On-Prem Red Team AI — engineering notes from the front line
Deep dives, comparisons and field reports on autonomous red team AI, generative pentesting, deep-packet traffic intelligence, NIS2/DORA, and how to operate them air-gapped.
- WSO2 API ManagerCVE-2026-5430JWT Authentication Bypass
WSO2 CVE-2026-5430: the CVSS 10 JWT Bypass Forging Admin Tokens in the Wild
WSO2 CVE-2026-5430 is a CVSS 10 JWT authentication bypass in API Manager, exploited with forged admin tokens. Patched in May — here's the runbook.
9 min read - Citrix NetScalerZero-Day RCECISA KEV
NetScaler CVE-2026-88771/88772: two RCE zero-days exploited before the fix
Two unauthenticated NetScaler RCE zero-days, CVE-2026-88771/88772, exploited before a patch existed. Fixed builds, IOCs, and why the box can't clear you.
8 min read - Arista VeloCloudSD-WANCVE-2026-93952
Arista VeloCloud Orchestrator CVE-2026-93952: SD-WAN Auth Bypass Exploited in the Wild
CVE-2026-93952 is a CVSS 10.0 auth-bypass zero-day in Arista VeloCloud Orchestrator, exploited in the wild. Fixed versions, IOCs and a remediation runbook.
8 min read - F5 BIG-IPZero-Day RCEOAuth
F5 BIG-IP APM CVE-2026-94127: Unauthenticated RCE Exploited in the Wild
CVE-2026-94127 is a CVSS 9.8 unauthenticated heap-overflow RCE in the F5 BIG-IP APM OAuth authorization server, exploited in the wild before a patch existed.
9 min read - Autonomous AI AgentsWeb SkimmingPayment Card Fraud
AI Agents Skimmed 600K Credit Cards for $25 a Target
Gambit tracked three open-source AI agents that breached 27 retailers and skimmed 600,000+ payment cards in days, at roughly $25 a target. Where detection lives.
9 min read - AI Vulnerability DiscoverycurlAgentic Security
AI Found 6 curl CVEs That Frontier Models Missed
AISLE's purpose-built AI found six curl CVEs after Mythos, Codex and ZeroPath returned none. Why a specialized agent beats a frontier model run as a scanner.
8 min read - GDPRArticle 32Compliance
GDPR Article 32: The Fine for the Security Test You Didn't Run
Sweden fined Miljödata under GDPR Article 32 for skipping software testing and real-time monitoring — not for the breach. Why 'appropriate measures' now bites.
6 min read - Zyxel GS1900CVE-2026-7273Actively Exploited
Zyxel GS1900 CVE-2026-7273: Unauthenticated RCE, Now Exploited in the Wild
Zyxel GS1900 switch flaw CVE-2026-7273 lets a LAN-adjacent, unauthenticated attacker run OS commands with one HTTP request. Patched in June, added to CISA KEV in September.
10 min read - Linux KernelPrivilege EscalationCVE-2026-53266
Linux Kernel Privilege Escalation: 3 KEV Flaws, 4 Public Root Exploits, One Week
Linux kernel privilege escalation is spiking: three flaws are in CISA's KEV with a federal deadline today, and four public root exploits just dropped. How to fix it.
8 min read