Sam Pizzey

LLMs give up early when hunting bugs. So we lied to one about a breach that never happened, and it found an auth bypass 0-day in Plesk.

This post details how we are using LLMs to find novel vulnerabilities using code scanning frameworks alongside pre-Mythos models.

When we used AI to help code a honeypot, it introduced a vulnerability of its own. What transpired was a fascinating, if uncomfortable, lesson in AI complacency - how easily trust in automation can make us miss what’s right in front of us. We share what we learned and what it means for anyone using AI to code.

CVE-2025-30406 was added to CISA’s KEV list after being exploited in the wild. When we spotted a discrepancy between the vendor’s CVSS score (9.0) and NVD’s rating (9.8), we investigated to understand the real risk: how easily could an attacker obtain the machine keys and use them to exploit the vulnerability? Read on for the full breakdown.

CSLA.NET is a framework that helps structure business logic for .NET applications into re-usable objects, and share those objects between systems. During a penetration test last year, we discovered an interesting path traversal vulnerability affecting applications using this framework. Read on for a technical explanation of how this vulnerability works.