PHP2Shell took six days to go from a leaked CVE number to CISA’s exploited list. The fix shipped ten hours after the first exploit tooling was seen scanning. A week later, FireCompass research across 1,000,000+ assets found that 65 percent of organisations still had at least one exposed application, and that nearly half of those… Read More »PHP2Shell Was Not the First. The Next One Is Already in Someone’s Queue
API penetration testing that stops at scanning misses the flaws attackers actually exploit: broken authorization, forgotten endpoints, and chained attack paths. Here is what makes APIs exploitable, why traditional testing misses it, and how agentic AI pentesting finds and proves it. By FireCompass Security Team | Updated September 2026 | 10 min read #1 On… Read More »API Penetration Testing in 2026: Why Scanners Miss What Attackers Exploit
At Black Hat USA 2026 and DEF CON 34, one theme was ever-present in both the briefings and the hallway conversations alike: autonomous AI threat actors are actively executing multi-stage attacks. Under permissive evaluation conditions, AI agents have already demonstrated the ability to escape sandbox constraints, establish covert communication channels across third-party tools, and systemically… Read More »What Recent Autonomous Hacking Incidents Mean for Web App and API Security
Three vulnerability classes I’ve spent most of my career testing for turned up at Black Hat and DEF CON this year, wearing AI costumes. CSP bypass. SSRF. HTML injection race conditions. Every one of them was written off as solved; every one of them was reachable again. The clearest example was SearchLeak, disclosed by Varonis… Read More »Old Web Bugs, New Blast Radius: What Vegas 2026 Means for API Testing
The model is the reasoning component. Everything that makes a test real lives outside it. Every AI penetration testing pitch now leads with the model. Point the strongest frontier LLM at your application, the story goes, and pentest quality follows. Buyers have started evaluating vendors the same way: which model is behind the agent, and… Read More »Why an LLM Alone Cannot Run an AI Penetration Test