Threat Intelligence
PHP2Shell: Patch PHP, Then Keep Testing
PHP2Shell is two critical PHP RCE flaws (CVE-2026-109618 and CVE-2026-109619). The versions that fix them, and why to keep testing after you patch.
Read article
BreachLine Blog
AI Pentesting & Security Blog
Reproducible labs, security analysis and product updates. Explore the evidence, understand the limits and try the methods yourself.
Featured
More from BreachLine
15 articles
Industry Analysis
What a Penetration Test Includes, and Why Prices Vary
What goes into a penetration test, why prices vary, and what to ask before you buy. Compare AI pentesting plans from £399 a month.
Defensive Security
npm Lockfile Security Review: Checks Before You Merge
npm lockfile security review: check package sources, install hooks and integrity metadata, then record the evidence behind your merge decision.
Defensive Security
Supply Chain Review: A Reproducible Lockfile Lab
Reproduce a supply-chain review with sample npm lockfiles, inspect the evidence, and retest configuration changes using BreachLine's browser tools.
Product
Meet Nebula: autonomous AI pentesting, explained
Meet Nebula, the AI security engineer inside BreachLine. Give it a task and follow autonomous security work in one software workspace.
Industry Analysis
Working Exploit vs Scanner Finding for Questionnaires
Working exploit vs scanner finding: what enterprise security questionnaires actually accept, and how to turn coverage into adversarial proof.
Threat Intelligence
llms.txt Is Directing Agents to Install Unowned Code
Researchers found 120 corporate llms.txt files pointing at packages nobody owned. Claude, Codex, and Hermes then installed them inside real networks.
Threat Intelligence
Prompt Injection as RCE: Cursor, VS Code, and Antigravity
Three flaw clusters turned Cursor, VS Code, and Google Antigravity into a remote-code-execution surface in 2026. How each worked, and how to shut it down.
Offensive Research
Active Directory Takeover: Low-Priv to Domain Admin
How an AI security engineer chained DFSCoerce, NetNTLMv1, and DCSync to go from one low-privileged account to Domain Admin, live and fully anonymised.
Product
AI Browser Pentesting: HumanBrowser and Evidence
Evaluate AI browser pentesting with a practical workflow for authenticated sessions, cross-role checks, network evidence and reproducible findings.
Threat Intelligence
TeamPCP: The Group Turning Security Tools Into Malware
TeamPCP poisoned Trivy, Checkmarx, and LiteLLM in a 2026 supply chain campaign (CVE-2026-33634). Who they are, what they hit, and how to stop them.
Industry Analysis
Claude Mythos and AI Pentesting: What the Evidence Shows
What Claude Mythos evaluations show about AI pentesting, how they differ from the earlier Opus experiment, and what buyers should verify on their systems.
Industry Analysis
AI Pentesting Tools: Compare XBOW and Alternatives
Compare AI pentesting tools and XBOW alternatives with a practical trial worksheet for scope, authenticated coverage, exploit evidence, retests and cost.
Threat Intelligence
Vercel Breach: One OAuth Token, Full Compromise
Vercel's April 2026 breach traces to one compromised third-party OAuth token from Context.ai. The full attack chain, the IOCs, and the lessons for your team.
Threat Intelligence
The Axios npm Supply Chain Attack: What Teams Need to Know
Investigate the Axios npm supply chain attack using affected-version evidence, historical lockfiles, build records and credential exposure checks.
Threat Intelligence
LiteLLM Supply Chain Attacks: Exposure and Response
Investigate LiteLLM supply chain exposure with affected-version checks, build evidence, credential scoping and a recovery worksheet for AI teams.