PentesterLab: Penetration Testing & Web App Security Blog

Weekly Research

Research Worth Reading - Week 23, 2026

🔐 Let’s talk about encrypted reasoning • 👏 Golang code review notes II • 🤖 The sorry state of skill distribution

CVE in Your CVE: When the Patch Doesn't Fix the Vulnerability

A big part of what I do for PentesterLab is reading CVEs. I spend a lot of time going through them: ...

Weekly Research

Research Worth Reading - Week 21, 2026

⚒️ evilsocket / audit • 🤖 Autonomous fuzzing process under LLM supervision • 💰 StubZero: $148,337 RCE in Google Cloud Production

Weekly Research

Research Worth Reading - Week 20, 2026

🐚 The React2Shell Story and What Happened Next.js • 🏛️ Mythos finds a curl vulnerability • 🤖 Claude Code RCE: Exploiting Deeplink Handlers via Settings Injection

Weekly Research

Research Worth Reading - Week 18, 2026

🤖 AI threats in the wild: The current state of prompt injections on the web • 🪟 Persistence Atlas: 19 Techniques Nobody Talks About • 😳 Securing GitHub: Wiz Research uncovers RCE in GitHub.com

Weekly Research

Research Worth Reading - Week 17, 2026

📆 The zero-days are numbered • 🔁 High-Quality Chaos • 🪡 Needle in the haystack: LLMs for vulnerability research

Vibe Before You Buy!

Back when I worked in appsec, I wrote the same tool twice for two different companies. Both times it was a ...

Weekly Research

Research Worth Reading - Week 16, 2026

🤖 Lessons Learned From RITSEC CTF • 😼 Fail Open, Game Over: Turning a One-Line Tomcat Fix into Unauthenticated RCE • 🤖 I Let Claude Opus Write a Chrome Exploit

Weekly Research

Research Worth Reading - Week 15, 2026

👾 GDDRHammer and GeForge: GPU Rowhammer Now Achieves Full System Compromise • 🤖 Assessing Claude Mythos Preview’s cybersecurity capabilities

Weekly Research

Research Worth Reading - Week 14, 2026

✨ ImageMagick: From Arbitrary File Read to File Write In Every Policy • 🧑🏻‍💻 Leveling Up Secure Code Reviews with Claude Code • 🤖 Vulnerability Research Is Cooked

Defenders Finally Have the Edge

Everyone is panicking about AI-generated zero days. They should be paying attention to the other side of the equation. Anthropic recently ...

Weekly Research

Research Worth Reading - Week 13, 2026

☁️ Remote Command Execution in Google Cloud with Single Directory Deletion