October 2026 Data Breaches and Lessons Learned
Chainalysis, ConnectWise, Oracle Health and 3 more US breaches from October 2026. What happened, what was exposed and what your team should test next.
.jpg/)
Top 7 CVEs of October 2026: What Attackers Used and What to Fix First
PHP2Shell, HTTP2Shell, Ivanti, BeyondTrust and three more October 2026 CVEs are under attack. See what each one does and how to patch it today.
Security Insights
Deep dives, expert analysis, and practical guidance on exposure management, adversarial validation, and the future of AI-driven exposure management.
Running DeepSeek V4.1 Flash in production: serving, KV caching and autoscaling on AWS
A technical guide to self-hosting DeepSeek V4.1 Flash for long-context agent workloads: vLLM configuration, a latency model for sizing, tiered and shared KV cache in S3, prefix-aware routing, autoscaling and unit costs.
We Checked 286 Indian Companies. 4 in 5 Are One Bug Away From a Breach
We checked 286 Indian companies without logging in. 67% had exposed API keys or secrets in their JavaScript, and 81% had a serious flaw anyone could reach.
Best AI pentesting platforms for SOC 2 and PCI DSS compliance
Seven AI pentesting platforms compared on what SOC 2 and PCI DSS v4.0.1 actually ask for: scope, who tests, retests, and proof of what ran and what didn't.
Run pentests from Claude Code with the Strobes MCP servers
Run agentic pentests, validate findings, and re-test fixes from Claude Code or any MCP app with the open-source Strobes MCP servers.
HTTP2Shell (CVE-2026-111497): The Brotli RCE Hitting Node.js, Python and More
HTTP2Shell (CVE-2026-111497), first called Node2Shell, is a Brotli decoder flaw that can lead to remote code execution in Node.js, Python, Bun and any app that decodes untrusted br content. Affected versions, exposure paths, checks and fixes.
Introducing Red Loop: continuous, proven testing of your whole attack surface
Red Loop brings continuous offensive testing to Strobes Attack Surface Management. It discovers what you own, scans it the same way every time, and sends results to AI agents that attack and validate them. Only proven findings reach your queue.
PHP2Shell (CVE-2026-109618 & CVE-2026-109619): Leaked PHP Flaws and What to Do Now
PHP2Shell: two leaked critical PHP RCE flaws, CVE-2026-109618 and CVE-2026-109619, rated CVSS 9.2. What's confirmed, which PHP versions get the fix, and what to do before and after the October 21 patch.
Your board won't ask if you're secure anymore. It will ask you to prove it.
Boards now ask for evidence that cyber risk is within appetite. What board-ready security evidence looks like, how to govern autonomous testing, and how to get it into your 2027 plan.
Why your annual penetration test is already obsolete
Your annual pentest describes an environment that no longer exists. Here is how continuous offensive security testing closes the gap, and what it takes to run one.
Biggest data breaches of September 2026
153 million driver's licenses claimed, 23.6 million Gyazo records confirmed. September 2026's biggest breaches, with every number sourced.