Notable Critical CVEs in Late 2026: GitLab, Citrix, and Others
Brief overview of additional critical vulnerabilities disclosed or exploited in late 2026, including GitLab, Citrix NetScaler, and related Fortinet/Ivanti issues.
Blog
Practical notes on penetration testing cost, methodology, continuous testing, and related topics. These posts support the educational content on our main pages.
Ivanti Connect Secure Zero-Day Chain (October 2026)
Overview of the October 2026 Ivanti Connect Secure zero-day chain that allowed unauthenticated root access on affected appliances.
PHP2Shell: Critical Unauthenticated RCE in PHP Core
Overview of PHP2Shell (CVE-2026-109618 and CVE-2026-109619), two critical remote code execution vulnerabilities in PHP itself that can affect any web application running on an unpatched PHP version.
CVE-2025-55182: Critical RCE in React Server Components
Overview of CVE-2025-55182 (React2Shell), a critical unauthenticated remote code execution vulnerability in React Server Components and Next.js.
CVE-2025-64446: Critical Fortinet FortiWeb Vulnerability
Summary of CVE-2025-64446, a critical path-traversal vulnerability in Fortinet FortiWeb that was exploited in the wild.
What Actually Drives Penetration Testing Cost in 2025–2026
Market ranges have stayed relatively stable, but the factors that move a quote have become clearer. Manual depth, scope complexity, and reporting requirements remain the largest variables.
PTaaS vs a Traditional Annual Penetration Test
Continuous and change-driven testing models have grown quickly. Here is when a traditional point-in-time test still makes sense and when a PTaaS approach is a better fit.
What Has Changed Since the Last Penetration Test?
After a major release or significant change, do you need a full retest? How change detection helps between penetration tests.
Safety Practices When Testing Production Systems
Published methodologies help, but the practical controls that reduce risk to production environments are what separate careful testing from disruptive testing.
Other Notable Critical CVEs from Late 2024 and Early 2025
Brief awareness summary of additional critical vulnerabilities disclosed or exploited in late 2024 and early 2025, including SolarWinds Web Help Desk, GFI KerioControl, and Fortinet FortiSIEM.
Why Manual Testing Still Matters in 2025
Scanners and automation have improved, yet business-logic flaws, authorization issues, and chained vulnerabilities continue to require human interaction.
CVE-2024-0012: Critical Authentication Bypass in Palo Alto PAN-OS
Overview of CVE-2024-0012, a critical authentication bypass in Palo Alto Networks PAN-OS that was exploited in the wild.
Direct Employees vs Contractors for Penetration Testing
Background checks, consistent methodology, and accountability are easier to maintain when testers are direct employees rather than a rotating contractor pool.
Critical Pre-Authentication RCE Issues in Apache OFBiz (2024)
Summary of multiple critical pre-authentication remote code execution vulnerabilities in Apache OFBiz disclosed in 2024.
How to Read a Penetration Test Report
A useful report separates proven findings from scanner noise, includes evidence, and gives clear remediation guidance. Here is what to look for.
Penetration Testing for Compliance: What the Evidence Needs to Show
PCI-DSS, SOC 2, HIPAA, and similar frameworks expect more than a scanner output. Credible evidence includes scope, methods, findings with proof, and remediation status.