Blog
Ostorlab Blog
Vulnerability research, CVE deep dives and engineering write-ups from the Ostorlab team on AI pentesting and mobile, web and API security testing.
Exploit CVE-2026-42208: LiteLLM Unauthenticated SQL Injection via Bearer Token
A technical breakdown of CVE-2026-42208, a CVSS 9.3 critical unauthenticated SQL Injection vulnerability in the LiteLLM Proxy API. Improper parameterization of the Bearer token within raw SQL queries used for complex multi-table joins allows blind boolean-based timing attacks, enabling unauthenticated attackers to exfiltrate sensitive data including virtual API keys, user information, and LLM spend logs directly from the database.
May 22, 2026
DirtyFrag: Universal Linux Local Privilege Escalation via Page-Cache Write
A technical breakdown of DirtyFrag, a pair of Linux kernel local privilege escalation vulnerabili...
May 13, 2026
CVE-2026-44109: OpenClaw Feishu Auth Bypass to RCE
A technical breakdown of CVE-2026-44109, a CVSS 9.2 Critical authentication bypass vulnerability ...
May 07, 2026
CVE-2026-5205: Critical SSRF in Chatwoot Uploads
A deep dive into a critical Server-Side Request Forgery (SSRF) vulnerability in Chatwoot's upload...
Apr 29, 2026
Read by Topic
Latest from Engineering, Product & SecurityThe True Cost of False Positives: Calculating the Engineering Tax of Noisy Scanners
False positives are an engineering-capacity problem, not only a scanner-quality problem. Learn how to measu...
Sep 28, 2026
When Does an AI Scanner Become an AI Pentest?
Learn what separates AI-powered scanning from AI pentesting and how Ostorlab Deep Agentic Scan follows evid...
Jul 22, 2026
Source Code Security: From Signal to Validated Risk | Ostorlab
Learn how source code security testing works, why traditional SAST creates false positives, and how agentic...
Jul 16, 2026
Who Should Use Ostorlab? Best-Fit Teams, Use Cases, and When to Choose Something Else
Ostorlab fits teams testing connected mobile, web, API, and code assets on every release. Where it fits, wh...
Sep 28, 2026
How Deep Agentic Scan Catches Tricky Real-World Vulnerabilities
How Ostorlab's Deep Agentic Scan uncovers and empirically proves complex vulnerabilities across web, mobile...
Sep 23, 2026
Best On-Premises AppSec Testing Platforms (2026)
Compare Ostorlab, Invicti, Burp Suite DAST, HCL AppScan and Fortify for on-premises AppSec testing: deploym...
Sep 15, 2026
Ostorlab vs. Pentesting Firms: 2026 Cost & Depth Comparison
Ostorlab vs. pentesting firms: cost, testing frequency, depth and remediation, and when to use AI pentests,...
Sep 25, 2026
Why API Security Testing Misses Cross-Asset Attack Chains
API-only scanners miss attack chains that start with secrets or routes in mobile apps, web bundles, or code...
Sep 25, 2026
AI Pentesting for SOC 2: 6 Providers Compared
Compare Ostorlab, XBOW, Aikido, Intruder, Escape and Penti for SOC 2 pentests on exploit evidence, human re...
Sep 25, 2026
Changelog
View all changesThe Breach Brief Newsletter
Weekly offensive AI and cybersecurity breakdowns curated by Ostorlab.
Would You Like a PoC With That?
Sep 23, 2026
Agents Bake. Who Tastes?
Sep 16, 2026
Too Spicy For The Menu
Sep 09, 2026
Who Gets the Prime Cut?
Sep 03, 2026