Skip to content 
SOC 2 Compliance: Complete Guide for SaaS Companies
If you sell software to businesses, you will likely hear one question sooner or later: Are you SOC 2 compliant? Many enterprise customers may require SOC 2 before they sign a contract. It helps them understand whether your company protects customer data with strong security practices. For a SaaS firm, SOC 2 is more than […]
PHP2Shell: Critical PHP Vulnerabilities Require Immediate Action
Two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, can allow unauthenticated remote code execution (RCE) and sensitive memory disclosure. Security teams should immediately identify exposed PHP deployments, apply the available security updates, and investigate potential exploitation. The vulnerabilities, collectively known as PHP2Shell, affect the PHP runtime itself—not just a specific application or plugin. […]
Preparing for SOC 2? Don’t Forget to Document How Your Company Uses AI
Artificial intelligence (AI) tools are becoming common in everyday business operations. Companies use them to write code, summarize documents, answer customer questions, and analyze information. While these tools can save time, they can also create security and privacy risks. If your company is preparing for SOC 2, documenting how you use AI should be part […]
This App’s Own Security Feature Was Helping Attackers Bypass It: Reflected XSS via CSP Nonce Injection
How a Single </script> Tag Broke an Entire Security Policy A classic </script> breakout in a JSON config block would normally be stopped cold by a properly enforced Content-Security-Policy. Here, the CSP’s own nonce-injection middleware handed the injected script a valid nonce turning a defense into an accomplice. What We Found The affected endpoints take […]
AI Security Risks Every Business Should Know in 2026
Artificial intelligence is changing how businesses work and the reliance we have on bots and agents to get done with daily workday tasks and planning for long term business goals as well. While these tools save time, they also introduce new security risks that many business owners fail to anticipate. In 2026, cybercriminals are using […]
Zero-Click Entra ID SSO Account Takeover via an Unverified Email Claim (nOAuth)
A multi-tenant “Sign in with Microsoft” button trusted the wrong field. Because Entra’s mail attribute isn’t verified and isn’t unique, anyone with a free Microsoft 365 developer tenant could mint a login for someone else’s account with no password, no 2FA, no click from the victim. The Azure/Entra SSO login flow POST /api/o365s/azure-auth resolved the […]
Non-Human Identity: Why AI Agents Are Outnumbering Your Workforce 45 to 1
Every AI agent an employee connects to Slack, Salesforce, or an internal database creates a new credential — an OAuth token, an API key, a service account. Almost none of them get added to a central identity inventory. Multiply that across a workforce experimenting with agents on its own initiative, and enterprises are accumulating a […]
SSO Meets Zero Trust: Rebuilding Federated Identity for a Never-Trust Enterprise
For twenty years, SSO sold organizations on a simple promise: authenticate once, and every connected application trusts that session. Zero Trust Architecture (ZTA) rejects the second half of that promise. A single login event is no longer treated as proof that every subsequent request is safe – it’s treated as one data point among many, […]
How to Identify Which SSL Pinning Mechanism an Android App Uses
One of the biggest challenges during Android application security testing is SSL/TLS certificate pinning. When an application implements certificate pinning, intercepting HTTPS traffic with a proxy such as Burp Suite becomes difficult because the application verifies the server’s identity instead of relying solely on the device’s trusted Certificate Authorities (CAs). Many penetration testers immediately start […]
Exposed dead.letter Files: A Hidden Information Disclosure Risk
A leftover mail-system artifact was sitting in a public web directory on transfer.scip.ch potentially holding the contents of undelivered messages for anyone who knew where to look. What is a dead.letter File? A dead.letter file is automatically created by Unix/Linux mail utilities such as mail, mailx, or sendmail whenever an email cannot be delivered or […]