Sicuranext Blog

Sign in Subscribe

Two RCEs, one Wednesday: responsible disclosure has run out of time

Two RCEs, one Wednesday: responsible disclosure has run out of time

TL;DR. On Wednesday, October 21st, two critical RCEs went public a few hours apart, and both broke the idea that disclosure buys defenders time. php2shell, in PHP core, leaked before its patch: Amazon saw exploit attempts four days before disclosure, and our WAAP blocked a working tool 16 minutes

Operation Fashion Weak

Operation Fashion Weak

We discovered a ready-made kit for mass-producing fake online shops, run from a single server. With it they built more than a thousand websites impersonating 71 real global brands, mostly in beauty, fitness and skincare.

AppSec Qwen3.8 27B: Best LLM to protect web applications

AppSec Qwen3.8 27B: Best LLM to protect web applications

I spent a few days building a benchmark that measures 27 models over 7 different cases. My goal was to measure if, given a real Application Security problem, can a model produce a fix that actually works? For instance, can the AI determine whether a blocked HTTP request is a

The forgotten hardware: your security depends on your weakest link

The forgotten hardware: your security depends on your weakest link

You can patch everything you're aware of and still lose control of the domain because of that one device you overlooked. In this article, we'll examine three real-world cases where forgotten, abandoned perimeter assets led to a total compromise of Active Directory.

Patching WP2Shell in the dark using PAI

Patching WP2Shell in the dark using PAI

Will AI let me spend my time at the beach while patching a critical vulnerability in one of the most used CMS in the world? Yes it will. We recently released PAI, our AI Security Agent that acts as a Senior Security Specialist for a wide range of security tasks.

Why the HTTP QUERY Method Is a Good Idea but Accept-Query Is Not

Why the HTTP QUERY Method Is a Good Idea but Accept-Query Is Not

In June 2026 the IETF published RFC 10008 and gave HTTP a new method: QUERY. New HTTP methods are rare. Most engineers have not seen one added in about twenty years, so this is worth understanding before it shows up in your stack. At first, when I saw this new

Protect Your WordPress Using Claude Code and Karna

Protect Your WordPress Using Claude Code and Karna

When we open-sourced Karna WAF, we immediately added AI Agent Skills to help agents not just use and configure Karna, but also learn how to protect web apps and APIs. Now you can ask to Claude Code to protect your web application using Karna without knowing how to do

Ghost Stories: investigating an undocumented ClickFix C2 in Ghost CMS

Ghost Stories: investigating an undocumented ClickFix C2 in Ghost CMS

Read-only research into an active campaign that exploits CVE-2026-26980 in Ghost CMS. Every result below comes from public GET requests. We did not exploit the flaw, did not authenticate, and did not write anything. The main scan ran on 2026-06-11. Key findings * An active campaign

One Paste to Rule Them All: Inside a ClickFix → EtherHiding → GULoader Intrusion

One Paste to Rule Them All: Inside a ClickFix → EtherHiding → GULoader Intrusion

A real-world ClickFix intrusion observed from both sandbox and endpoint telemetry, revealing the complete attack path from a compromised WordPress site to a blocked GULoader execution, including a full process creation call stack from the Windows Run dialog to the kernel. Preamble In April 2026, we responded to an

क Karna: we built our own WAF. Modern, Fast and Free.

क Karna: we built our own WAF. Modern, Fast and Free.

We replaced ModSecurity with Karna, our open-source WAF engine in Lua and C running as a Kong plugin. CRS-compatible, MCP-aware, can sanitize instead of blocking, and 2 to 4 times faster than ModSecurity in our benchmarks. The honest story of why, how, and how to try it.

From Prompt to Prod: Sicuranext Evaluates AI Integration in SOC Analysis

From Prompt to Prod: Sicuranext Evaluates AI Integration in SOC Analysis

At Sicuranext, we do not evaluate AI with artificial examples. We replay realistic SOC workflows, measure correctness and consistency, verify tool behavior, and put guardrails around automation before it touches our SOC. AI in a SOC should not be judged by whether it can produce a convincing paragraph. It should

A nice approach to AWS security group management

A nice approach to AWS security group management

AWS Glossary for the novices Hi, before diving a bit more in the details of this article, is mandatory to explain some core components in the AWS ecosystem we are gonna cite during this post, so even for novice and unfamiliar people can understand better the concepts. * EC2: stands for

Vulnerability Research

Exploiting a PHP Object Injection in Profile Builder Pro in the era of AI

WordPress plugin "Profile Builder Pro" (versions before 3.14.5) is susceptible to Unauthenticated PHP Object Injection. In this blog post, we discuss how we discovered and exploited the vulnerability using a novel POP chain, how AI helped in the process, taking a final look at targets in the wild.

Fight bad bot with Sec Fetch and Client Hints inconsistencies in headless browsers

Fight bad bot with Sec Fetch and Client Hints inconsistencies in headless browsers

For many of our e-commerce customers the problem of bad bots it's a everyday problem and has evolved a lot in the last few years. A common approach is to "block" automated traffic with a JavaScript challenge, basically a small script that the browser must

68% Of Phishing Websites Are Protected by CloudFlare

68% Of Phishing Websites Are Protected by CloudFlare

Earlier this year, our CTI team set out to build something we'd been thinking about for a while: a phishing intelligence pipeline that could actually keep up with the threat. We combined feeds from hundreds of independent sources with our own real-time hunt for suspicious SSL/TLS

Vtenext 25.02: A three-way path to RCE

Vulnerability Research

Vtenext 25.02: A three-way path to RCE

Multiple vulnerabilities in vtenext 25.02 and prior versions allow unauthenticated attackers to bypass authentication through three separate vectors, ultimately leading to remote code execution on the underlying server.

Influencing LLM Output using logprobs and Token Distribution

Influencing LLM Output using logprobs and Token Distribution

What if you could influence an LLM's output not by breaking its rules, but by bending its probabilities? In this deep-dive, we explore how small changes in user input (down to a single token) can shift the balance between “true” and “false”, triggering radically different completions.

Breaking Down Multipart Parsers: File upload validation bypass

Breaking Down Multipart Parsers: File upload validation bypass

TL;DR: Basically, all multipart/form-data parsers fail to fully comply with the RFC, and when it comes to validating filenames or content uploaded by users, there are always numerous ways to bypass validation. We'll test various bypass techniques against PHP, Node.js, and Python parsers, as

Hunt3r Kill3rs and the Italian Critical Infrastructure risks

Hunt3r Kill3rs and the Italian Critical Infrastructure risks

A new cyber-criminal group known as Hunt3r Kill3rs has recently emerged, claiming responsibility for a series of attacks on critical infrastructure with the final political goal of attacking Israeli companies and Israeli allies. This group has primarily focused on industrial control systems (ICS), communication networks, and vulnerable web applications.

Medical Devices Exposed

Medical Devices Exposed

Medical devices, ranging from pacemakers to infusion pumps, have traditionally been designed with a singular purpose: to improve patient care and outcomes. Yet, as these devices become more interconnected through the Internet of Medical Things (IoMT), the cybersecurity landscape surrounding them has grown increasingly complex. In the Healthcare landscape there

Response Filter Denial of Service (RFDoS): shut down a website by triggering WAF rule

Response Filter Denial of Service (RFDoS): shut down a website by triggering WAF rule

TL;DR: Basically, if a target website is protected by a WAF using the OWASP Core Rule Set or Comodo Rule Set or Atomicorp Rule Set, you can send the string ORA-1234 or OracleDrive or ASL-CONFIG-FILE in a comment, product review, registration form, e-commerce order details,

ModSecurity: Path Confusion and really easy bypass on v2 and v3

ModSecurity: Path Confusion and really easy bypass on v2 and v3

TL;DR both ModSecurity v2 and v3 share a similar bug that can result in a really simple WAF bypass. The bug in the v3 branch has been fixed in version 3.0.12 and has been assigned the CVE number CVE-2024-1019. However, the bug in the v2

Emails and barcodes: a phishing story

Emails and barcodes: a phishing story

TL;DR If you open an email and see a QR code and some pressing message about something you’re supposed to do, doubt the source of the email. Microsoft won’t ask you to “verify the security of your account” via QR code. Neither will Google, nor Amazon, nor

OT Exposed Italy

OT Exposed Italy

OT (Operational Technology) consists of in a complex network of ICS (industrial control system). The ICS describes several types of control systems and associated instrumentation used for industrial process control. It includes systems like PLC (Programmable logic controller) , HMI (Human machine interface), DCS (Distributed control system) and SCADA (Supervisory Control

How attackers fingerprint your WordPress website

How attackers fingerprint your WordPress website

Attackers have quite a few sneaky ways to gather information from your WordPress website. They can get their hands on details like the WordPress version you're using, the active plugins and their versions, and even info about your active users. In this article, we'll take a