Application Security

Penetration Testing

Adversary Emulation

How it works Partners Security advisories Blog Contact Sign in Get Started

Blog

AppSec insights & product updates

Security research, engineering write-ups, and platform announcements from the Pragma Core team.

adversary-emulation 2 ai 13 application-security 13 appsec 32 auth-bypass 10 CI/CD 1 continuous-security 15 cPanel 1 CVE 25 dast 1 GitHub 6 kernel 5 linux 6 malware-analysis 1 mitre-attack 1 pentest 21 RCE 13 red-team 1 reverse-engineering 1 sast 13 Supply Chain 8 threat-intelligence 1 Vulnerability Research 32 web-security 1

Featured

P Paraschivoiu Alexandru · Jun 26, 2026 · 19 min read

When the attacker has an AI too: AppSec scanning in an era where exploits arrive before patches

Inside the AI-offense era: autonomous systems like XBOW, Big Sleep, and Claude Mythos find and weaponize flaws in hours, while 28.3% of CVEs are exploited within 24 hours. Why periodic scanning fails, and what continuous AppSec must become.

appsec ai sast continuous-security pentest

S Stefan Mitocaru · Sep 18, 2026 · 20 min

CVE-2026-74820: how an unsanitized ORDER BY clause turned ServiceNow's AI Platform into an unauthenticated database backdoor

Inside CVE-2026-74820: a CVSS 10.0 unauthenticated SQL injection in ServiceNow's AI Platform, reachable through a dynamic schema ORDER BY cl...

appsec application-security Vulnerability Research

P Paraschivoiu Alexandru · Sep 9, 2026 · 20 min

CVE-2026-85978: how one path normalization mismatch turned Akana's admin console into unauthenticated remote code execution

Inside CVE-2026-85978: a path normalization gap between Akana Policy Manager's auth filter and its servlet dispatcher lets an unauthenticate...

appsec RCE Vulnerability Research

S Stefan Mitocaru · Sep 1, 2026 · 19 min

CVE-2026-78174: how an unredacted session token in a diagnostic log turned a low-privileged WatchGuard Dimension admin into super admin

Inside CVE-2026-78174: WatchGuard Dimension writes Super Administrator session tokens into a diagnostic log any lower-privileged Administrat...

appsec sast Vulnerability Research

S Stefan Mitocaru · Aug 19, 2026 · 17 min

Qwen 3.8 27B and the year the open weights caught up: how a 17GB download started beating the frontier

Inside the Qwen 3.8 27B release: a 27B Apache 2.0 dense multimodal model that runs on one consumer GPU and claims frontier-class coding, and...

appsec ai continuous-security

S Stefan Mitocaru · Aug 3, 2026 · 18 min

CVE-2026-65321: how one backslash in PyAthena's quote escaper turned parameterized DELETE queries into SQL injection

Inside CVE-2026-65321: PyAthena sent DELETE and CTAS statements through a Hive escaper that backslash-escapes quotes, but Athena and Trino i...

appsec sast pentest

S Stefan Mitocaru · Jul 31, 2026 · 19 min

CVE-2026-63223: how a GIF header on a PHP file turned CodeIgniter's image upload check into remote code execution

CodeIgniter's is_image and mime_in upload rules trusted content-derived MIME type but never the client filename extension, letting a .php fi...

appsec sast RCE

P Paraschivoiu Alexandru · Jul 29, 2026 · 18 min

CVE-2026-58155: how silently truncating a long header name turned Apache Traffic Server into a request-smuggling engine

Inside CVE-2026-58155: Apache Traffic Server silently truncated over-length HTTP header names instead of rejecting them, enabling header ali...

appsec pentest Vulnerability Research

S Stefan Mitocaru · Jul 27, 2026 · 11 min

Pragma Binary: static analysis, live sandbox, and threat intelligence, in one place

A tour of Pragma Binary, the platform that takes any binary, assembly, or script apart. Read the code, detonate it in a safe sandbox, connec...

Vulnerability Research malware-analysis threat-intelligence

P Paraschivoiu Alexandru · Jul 20, 2026 · 21 min

CVE-2026-60137 + CVE-2026-63030: how a one-position array desync in WordPress's batch API turned a login-only SQL injection into unauthenticated RCE

Inside wp2shell (CVE-2026-60137 + CVE-2026-63030): a REST batch route desync in WordPress core unblocks an author__not_in SQL injection, cha...

sast RCE Vulnerability Research

P Paraschivoiu Alexandru · Jul 17, 2026 · 19 min

CVE-2026-58644: how one unsafe deserialize turns an on-prem SharePoint server into unauthenticated remote code execution

Inside CVE-2026-58644: a critical (CVSS 9.8) deserialization flaw in on-premises Microsoft SharePoint Server that hands unauthenticated atta...

appsec sast RCE

S Stefan Mitocaru · Jul 15, 2026 · 22 min

AsyncAPI and Miasma v3: how one unmerged workflow fix let a pull request publish malware to 2.9 million weekly downloads

Inside the July 14, 2026 AsyncAPI supply chain compromise: a pull_request_target pwn-request stole an org token, and the project's own pipel...

appsec continuous-security GitHub

S Stefan Mitocaru · Jul 14, 2026 · 11 min

Introducing CI/CD Pipeline Security: the part of your attack surface that ships to production every day

Pragma Core's new CI/CD Pipeline Security module detects misconfigurations in your build pipelines across GitHub Actions, GitLab CI, Azure P...

appsec continuous-security pentest

Showing 1–12 of 42 results

1 2 3 4

Start securing your codebase today

Connect your repositories and let AI agents handle continuous scanning, research, and triage.

Create free account Sign in

Have questions? Get in touch →

AppSec insights & product updates

Start securing your codebase today

Get the next advisory in your inbox