The Blind Spots of Agentic Pentesting and How to Close Them
Agentic pentesting is the sharpest edge of offensive security today, but it leaves critical gaps. Here's where those blind spots are and how to address them.
ToolsThreat Intelligence Feed
-
-
Three Teams Remotely Hack Pixel 10 at Pwn2Own Ireland 2026
Three research teams successfully exploited a fully patched Google Pixel 10 at Pwn2Own Ireland, winning a combined $562,500 in prizes.
Guides -
ARTEX AI Pentesting Tool Weaponized Against South Korean Financial Firms
An unknown threat actor used the open-source AI pentesting tool ARTEX to breach South Korean banks. A separate actor, SCARLET LOOP, was found automating account
Threats -
Low-Cost Android Phones Ship with Firmware-Embedded Residential Proxy Malware
A malware campaign called 'Midnight Mimosa' embeds malicious code in low-cost Android firmware, enabling ad fraud and residential proxy abuse across 150+ countr
VPN & Privacy -
Wazza Phishkit Uses Multi-Stage Routing to Target Banking and Government
The Wazza phishkit targets banking, manufacturing, and government sectors across the US, Europe, and Australia using a multi-stage routing chain to evade detect
Tools -
Fake AI Chatbot Ad Platform Uses BitB Attacks to Steal Credentials
A phishing platform impersonates AI chatbot ad products to steal credentials and MFA codes via browser-in-the-browser attacks targeting agency ad accounts.
Tools
Analysis & Guides
VPN & Privacy
Windows KB5124010 Update Crashes Games and Apps Using AC-3 Audio
Microsoft confirmed KB5124010 crashes apps using AC-3 audio decoding. Legacy games, media players, and productivity apps are most affected.
Threats
OpenAI Disrupts Coordinated AI Reasoning Extraction Campaign Linked to Moonshot AI
OpenAI disrupted a coordinated distillation campaign attempting to illicitly extract protected reasoning from its AI models, attributing core activity to Moonsh
Guides
Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix
Threat actors are weaponizing ChatGPT Custom GPTs to redirect victims to ClickFix lures that deploy a full-featured remote access trojan via DLL sideloading.
Tools
ShinyHunters Bypass WAFs to Exploit Critical Oracle PeopleSoft Flaw
UNC6240 is mass-exploiting CVE-2026-35273 in Oracle PeopleSoft by URL-encoding requests to bypass WAF rules, deploying web shells and backdoors across multiple
VPN & Privacy
Anthropic's AI Misuse Report: Key Findings on Claude Abuse
Anthropic published a detailed report on Claude misuse cases. Key findings cover credential theft, influence operations, surveillance, and weapons research.
Threats
Malicious Terraform Providers and Go Modules Linked to DPRK Campaign
DPRK-linked attackers are distributing Go-based malware via Terraform providers and Go modules, marking a novel supply chain distribution vector.
Threats
ShinyHunters Hacks Cl0p's Leak Site, Threatening Victims Further
ShinyHunters breached rival ransomware gang Cl0p and threatened to expose victim data. Organizations that paid Cl0p may now face renewed extortion risks.
VPN & Privacy
Claude Opus 5 Helped Researchers Breach OpenAI's Internal Code Repository
Hacktron researchers used Claude Opus 5 to chain two flaws and access OpenAI staff accounts and an internal GitHub repository within 72 hours.
Guides
Identity Visibility in IAM: Concepts, Challenges, and Key Tools
Identity visibility is foundational to modern security. This guide covers core concepts, cloud challenges, and leading platform capabilities.