continuous-security

S Stefan Mitocaru · Aug 19, 2026 · 17 min

Qwen 3.8 27B and the year the open weights caught up: how a 17GB download started beating the frontier

Inside the Qwen 3.8 27B release: a 27B Apache 2.0 dense multimodal model that runs on one consumer GPU and claims frontier-class coding, and...

S Stefan Mitocaru · Jul 15, 2026 · 22 min

AsyncAPI and Miasma v3: how one unmerged workflow fix let a pull request publish malware to 2.9 million weekly downloads

Inside the July 14, 2026 AsyncAPI supply chain compromise: a pull_request_target pwn-request stole an org token, and the project's own pipel...

S Stefan Mitocaru · Jul 14, 2026 · 11 min

Introducing CI/CD Pipeline Security: the part of your attack surface that ships to production every day

Pragma Core's new CI/CD Pipeline Security module detects misconfigurations in your build pipelines across GitHub Actions, GitLab CI, Azure P...

P Paraschivoiu Alexandru · Jul 6, 2026 · 18 min

Pragma Core for Dynamic AppSec Teams

Pragma Core for dynamic AppSec teams: how a continuous, AI-driven platform spanning code, infrastructure, and adversary emulation replaces t...

S Stefan Mitocaru · Jul 3, 2026 · 16 min

Your perimeter, tested every week: External Penetration Testing is live in Pragma Core

Pragma Core now runs your external pentest for you: hand over a scope, pick a depth, and an AI operator maps and tests your perimeter, non-d...

S Stefan Mitocaru · Jun 29, 2026 · 11 min

OWASP Global AppSec EU 2026: thoughts and conclusions from the floor

A practitioner's recap of OWASP Global AppSec EU 2026 at the Austria Center in Vienna, OWASP's 25th anniversary edition: how AI security, su...

P Paraschivoiu Alexandru · Jun 26, 2026 · 19 min

When the attacker has an AI too: AppSec scanning in an era where exploits arrive before patches

Inside the AI-offense era: autonomous systems like XBOW, Big Sleep, and Claude Mythos find and weaponize flaws in hours, while 28.3% of CVEs...

P Paraschivoiu Alexandru · Jun 24, 2026 · 21 min

Classic SAST vs AI-powered SAST: why pattern matching stops at the function boundary and reasoning takes over

Inside the SAST shift: why rule-based static analysis drowns teams in false positives and misses logic bugs, how AI-powered SAST reasons abo...

S Stefan Mitocaru · Jun 19, 2026 · 12 min

Continuous attack emulation: turning the MITRE ATT&CK matrix into a live test your defenses never stop taking (Pragma Core feature preview)

A preview of Pragma Core's Continuous Attack Emulation: intelligence-led, MITRE ATT&CK-aligned breach simulation that runs on a loop, so sil...

P Paraschivoiu Alexandru · Jun 17, 2026 · 19 min

npm v12: how switching off one install-time default cuts the legs out from under almost every recent npm worm

Inside npm v12: GitHub is disabling preinstall/install/postinstall scripts, Git, and remote-URL dependencies by default, killing the install...

P Paraschivoiu Alexandru · Jun 10, 2026 · 18 min

When the attacker is an agent: securing infrastructure with AI powered red teaming

Inside the shift to autonomous offense: AI agents now run the full infrastructure kill chain at machine speed, from recon to domain takeover...

S Stefan Mitocaru · May 29, 2026 · 8 min

Continuous Pentest: what rolling means, and why it matters most on the internal network

AI agents run rolling pentest operations against your environment on every push, every night, and every week, with the heaviest emphasis on...