Blog

Security Insights & Research

Technical deep-dives, industry trends, and best practices from our offensive security experts. Stay ahead of emerging threats with insights from the OraSec team.

Showing page 1 of 12 (133 total posts)

...

1 / 12

Security

CI/CD Security Best Practices: A Checklist for Your Pipeline

CI/CD security best practices protect the system that builds and ships your code. Your pipeline holds cloud keys, signing certificates, and write access to production, which makes it one of the most valuable targets an attacker can reach. One leaked token or poisoned dependency can push malicious code to every customer. This checklist covers 12 controls to put in place, the real breaches behind them, and how to test whether they hold. What is CI/CD security? The controls that protect your bui

Broken Access Control: 6 Real Examples Found in Pentests

Broken access control happens when an app lets a user do something they shouldn't, like read another customer's invoice or open an admin page. It is the top risk in the OWASP Top 10:2025, and it shows up in almost every web app pentest. Scanners rarely catch it because the requests look normal. Below are 6 real examples testers find again and again, how each one gets found, and how to fix it. What is broken access control? A flaw that lets users act outside their permissions, such as viewing

10 Penetration Testing Myths That Leave Businesses Exposed

Penetration testing myths cost companies real money. Some teams skip testing because they fear downtime. Others think a clean scan or a compliance checkbox means they are safe. Neither is true. A penetration test is a controlled, authorized attack run by a human expert to show how a real attacker could get in. Below are the 10 most common myths, what actually happens during a test, and what a good one should deliver. Is AI taking over pentesting? No. AI speeds up recon and scanning, but human

Penetration Testing Methodology: Phases, Types and Standards

A penetration testing methodology is the step-by-step plan ethical hackers follow to attack your systems safely, find real weaknesses, and report them in a way you can fix. Without one, a pentest turns into a random tool run. Good methodologies borrow from published standards like PTES, NIST SP 800-115, and the OWASP Web Security Testing Guide. Below you'll find the 10 phases of a test, the main testing types, and how the major standards compare. What is penetration testing methodology? It's

BGP Hijack Delivered a Backdoored Virtualizor Update

The update came from the right domain over valid TLS. The route to the vendor had been stolen, so the traffic reached an attacker-controlled server instead. What Happened? Between 28 and 30 August 2026, attackers announced a BGP route they had no authority over, pulling Softaculous update traffic to a server they controlled. Any Virtualizor installation that checked for updates during one of the diverted routing intervals could have received the backdoored package. AlbaHost, a hosting provid

JFrog Artifactory Vulnerability: Exploited in Three Days

JFrog released patches on 28 August 2026. By 1 September, watchTowr was publicly reporting active exploitation — roughly three and a half days after disclosure. What Is the Vulnerability? CVE-2026-82329 is an authentication bypass in JFrog Artifactory, rated CVSS 9.8. In default configurations, an unauthenticated attacker with network access can obtain administrative privileges, with no user interaction required. Self-hosted deployments require customer action. JFrog says affected cloud envi

DLL Sideloading: How ValleyRAT Hides Behind Signed Software

The malicious code was not signed. The program that loaded it was. What Is DLL Sideloading? When an application loads a DLL by name rather than a fully qualified path, Windows searches a defined set of locations. If an attacker can place a malicious DLL in a directory searched before the legitimate copy, the application may load it. Microsoft documents this as DLL preloading/binary planting behavior. (Microsoft Learn) The signed executable runs. The signature checks out. The malicious DLL ex

TerminalFix: The ClickFix Attack That Uses Windows Terminal

The victim is not tricked into opening an attachment. They are asked to prove they are human, and they do it by pasting a command into their own terminal. Microsoft documented the campaign, which it calls TerminalFix, on 28 August 2026. What Is a ClickFix Attack? ClickFix is social engineering that persuades the user to run the command themselves. A web page shows a fake error or verification prompt, then supplies instructions: copy this text, open this box, paste, press Enter. The initial

Internet-Exposed OT: Why 100+ Water-Sector Systems Were Targeted

A controller plugged into a cellular modem does not feel like an internet-facing system. Often enough, it is one. In July 2026, CISA observed malicious activity targeting more than 100 internet-exposed systems in the Water and Wastewater Systems sector, commonly involving PLCs connected directly to cellular modems. (SecurityWeek) Many reported incidents involved smaller utilities. The activity publicly documented by CISA focused on exposed or poorly protected OT, default credentials, configura

CISA Red Team: Why One SOC Contained the Attack and One Didn't

The organization that missed the intrusion was not blind. Its EDR fired alerts on the red team's activity. They were rated medium and low, they sat in the queue, and nobody acted on them. The tools worked. What Happened? In August 2026, CISA published advisory AA26-237A, "A Tale of Two SOCs," on red team assessments at two critical infrastructure organizations. Organization A sits in Government Services and Facilities. Organization B is in Water and Wastewater Systems. At Organization A, th

Mirage2FA: The Microsoft 365 Phishing Kit That Bypasses Conventional MFA

Your user got the phishing email and was careful. They checked the login page, entered their password, approved the MFA prompt, and signed in. The attacker could then reuse the stolen authenticated session. What Is Mirage2FA? Mirage2FA is a phishing-as-a-service toolkit built to steal Microsoft 365 credentials and sessions through adversary-in-the-middle (AiTM) attacks. ANY.RUN attributes the Mirage2FA brand/operator to "LinX Coders" based on recurring LINX markers, bot names, and related in

Microsoft Copilot Security: When One Click Leaks Your Data

You click a link. Your AI assistant answers a question you never asked, and your inbox is already on its way to someone else's server. No password prompt. No warning. What Happened? In August 2026, Varonis Threat Labs disclosed a chain of flaws in Microsoft Copilot Personal, tracked as CVE-2026-24301 with a CVSS 3.1 score of 8.8. They named it CoSnitch. CoSnitch chained three weaknesses: automatic prompt execution from a crafted URL, silent data exfiltration through Copilot's connected apps

OrasecAug 25, 2026

3 min read

Read Article

...

1 / 12

Loading articles...