Eresus Security Research Feed https://www.eresussec.com Research, advisories, and offensive security writing from Eresus Security. en-us Tue, 25 Aug 2026 15:22:45 GMT <![CDATA[Penetration Testing Under Turkish KVKK: Technical Measures, Board Decisions, and Evidentiary Value]]> https://www.eresussec.com/en/blog/kvkk-gdpr-turkey-pentest-technical-measures-guide https://www.eresussec.com/en/blog/kvkk-gdpr-turkey-pentest-technical-measures-guide Tue, 25 Aug 2026 00:00:00 GMT <![CDATA[NIS2 Compliance and Penetration Testing: Article 21, the 24-Hour Clock, and €10M Fine Risk]]> https://www.eresussec.com/en/blog/nis2-compliance-pentest-requirements https://www.eresussec.com/en/blog/nis2-compliance-pentest-requirements Mon, 24 Aug 2026 00:00:00 GMT <![CDATA[Case Study: Lateral Movement Chain in a Kubernetes Security Review]]> https://www.eresussec.com/en/blog/case-study-kubernetes-cloud-review-lateral-movement https://www.eresussec.com/en/blog/case-study-kubernetes-cloud-review-lateral-movement Mon, 24 Aug 2026 00:00:00 GMT <![CDATA[DORA and Penetration Testing: Digital Operational Resilience Testing for Financial Entities]]> https://www.eresussec.com/en/blog/dora-financial-sector-digital-operational-resilience-testing https://www.eresussec.com/en/blog/dora-financial-sector-digital-operational-resilience-testing Sun, 23 Aug 2026 00:00:00 GMT <![CDATA[PCI DSS 4.0.1 Penetration Testing: Requirement 11.4, Segmentation Testing, and the 2025 Changes]]> https://www.eresussec.com/en/blog/pci-dss-4-penetration-testing-requirements https://www.eresussec.com/en/blog/pci-dss-4-penetration-testing-requirements Sat, 22 Aug 2026 00:00:00 GMT <![CDATA[Case Study: AI Agent & MCP Red Team — The Prompt-to-Action Open Door]]> https://www.eresussec.com/en/blog/case-study-ai-agent-mcp-red-team-prompt-to-action https://www.eresussec.com/en/blog/case-study-ai-agent-mcp-red-team-prompt-to-action Sat, 22 Aug 2026 00:00:00 GMT <![CDATA[Case Study: Chaining BOLA and IDOR in a Fintech API Pentest]]> https://www.eresussec.com/en/blog/case-study-fintech-api-pentest-bola-idor-chain https://www.eresussec.com/en/blog/case-study-fintech-api-pentest-bola-idor-chain Fri, 21 Aug 2026 00:00:00 GMT <![CDATA[wp2shell: Unauthenticated WordPress Core RCE via REST API Batch-Route Confusion (CVE-2026-63030 + CVE-2026-60137)]]> https://www.eresussec.com/en/blog/wp2shell-wordpress-core-rce-cve-2026-63030 https://www.eresussec.com/en/blog/wp2shell-wordpress-core-rce-cve-2026-63030 Mon, 20 Jul 2026 00:00:00 GMT <![CDATA[RFC 10008's New HTTP QUERY Method Is a Blind Spot for Every WAF Written Before June 2026]]> https://www.eresussec.com/en/blog/rfc-10008-http-query-method-waf-bypass https://www.eresussec.com/en/blog/rfc-10008-http-query-method-waf-bypass Mon, 20 Jul 2026 00:00:00 GMT <![CDATA[CVE-2026-58420: Understanding Gitea Migration Restore Local File Inclusion]]> https://www.eresussec.com/en/blog/gitea-cve-2026-58420-local-file-inclusion-en https://www.eresussec.com/en/blog/gitea-cve-2026-58420-local-file-inclusion-en Tue, 14 Jul 2026 00:00:00 GMT <![CDATA[FreeBSD TIOCSTI: Terminal Input Injection and Local Privilege Risk]]> https://www.eresussec.com/en/blog/freebsd-tiocsti-terminal-input-injection-disclosure https://www.eresussec.com/en/blog/freebsd-tiocsti-terminal-input-injection-disclosure Tue, 14 Jul 2026 00:00:00 GMT <![CDATA[Evidence-First Application Security: Turning Findings into Verifiable Decisions with Eresus Guard]]> https://www.eresussec.com/en/blog/evidence-first-application-security-eresus-guard https://www.eresussec.com/en/blog/evidence-first-application-security-eresus-guard Tue, 14 Jul 2026 00:00:00 GMT <![CDATA[Four Chrome Extensions, One Scheme: How a Roblox Extension Network Is Farming Its Users]]> https://www.eresussec.com/en/blog/roblox-extension-network-roearn-research https://www.eresussec.com/en/blog/roblox-extension-network-roearn-research Mon, 29 Jun 2026 00:00:00 GMT <![CDATA[Linux Kernel LPE 2026: Copy Fail, Dirty Frag, and Fragnesia Compared]]> https://www.eresussec.com/en/blog/linux-kernel-lpe-2026-copy-fail-dirty-frag-fragnesia https://www.eresussec.com/en/blog/linux-kernel-lpe-2026-copy-fail-dirty-frag-fragnesia Sun, 17 May 2026 00:00:00 GMT <![CDATA[JavaScript Obfuscation Reverse Engineering: A Practical Deobfuscation Playbook]]> https://www.eresussec.com/en/blog/javascript-obfuscation-reverse-engineering-deobfuscation https://www.eresussec.com/en/blog/javascript-obfuscation-reverse-engineering-deobfuscation Sun, 17 May 2026 00:00:00 GMT <![CDATA[Fragnesia CVE-2026-46300: Linux Kernel XFRM ESP-in-TCP Local Privilege Escalation]]> https://www.eresussec.com/en/blog/fragnesia-cve-2026-46300-linux-kernel-xfrm-esp-privilege-escalation https://www.eresussec.com/en/blog/fragnesia-cve-2026-46300-linux-kernel-xfrm-esp-privilege-escalation Sun, 17 May 2026 00:00:00 GMT <![CDATA[Dirty Frag CVE-2026-43284: Linux Kernel Local Privilege Escalation via ESP and RxRPC]]> https://www.eresussec.com/en/blog/dirty-frag-cve-2026-43284-linux-kernel-privilege-escalation https://www.eresussec.com/en/blog/dirty-frag-cve-2026-43284-linux-kernel-privilege-escalation Sun, 17 May 2026 00:00:00 GMT <![CDATA[AI Chatbot Web Application Pentesting: Attack Surface Beyond Prompt Injection]]> https://www.eresussec.com/en/blog/ai-chatbot-web-application-pentest-methodology https://www.eresussec.com/en/blog/ai-chatbot-web-application-pentest-methodology Sun, 17 May 2026 00:00:00 GMT <![CDATA[CVE-2026-7482: Ollama GGUF Heap Out-of-Bounds Read — Full Technical Analysis]]> https://www.eresussec.com/en/blog/ollama-cve-2026-7482-heap-oob-gguf-vulnerability https://www.eresussec.com/en/blog/ollama-cve-2026-7482-heap-oob-gguf-vulnerability Mon, 04 May 2026 00:00:00 GMT <![CDATA[CVE-2026-41940: Emergency Action Plan for cPanel & WHM Authentication Bypass]]> https://www.eresussec.com/en/blog/cpanel-whm-cve-2026-41940-authentication-bypass-action-plan https://www.eresussec.com/en/blog/cpanel-whm-cve-2026-41940-authentication-bypass-action-plan Fri, 01 May 2026 00:00:00 GMT