ai

S Stefan Mitocaru · Aug 19, 2026 · 17 min

Qwen 3.8 27B and the year the open weights caught up: how a 17GB download started beating the frontier

Inside the Qwen 3.8 27B release: a 27B Apache 2.0 dense multimodal model that runs on one consumer GPU and claims frontier-class coding, and...

P Paraschivoiu Alexandru · Jul 6, 2026 · 18 min

Pragma Core for Dynamic AppSec Teams

Pragma Core for dynamic AppSec teams: how a continuous, AI-driven platform spanning code, infrastructure, and adversary emulation replaces t...

S Stefan Mitocaru · Jul 3, 2026 · 16 min

Your perimeter, tested every week: External Penetration Testing is live in Pragma Core

Pragma Core now runs your external pentest for you: hand over a scope, pick a depth, and an AI operator maps and tests your perimeter, non-d...

S Stefan Mitocaru · Jun 29, 2026 · 11 min

OWASP Global AppSec EU 2026: thoughts and conclusions from the floor

A practitioner's recap of OWASP Global AppSec EU 2026 at the Austria Center in Vienna, OWASP's 25th anniversary edition: how AI security, su...

P Paraschivoiu Alexandru · Jun 26, 2026 · 19 min

When the attacker has an AI too: AppSec scanning in an era where exploits arrive before patches

Inside the AI-offense era: autonomous systems like XBOW, Big Sleep, and Claude Mythos find and weaponize flaws in hours, while 28.3% of CVEs...

P Paraschivoiu Alexandru · Jun 24, 2026 · 21 min

Classic SAST vs AI-powered SAST: why pattern matching stops at the function boundary and reasoning takes over

Inside the SAST shift: why rule-based static analysis drowns teams in false positives and misses logic bugs, how AI-powered SAST reasons abo...

S Stefan Mitocaru · Jun 19, 2026 · 12 min

Continuous attack emulation: turning the MITRE ATT&CK matrix into a live test your defenses never stop taking (Pragma Core feature preview)

A preview of Pragma Core's Continuous Attack Emulation: intelligence-led, MITRE ATT&CK-aligned breach simulation that runs on a loop, so sil...

P Paraschivoiu Alexandru · Jun 12, 2026 · 18 min

Miasma: how a 157-byte binding.gyp file turned npm install into a self-spreading credential worm

Inside Miasma (Shai-Hulud's npm successor): a 157-byte binding.gyp file executes code during npm install with no lifecycle script, compromis...

P Paraschivoiu Alexandru · Jun 10, 2026 · 18 min

When the attacker is an agent: securing infrastructure with AI powered red teaming

Inside the shift to autonomous offense: AI agents now run the full infrastructure kill chain at machine speed, from recon to domain takeover...

S Stefan Mitocaru · May 29, 2026 · 8 min

Continuous Pentest: what rolling means, and why it matters most on the internal network

AI agents run rolling pentest operations against your environment on every push, every night, and every week, with the heaviest emphasis on...

P Paraschivoiu Alexandru · May 28, 2026 · 6 min

Continuous Web DAST: what it does, where it fits, and what an annual pentest cannot

AI agents run continuous black-box and grey-box DAST against your live web apps, returning real bugs with a request, a response, and a repro...

S Stefan Mitocaru · May 25, 2026 · 7 min

Continuous Adversary Emulation: random cadence, unannounced runs, and real blue team reactions

Continuous adversary emulation runs MITRE ATT&CK aligned playbooks against your live defenses on a randomized weekly and monthly cadence. Th...