Offensive
Security Blog

Industry

What Is an Agent Harness? How AI Security Tools Work

Nov 5, 2026

Two AI security tools can use the same model and produce very different results. The difference is the harness. This post explains what an agent harness is, how its execution loop works, and why design choices around context, verification, and scope matter for AI-powered penetration testing.

By Alan Buxbaum

Industry

AI Findings are Cheap to Find & Costly to Trust

Nov 3, 2026

AI can produce a plausible vulnerability report in seconds, but proving it is real still takes expert judgment. This post explores the economics of false positives, why they burden your most senior people, and why accountability stays human.

By Christie Terrill

Technical Research

A Journey into Claude's Sandbox

Oct 29, 2026

What started as a question about Claude’s sandbox turned into a connected investigation of container internals, process memory, and authorization tokens. Bishop Fox researcher Chris Davis documents what Claude revealed, what it handed over, and what that means for defense in depth.

By Chris Davis

Technical Research

Responder Guidance for PHP2Shell (CVE-2026-109618 and CVE-2026-109619)

Oct 27, 2026

On October 21, 2026, the PHP project disclosed two critical memory-corruption vulnerabilities that can allow unauthenticated remote code execution. Both are fixed in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Every PHP install serving web requests is in scope,

By Jon Williams, Threat Enablement & Analysis Team

Industry

The True Blast Radius of an AI Attack

Oct 22, 2026

Connecting AI to enterprise systems changes what organizations entrust software to do. An agent that can query internal databases or modify business records has operational authority, and the scope of that authority becomes a security decision.

By Bishop Fox Researchers

Industry

AI Security Scoping: Define What To Test In Your Deployment

Oct 15, 2026

Testing AI security without clear scoping produces superficial coverage and unaddressed risk. This post breaks down how to define boundaries, select the right assessment type, and align AI penetration testing, red teaming, and architecture reviews to the decisions that actually matter.

By Bishop Fox Researchers

Industry

Behind Closed Doors: How Physical Penetration Testing Secures Sensitive Conversations

Oct 14, 2026

Closing the door doesn’t make a room secure. Alethe Denis breaks down how physical penetration testing evaluates whether unauthorized people can reach sensitive spaces, interact with equipment, or leave something behind without anyone noticing or reporting it.

By Alethe Denis

Technical Research

Submit and Execute: Weaponizing Reflected XSS in Siemens Teamcenter's Login Redirect (CVE-2026-58113)

Oct 13, 2026

A crafted link, one page load, and no clicks required. Bishop Fox found a reflected XSS in Siemens Teamcenter’s login redirect that auto-submits its own form, turning attribute injection into zero-interaction code execution and a silent surrogate delegation change on the victim’s account.

By Enzo Alvarez

Industry

Why the AI Attack Surface Extends Your Stack

Oct 6, 2026

Integrating AI into enterprise applications creates risk across every layer of the stack, not just the model. This post maps the full AI attack surface, shows how a prompt injection can chain into credential theft and cross-tenant data exposure, and explains why isolated scanners miss most of it.

By Bishop Fox Researchers

Technical Research

One Port to Root: Weaponizing Check Point Management CVE-2026-93616

Oct 1, 2026

An unauthenticated attacker who can reach TCP 19009 on a Check Point management server can take it over completely. Bishop Fox reproduced the full root RCE chain on R81.10 and R82.10, breaks down all three vulnerabilities the patch actually closes, and shares a safe detection tool for defenders.

By Jon Williams, Threat Enablement & Analysis Team

Industry

Separating Signal from Slop: Triaging CVEs in the Age of AI Security Research

Sep 30, 2026

AI-assisted research is flooding the CVE pipeline with bugs that score critical but depend on configurations almost nobody runs. Bishop Fox tested four high-profile Nginx CVEs in the lab, measured real-world prevalence, and explains how to separate actual risk from well-marketed noise.

By Nate Robb, Threat Enablement & Analysis Team

Advisory

Zilliz / Attu | 2.6.5

Sep 29, 2026

Two vulnerabilities in Zilliz Attu 2.6.5 chain into something serious. Missing authentication lets anyone proxy requests unauthenticated, and a regex bypass defeats the private IP block. Bishop Fox turned both into full Kubernetes namespace takeover in a cloud deployment. Update to 3.0.0 now.

By Bishop Fox

Technical Research

Master Key Included: Detecting SolarWinds ARM CVE-2026-28326

Sep 25, 2026

A hardcoded authentication secret ships with every SolarWinds Access Rights Manager install, and reaching TCP 55555 is enough to hit a .NET deserialization sink. Bishop Fox confirmed SYSTEM-level code execution, breaks down the root cause, and shares a safe detection tool for defenders.

By Jon Williams, Threat Enablement & Analysis Team

Technical Research

Unified Code, Unified Risks: Uncovering Vulnerabilities in .NET MAUI Applications

Sep 24, 2026

.NET MAUI lets developers write once and ship to both platforms. From an attacker's perspective, that means reverse-engineer once and break everywhere. This post walks through extracting readable assemblies from MAUI apps and the high-impact vulnerability patterns that consistently appear.

By Carlos Yanez

Technical Research

From Fork to Framework: What Modifying Apollo Taught Us About Agent Invasion

Sep 18, 2026

Forking an existing C2 agent sounds faster than building from scratch. Bishop Fox learned otherwise. This post documents what happened when they forked Apollo, built a 16-pass obfuscation pipeline to defeat EDR detection, and spent months fighting an architecture never designed for it.

By Rob Antonucci

Technical Research

MikroTrick: Inside the RouterOS Takeover Chain

Sep 17, 2026

Attackers were exploiting MikroTik routers before fixes went public. Bishop Fox reproduced the full unauthenticated takeover chain, found persistence artifacts on real compromised devices, and breaks down what defenders need to investigate beyond patching to confirm they are actually clean.

By Emilio Gallegos

Technical Research

CVE-2026-82329: Unauthenticated Administrative Access in JFrog Artifactory via an Empty Cluster Join Key

Sep 11, 2026

A misconfigured cluster join key in JFrog Artifactory's default install lets unauthenticated attackers mint a permanent admin token in one request. Bishop Fox reproduced the full chain, confirmed in-the-wild exploitation, and shares a non-invasive detection check and remediation guidance.

By Nate Robb, Threat Enablement & Analysis Team

Technical Research

Mind the Config: Detecting and Weaponizing NetScaler CVE-2026-19490

Sep 10, 2026

A single unauthenticated request bypasses authentication on NetScaler Gateway and AAA virtual servers. Whether that means a dead-end session, a proxy into the internal network, or root on the appliance depends entirely on configuration. Bishop Fox maps every branch and shares a safe detection tool.

By Jon Williams, Threat Enablement & Analysis Team

Technical Research

Signature Optional - Analysis of CVE-2026-28323

Sep 3, 2026

SolarWinds Web Help Desk treated SAML signature verification as optional and skipped every other validation the spec requires. Bishop Fox confirmed the full exploit end to end: one forged POST request, no credentials, full session takeover. Here is the root cause, the fix, and how to detect it.

By Ronan Kervella, Threat Enablement & Analysis Team

Advisory

Traefik | Version Through 3.7.11

Aug 31, 2026

Traefik's request read timeout is enabled by default and documented without exception, but it has never applied to HTTP/3. Bishop Fox confirmed the gap across four years of releases, measured it against the backend, and reported it to the vendor, who shipped a fix within twelve days.

By Shad Malloy

Technical Research

A GUID is Not a Credential: Unauthenticated RCE in Veeam Service Provider Console

Aug 26, 2026

Two critical vulnerabilities in Veeam Service Provider Console chain into unauthenticated remote code execution on the management server sitting above every tenant's backups. Bishop Fox confirmed the full chain end to end, breaks down both root causes, and shares a safe detection tool and IOCs.

By Jon Williams, Ronan Kervella, Threat Enablement & Analysis Team

Technical Research

No Crash Required: Verifying the Citrix NetScaler SAML Patch for CVE-2026-8452

Aug 21, 2026

CVE-2026-8452 lets an unauthenticated attacker corrupt memory in Citrix NetScaler's SAML parser with a single request, potentially leading to remote code execution. Bishop Fox breaks down the patch, how to safely verify it across a fleet, and what exploitation actually looks like in the logs.

By Jon Williams, Threat Enablement & Analysis Team

Industry

CTEM 101: Moving From Spreadsheets to Continuous Risk Reduction

Aug 20, 2026

Traditional vulnerability management was built for a smaller, slower problem than most teams face today. This post breaks down CTEM, why it exists, how its five stages work, and what it actually takes to move from a reactive pile of findings to a continuous, prioritized risk reduction program.

By Ori Zigindere

Technical Research

Critical SQL Injection in Metabase via Password Reset: CVE-2026-72898

Aug 11, 2026

Immediate action is advised for all organizations running self-hosted Metabase. A critical, unauthenticated SQL injection vulnerability has been disclosed in Metabase's password reset functionality, and Metabase has confirmed active exploitation in the wild.

By Threat Enablement & Analysis Team