Security research, engineering write-ups, and platform announcements from the Pragma Core team.
Inside the AI-offense era: autonomous systems like XBOW, Big Sleep, and Claude Mythos find and weaponize flaws in hours, while 28.3% of CVEs are exploited within 24 hours. Why periodic scanning fails, and what continuous AppSec must become.
Inside CVE-2026-20245: an unvalidated file-path argument to a privileged tenant-list upload script lets a netadmin execute commands as root...
Inside Megalodon: how threat actor TeamPCP pushed 5,718 malicious commits to 5,561 GitHub repositories in a six-hour window, injecting dorma...
Inside CVE-2026-45659: an insecure-deserialization (CWE-502) flaw lets any authenticated SharePoint Server Site Member run code on-prem (CVS...
Inside CVE-2026-48095: an undefined-behavior shift in 7-Zip's NTFS handler allocates a 1-byte buffer, then writes 256 MB into it, corrupting...
AI agents run rolling pentest operations against your environment on every push, every night, and every week, with the heaviest emphasis on...
AI agents run continuous black-box and grey-box DAST against your live web apps, returning real bugs with a request, a response, and a repro...
Continuous adversary emulation runs MITRE ATT&CK aligned playbooks against your live defenses on a randomized weekly and monthly cadence. Th...
Inside CVE-2026-43640: the C# short-circuit boolean that lets any authenticated Bitwarden admin with a stolen session pull or rotate the org...
Ivanti Ivanti Endpoint Manager Mobile (versions up to 12.8.0.0) contains an improper input validation vulnerability that allows remote code...
Inside CVE-2026-42945 (NGINX Rift): the 18-year-old heap buffer overflow in NGINX's ngx_http_rewrite_module that enables unauthenticated RCE...
Breakdown of CVE-2026-45321, the TanStack supply chain compromise. An attacker chained a pull_request_target misconfiguration, GitHub Action...
A critical double-free bug in Apache HTTP Server 2.4.66 lets unauthenticated attackers crash worker processes with two HTTP/2 frames, and es...
Connect your repositories and let AI agents handle continuous scanning, research, and triage.
Choose which categories you are happy to allow. You can change your mind at any time using the Cookie settings link in the footer.