Eresus Security Research Feed

Eresus Security Research Feed https://www.eresussec.com Research, advisories, and offensive security writing from Eresus Security. en-us Thu, 08 Oct 2026 16:30:23 GMT <![CDATA[File Upload Security: Testing the Pipeline End to End]]> https://www.eresussec.com/en/blog/secure-file-upload-pipeline-security https://www.eresussec.com/en/blog/secure-file-upload-pipeline-security Thu, 08 Oct 2026 00:00:00 GMT <![CDATA[SAML SSO Security Testing: Assertions, Signatures, and Tenant Mapping]]> https://www.eresussec.com/en/blog/saml-sso-security-testing https://www.eresussec.com/en/blog/saml-sso-security-testing Thu, 08 Oct 2026 00:00:00 GMT <![CDATA[Password Reset and Account Recovery Security Testing]]> https://www.eresussec.com/en/blog/password-reset-account-recovery-security https://www.eresussec.com/en/blog/password-reset-account-recovery-security Thu, 08 Oct 2026 00:00:00 GMT <![CDATA[GraphQL API Security Testing: Resolver Access, Batching, and Cost]]> https://www.eresussec.com/en/blog/graphql-api-security-assessment https://www.eresussec.com/en/blog/graphql-api-security-assessment Thu, 08 Oct 2026 00:00:00 GMT <![CDATA[DAST Findings Need More Than a Severity Score: HTTP Evidence and OAST Callbacks]]> https://www.eresussec.com/en/blog/dast-http-evidence-oast-callbacks https://www.eresussec.com/en/blog/dast-http-evidence-oast-callbacks Thu, 08 Oct 2026 00:00:00 GMT <![CDATA[Authenticated DAST Testing: Scope, Test Accounts, and Safe Scan Boundaries]]> https://www.eresussec.com/en/blog/authorized-dast-scope-authentication https://www.eresussec.com/en/blog/authorized-dast-scope-authentication Thu, 08 Oct 2026 00:00:00 GMT <![CDATA[From AppSec Finding to Verified Fix: A Remediation and Retest Workflow]]> https://www.eresussec.com/en/blog/appsec-findings-retest-remediation-loop https://www.eresussec.com/en/blog/appsec-findings-retest-remediation-loop Thu, 08 Oct 2026 00:00:00 GMT <![CDATA[Agentic SAST Without Guesswork: File-Level Evidence, Validation, and Trace]]> https://www.eresussec.com/en/blog/agentic-sast-validation-line-evidence https://www.eresussec.com/en/blog/agentic-sast-validation-line-evidence Thu, 08 Oct 2026 00:00:00 GMT <![CDATA[Webhook Security Testing: Signatures, Replay, and Delivery]]> https://www.eresussec.com/en/blog/webhook-security-testing-signatures-replay https://www.eresussec.com/en/blog/webhook-security-testing-signatures-replay Wed, 07 Oct 2026 00:00:00 GMT <![CDATA[RAG Authorization and Tenant Isolation Testing]]> https://www.eresussec.com/en/blog/rag-authorization-tenant-isolation-testing https://www.eresussec.com/en/blog/rag-authorization-tenant-isolation-testing Wed, 07 Oct 2026 00:00:00 GMT <![CDATA[OAuth and OIDC Security Testing for SaaS]]> https://www.eresussec.com/en/blog/oauth-oidc-security-testing-saas https://www.eresussec.com/en/blog/oauth-oidc-security-testing-saas Wed, 07 Oct 2026 00:00:00 GMT <![CDATA[Mobile App Security: Tokens, Deep Links, and API Trust]]> https://www.eresussec.com/en/blog/mobile-app-api-security-token-deep-links https://www.eresussec.com/en/blog/mobile-app-api-security-token-deep-links Wed, 07 Oct 2026 00:00:00 GMT <![CDATA[AI Penetration Testing: How to Validate an Agent's Findings]]> https://www.eresussec.com/en/blog/ai-penetration-testing-evidence https://www.eresussec.com/en/blog/ai-penetration-testing-evidence Wed, 07 Oct 2026 00:00:00 GMT <![CDATA[AI Agent Identity Security: Trace the Path Behind Every Tool Call]]> https://www.eresussec.com/en/blog/ai-agent-identity-attack-paths https://www.eresussec.com/en/blog/ai-agent-identity-attack-paths Wed, 07 Oct 2026 00:00:00 GMT <![CDATA[CI/CD Build Script Security: postinstall and build.rs Risks]]> https://www.eresussec.com/en/blog/ci-cd-build-script-security-guide https://www.eresussec.com/en/blog/ci-cd-build-script-security-guide Wed, 26 Aug 2026 00:00:00 GMT <![CDATA[ArrayRef Supply-Chain Attack: The proc-macro1 Backdoor in Rust]]> https://www.eresussec.com/en/blog/arrayref-rust-supply-chain-attack-proc-macro1 https://www.eresussec.com/en/blog/arrayref-rust-supply-chain-attack-proc-macro1 Wed, 26 Aug 2026 00:00:00 GMT <![CDATA[Penetration Testing Under Turkish KVKK: Technical Measures, Board Decisions, and Evidentiary Value]]> https://www.eresussec.com/en/blog/kvkk-gdpr-turkey-pentest-technical-measures-guide https://www.eresussec.com/en/blog/kvkk-gdpr-turkey-pentest-technical-measures-guide Tue, 25 Aug 2026 00:00:00 GMT <![CDATA[NIS2 Compliance and Penetration Testing: Article 21, the 24-Hour Clock, and €10M Fine Risk]]> https://www.eresussec.com/en/blog/nis2-compliance-pentest-requirements https://www.eresussec.com/en/blog/nis2-compliance-pentest-requirements Mon, 24 Aug 2026 00:00:00 GMT <![CDATA[Case Study: Lateral Movement Chain in a Kubernetes Security Review]]> https://www.eresussec.com/en/blog/case-study-kubernetes-cloud-review-lateral-movement https://www.eresussec.com/en/blog/case-study-kubernetes-cloud-review-lateral-movement Mon, 24 Aug 2026 00:00:00 GMT <![CDATA[DORA and Penetration Testing: Digital Operational Resilience Testing for Financial Entities]]> https://www.eresussec.com/en/blog/dora-financial-sector-digital-operational-resilience-testing https://www.eresussec.com/en/blog/dora-financial-sector-digital-operational-resilience-testing Sun, 23 Aug 2026 00:00:00 GMT