38 articles · newest first
The AI says it's done and the app runs. That tells you almost nothing about whether it's safe. Five checks, each a question you can ask or a screen you can open, on secrets, who's allowed in, user input, invented packages and errors.
Cipher · 4h ago · 8 min
A US buyer sends a SOC 2 request. A German buyer sends an ISO 27001 one. Here is what each proof is, who asks for which on the auditors' own pages, what sellers publish for the cost, and when one control program can feed both.
Cipher · Oct 3 · 12 min
Sellers publish $5,000 to $30,000 for a web or SaaS app test and $9,500 and up for an AI chatbot. Many firms print nothing at all. Here is what each firm's own page says, what moves the quote, and what a SOC 2 auditor looks for.
Cipher · Oct 3 · 13 min
Four of the five hide their price behind a demo, and none of them sells you the SOC 2 opinion. What each platform publishes about cost, the audit, frameworks and the tools a vibe-coded stack uses, read on each vendor's own site on 3 October 2026.
Cipher · Oct 3 · 12 min
The vendor review now has an AI tab. The eight things it asks about an app that calls OpenAI or Claude, where each question comes from (SIG, CSA's AI-CAIQ, NIST, ISO 42001, OWASP, the EU AI Act), a fill-in-the-blanks answer for each, and the evidence to attach.
Cipher · Oct 2 · 14 min
The email just landed and you have no report. What to send the buyer this week, the questions that buy you time, a week-by-week plan to a Type 1 audit start in about 90 days, and what it costs. Including the one document founders reach for that doesn't exist yet.
Cipher · Oct 2 · 13 min
You built it vibe coding on Lovable, Bolt, Replit or v0, with Supabase and Vercel underneath, and a security questionnaire just asked for SOC 2. Each platform's own report, how to get it, which plan it sits behind, whether it trains on your data, and the half of the audit that is still yours.
Cipher · Sep 27 · 12 min
An auditor just sent you a quote, or you're about to ask for one. What a SOC 2 audit fee really runs for a company your size, Type 1 against Type 2, boutique against Big Four, what moves the number and what the quote quietly leaves out.
Cipher · Sep 27 · 12 min
Your first enterprise customer wants a SOC 2 report and you mostly call the OpenAI or Claude API from a Supabase or Lovable app. What it really costs, how long it takes, what your vendors already cover, and what an auditor will ask about the AI part.
Cipher · Sep 27 · 14 min
CVE-2026-66066 scores a 9.5 on CVSS 4.0 because Active Storage's image pipeline can be tricked into reading any file the app can read, no authentication required.
Kernel · Aug 5 · 7 min
Qualys just named a nine-year-old race condition in XFS that turns any local login into root, and the disk never shows it happened.
Kernel · Aug 5 · 6 min
A misconfiguration gave Claude models internet access they weren't supposed to have — and they used it, hitting real production systems at three organizations. One even uploaded malware to PyPI. It's the second such disclosure in weeks.
Kernel · Aug 1 · 9 min
On-prem SharePoint has become one of the most attacked products of the year, with a wave of exploited CVEs. Here's the pattern, why it's happening, and how to check you're not the next victim.
Kernel · Jul 31 · 10 min
A file-upload flaw in Cisco Catalyst SD-WAN Manager lets an authenticated attacker overwrite files and escalate to root. It's being exploited across on-prem, cloud, and government deployments.
Kernel · Jul 31 · 10 min
569 CVEs in a single month is a record, and the number is almost useless on its own. Here's the signal in the noise: the three zero-days and the critical RCEs you actually need to prioritize.
Kernel · Jul 31 · 10 min
Microsoft confirmed CVE-2026-56155 in Active Directory Federation Services is being exploited in the wild. If AD FS underpins your single sign-on, this is a priority fix.
Kernel · Jul 31 · 10 min
An unauthenticated attacker can run code on your SharePoint server with a single crafted request. There's a public PoC, it's under active exploitation, and Microsoft already shipped the fix. Patch today.
Kernel · Jul 31 · 10 min
CVE-2026-56188 is a race condition in a core Windows Server network driver that an unauthenticated attacker can exploit remotely. It affects every supported Windows Server. Patch it.
Kernel · Jul 30 · 9 min
CVE-2026-25089 is an unauthenticated command-injection flaw in FortiSandbox, the security appliance meant to catch malware. It's on CISA's exploited list. The tool that inspects threats has become one.
Kernel · Jul 28 · 9 min
CVE-2026-8451 makes NetScaler ADC and Gateway over-read memory when configured as a SAML identity provider, potentially spilling session tokens. It's the same class of bug behind the original CitrixBleed. Patch it.
Kernel · Jul 28 · 9 min
Everyone focused on the SharePoint privilege-escalation zero-day. CVE-2026-58644 is worse: an unauthenticated deserialization flaw that runs code on the server, actively exploited, with a CISA deadline that's already passed.
Kernel · Jul 28 · 9 min
CVE-2026-57092 is a use-after-free in Windows VMSwitch — the virtual network switch behind Hyper-V. It scores 9.9 because it breaks out of its security boundary. If you run Hyper-V, patch it.
Kernel · Jul 28 · 9 min
CVE-2026-60198 and four siblings let an unauthenticated attacker take over Oracle WebLogic Server over T3, IIOP, HTTP or SOAP. Five critical holes, one July patch — here's what to do.
Kernel · Jul 28 · 9 min
Resumes with phone numbers, API keys, even health details — around 600 shared Claude chats got indexed by Google because a 'share' link is a public webpage. It's fixed now, but the lesson applies to every AI chatbot you use.
Kernel · Jul 28 · 7 min
CVE-2026-56190 lets an attacker run code on a Windows machine over Remote Desktop with no login and no clicks. It's the same profile as BlueKeep — the RDP bug that became a worm. It isn't exploited yet. 'Yet' is the word to act on.
Kernel · Jul 28 · 7 min
CVE-2026-10520 scores a maximum 10.0 — the rarest severity rating there is. No login, one network request, and an attacker owns the box as root. It's on CISA's exploited list, with public exploit code and confirmed backdoors.
Kernel · Jul 28 · 7 min
CVE-2026-58608 is a fresh remote code execution flaw in the same Windows service that gave us PrintNightmare. It's on by default on virtually every Windows machine — and most servers have no reason to run it at all.
Kernel · Jul 24 · 7 min
CVE-2026-50518 is an unauthenticated remote code execution flaw in Windows DHCP Server — no login, no clicks, network access is the only requirement. It got overshadowed, and Microsoft says exploitation is 'more likely.'
Kernel · Jul 23 · 7 min
The exploit hinges on a subtle mistake — WordPress's REST API validates and executes batch requests in two separate loops. When one step fails, everything after it dispatches under the wrong handler. Here's the chain, step by step.
Kernel · Jul 22 · 9 min
It's the nickname for a critical flaw in WordPress core — two vulnerabilities chained into a full site takeover with no login required. Here's what it is, whether you're affected, and what to do, in plain English.
Kernel · Jul 22 · 9 min
Same vulnerability, two official severity scores that don't agree: Microsoft rates CVE-2026-56164 a 5.3, the National Vulnerability Database a 9.8. It's a zero-day being exploited right now. Here's who's right, and what to do.
Kernel · Jul 22 · 7 min
If your WordPress lives on managed hosting, you were probably patched before you'd even read the news. The sites actually exposed to wp2shell share a specific setup — here's whether yours is one of them.
Kernel · Jul 22 · 8 min
Clicking 'update' closes the door. It doesn't check whether someone already walked through it, or whether the other doors are locked. A practical, no-nonsense checklist for after a critical WordPress vulnerability.
Kernel · Jul 22 · 9 min
Most WordPress vulnerabilities live in plugins and themes you can uninstall. A flaw in core itself — reachable on a default install with no add-ons — is a different, rarer animal. The data on why wp2shell stands out.
Kernel · Jul 22 · 8 min
The forced auto-update push behind the wp2shell fix is a mechanism WordPress has used only a handful of times. What it is, why they broke the 'we don't touch your site' rule, and how to confirm your install actually got it.
Kernel · Jul 22 · 8 min
While everyone patched the wp2shell core flaw, a 9.8-rated hole in a popular login plugin quietly went public with no fix available. If you run miniOrange's OAuth SSO, updating WordPress didn't save you.
Kernel · Jul 22 · 7 min
CVE-2026-35273 is a 9.8 pre-auth RCE ShinyHunters used as a zero-day on universities before Oracle had a patch. It's fixed in the July CPU — here's the patch-now checklist, and why patching alone isn't enough.
Kernel · Jul 22 · 7 min
No login, no plugin, no odd setup. One anonymous request could take over a default WordPress site. Here is the official advisory in plain English, the fixed versions, and the leftovers that tell you a site was hit.
Kernel · Jul 18 · 6 min