Eresus Security Research Feed https://www.eresussec.com Research, advisories, and offensive security writing from Eresus Security. en-us Wed, 07 Oct 2026 16:22:59 GMT <![CDATA[Webhook Security Testing: Signatures, Replay, and Delivery]]> https://www.eresussec.com/en/blog/webhook-security-testing-signatures-replay https://www.eresussec.com/en/blog/webhook-security-testing-signatures-replay Wed, 07 Oct 2026 00:00:00 GMT <![CDATA[RAG Authorization and Tenant Isolation Testing]]> https://www.eresussec.com/en/blog/rag-authorization-tenant-isolation-testing https://www.eresussec.com/en/blog/rag-authorization-tenant-isolation-testing Wed, 07 Oct 2026 00:00:00 GMT <![CDATA[OAuth and OIDC Security Testing for SaaS]]> https://www.eresussec.com/en/blog/oauth-oidc-security-testing-saas https://www.eresussec.com/en/blog/oauth-oidc-security-testing-saas Wed, 07 Oct 2026 00:00:00 GMT <![CDATA[Mobile App Security: Tokens, Deep Links, and API Trust]]> https://www.eresussec.com/en/blog/mobile-app-api-security-token-deep-links https://www.eresussec.com/en/blog/mobile-app-api-security-token-deep-links Wed, 07 Oct 2026 00:00:00 GMT <![CDATA[AI Penetration Testing: How to Validate an Agent's Findings]]> https://www.eresussec.com/en/blog/ai-penetration-testing-evidence https://www.eresussec.com/en/blog/ai-penetration-testing-evidence Wed, 07 Oct 2026 00:00:00 GMT <![CDATA[AI Agent Identity Security: Trace the Path Behind Every Tool Call]]> https://www.eresussec.com/en/blog/ai-agent-identity-attack-paths https://www.eresussec.com/en/blog/ai-agent-identity-attack-paths Wed, 07 Oct 2026 00:00:00 GMT <![CDATA[CI/CD Build Script Security: postinstall and build.rs Risks]]> https://www.eresussec.com/en/blog/ci-cd-build-script-security-guide https://www.eresussec.com/en/blog/ci-cd-build-script-security-guide Wed, 26 Aug 2026 00:00:00 GMT <![CDATA[ArrayRef Supply-Chain Attack: The proc-macro1 Backdoor in Rust]]> https://www.eresussec.com/en/blog/arrayref-rust-supply-chain-attack-proc-macro1 https://www.eresussec.com/en/blog/arrayref-rust-supply-chain-attack-proc-macro1 Wed, 26 Aug 2026 00:00:00 GMT <![CDATA[Penetration Testing Under Turkish KVKK: Technical Measures, Board Decisions, and Evidentiary Value]]> https://www.eresussec.com/en/blog/kvkk-gdpr-turkey-pentest-technical-measures-guide https://www.eresussec.com/en/blog/kvkk-gdpr-turkey-pentest-technical-measures-guide Tue, 25 Aug 2026 00:00:00 GMT <![CDATA[NIS2 Compliance and Penetration Testing: Article 21, the 24-Hour Clock, and €10M Fine Risk]]> https://www.eresussec.com/en/blog/nis2-compliance-pentest-requirements https://www.eresussec.com/en/blog/nis2-compliance-pentest-requirements Mon, 24 Aug 2026 00:00:00 GMT <![CDATA[Case Study: Lateral Movement Chain in a Kubernetes Security Review]]> https://www.eresussec.com/en/blog/case-study-kubernetes-cloud-review-lateral-movement https://www.eresussec.com/en/blog/case-study-kubernetes-cloud-review-lateral-movement Mon, 24 Aug 2026 00:00:00 GMT <![CDATA[DORA and Penetration Testing: Digital Operational Resilience Testing for Financial Entities]]> https://www.eresussec.com/en/blog/dora-financial-sector-digital-operational-resilience-testing https://www.eresussec.com/en/blog/dora-financial-sector-digital-operational-resilience-testing Sun, 23 Aug 2026 00:00:00 GMT <![CDATA[PCI DSS 4.0.1 Penetration Testing: Requirement 11.4, Segmentation Testing, and the 2025 Changes]]> https://www.eresussec.com/en/blog/pci-dss-4-penetration-testing-requirements https://www.eresussec.com/en/blog/pci-dss-4-penetration-testing-requirements Sat, 22 Aug 2026 00:00:00 GMT <![CDATA[Case Study: AI Agent & MCP Red Team — The Prompt-to-Action Open Door]]> https://www.eresussec.com/en/blog/case-study-ai-agent-mcp-red-team-prompt-to-action https://www.eresussec.com/en/blog/case-study-ai-agent-mcp-red-team-prompt-to-action Sat, 22 Aug 2026 00:00:00 GMT <![CDATA[Case Study: Chaining BOLA and IDOR in a Fintech API Pentest]]> https://www.eresussec.com/en/blog/case-study-fintech-api-pentest-bola-idor-chain https://www.eresussec.com/en/blog/case-study-fintech-api-pentest-bola-idor-chain Fri, 21 Aug 2026 00:00:00 GMT <![CDATA[wp2shell: Unauthenticated WordPress Core RCE via REST API Batch-Route Confusion (CVE-2026-63030 + CVE-2026-60137)]]> https://www.eresussec.com/en/blog/wp2shell-wordpress-core-rce-cve-2026-63030 https://www.eresussec.com/en/blog/wp2shell-wordpress-core-rce-cve-2026-63030 Mon, 20 Jul 2026 00:00:00 GMT <![CDATA[RFC 10008's New HTTP QUERY Method Is a Blind Spot for Every WAF Written Before June 2026]]> https://www.eresussec.com/en/blog/rfc-10008-http-query-method-waf-bypass https://www.eresussec.com/en/blog/rfc-10008-http-query-method-waf-bypass Mon, 20 Jul 2026 00:00:00 GMT <![CDATA[CVE-2026-58420: Understanding Gitea Migration Restore Local File Inclusion]]> https://www.eresussec.com/en/blog/gitea-cve-2026-58420-local-file-inclusion-en https://www.eresussec.com/en/blog/gitea-cve-2026-58420-local-file-inclusion-en Tue, 14 Jul 2026 00:00:00 GMT <![CDATA[FreeBSD TIOCSTI: Terminal Input Injection and Local Privilege Risk]]> https://www.eresussec.com/en/blog/freebsd-tiocsti-terminal-input-injection-disclosure https://www.eresussec.com/en/blog/freebsd-tiocsti-terminal-input-injection-disclosure Tue, 14 Jul 2026 00:00:00 GMT <![CDATA[Evidence-First Application Security: Turning Findings into Verifiable Decisions with Eresus Guard]]> https://www.eresussec.com/en/blog/evidence-first-application-security-eresus-guard https://www.eresussec.com/en/blog/evidence-first-application-security-eresus-guard Tue, 14 Jul 2026 00:00:00 GMT