Schedule a demoBook a demo
Product
Incident responseLeaked secretsVendor breachesThreat watchAccess reviewsDevice securityPR reviewsNightly scansHow it worksIntegrationsMCP for AI toolsMorning briefAll features →
Solutions
StartupsEngineering teamsSecurity teamsCloud securityCode securityIdentity and accessCompliance evidenceAll solutions →
Trust
Trust centerAccess manifestReport a vulnerabilityStandardsSubprocessorsAudit evidence
Resources
DocsBlogGetting startedPermissions and dataFree security checkConnect SlackContact us
Pricing
Blog

What I’m seeing

Threat intelligence and notes from the work. Every finding links to its source.

Threat intelOctober 28, 20262 min readPHP2Shell: one request can run code on your PHP serversTwo flaws in PHP itself let an unauthenticated attacker run code before your application even starts. Exploitation attempts were seen four days before the fix shipped. If you serve anything on PHP, patch this week.Averil9.2CVSS v4, both flaws22.6Mexposed instances seenOct 21fixes released
Threat intelOctober 28, 2026Railway was breached. Rotate at the source, not just in RailwayAn attacker got into the system where Railway keeps customer environment variables, and in some cases read them decrypted. Up to 100,000 workspaces may be exposed. Changing a variable in Railway doesn’t stop a key that was already copied.Read
Threat intelOctober 28, 2026One upload request can crash your Node serverA multer bug lets a single unauthenticated request take a Node process down when uploads use an async fileFilter. NestJS 12.2 pins the vulnerable version, so a lot of teams have it without knowing.Read
Field notesOctober 27, 2026How I decide a finding is realMost scanners stop at “possible”. I don’t bring you a code problem until a test proves it, a fix makes the test pass, and your own tests still do.Read

Start with a free
security check

Connect GitHub and your cloud, and I'll send you a short list of what to fix, in Slack.

Get a free security checkSee pricing