSploit, Deadend CLI and RedAmon compared: key features of each AI pentest agent, GitHub stars and licenses.

Ostorlab 2025 Year in Review

Manal Samir — Wed, 28 Jan 2026 16:20:00 +0100

2025 marked the turning point where AI in cybersecurity graduated from experimental prototypes to production-grade engines. In this retrospective, we explore how Ostorlab’s new AI Pentest Engine and AI Monkey Tester are already uncovering critical vulnerabilities in the wild, including a complex arbitrary file read chain in Signal for Android. From mapping global banking risks to orchestrating scans with OXO Titan, dive into the year we redefined what automated security testing can actually do.

Android Developer Verification 2026: Who Needs It

Youssef Mabrouk — Tue, 27 Jan 2026 10:47:00 +0100

From 2026, certified Android devices can block apps from unverified developers. What changes for sideloading, who is affected, and how Google is responding.

That Time a Zero (could have) Broke the Internet's Plumbing (CVE-2026-0915)

Ostorlab Team — Wed, 21 Jan 2026 16:20:00 +0100

An AI-assisted analysis uncovered a 30-year-old uninitialized buffer vulnerability in glibc's _nss_dns_getnetbyaddr_r function. This case study details how a zero-input edge case bypasses loop logic, causing the library to transmit raw stack memory to external DNS servers, and benchmarks how various AI models succeeded in identifying this subtle logic error where human review failed.

Android WebView addJavascriptInterface Risks

Mohamed Nasser — Wed, 07 Jan 2026 00:00:00 +0100

Case study: Ostorlab's AI pentest engine finds an Android WebView JavaScript bridge reachable via deep links and chains it into native UI manipulation.

Best Mobile App Security Testing Platforms 2026

Bilal Harras — Mon, 05 Jan 2026 16:20:00 +0100

Compare Ostorlab, NowSecure, Appknox, Data Theorem, Quokka, Zimperium and MobSF for Android and iOS, with a feature matrix and vendor proof-of-value questions.

Android FLAG_SECURE: Block Screenshots and Recording

Bilal Harras — Mon, 29 Dec 2025 16:20:00 +0100

How Android's FLAG_SECURE blocks screenshots, screen recording and recent-apps previews, with code samples, use cases, limitations and casting behavior.