Cyber Security Blog

Blog posts about Cyber Security, Pentesting, Cloud Security and Red Teaming from our team.

Penetration Test

The Availability Vector in CVSS

In CVSS, availability is a standalone security objective. How the availability vector works and why a flaw with no data exposure still reaches CVSS 7.5.
Jan Kahmen
Jan Kahmen
6 min read
Penetration Test

What Is a 10 Out of 10? The Perfect CVSS Score

A clean 10.0 in CVSS is rare and follows an exact combination of metrics. What makes the perfect score, and why most findings stall at 9.8.
Jan Kahmen
Jan Kahmen
6 min read
Web/API Penetration Test

Stored XSS and Its Dangers: Anatomy of a Persistent Attack Surface

Stored XSS persists in the backend and fires on every render. The anatomy of the sink, trust context, and privilege escalation of an underrated XSS class.
Jan Kahmen
Jan Kahmen
6 min read
Web/API Penetration Test

CVE-2026-42849: How One Link Can Take Over an Authentik Session

Found during a customer pentest: CVE-2026-42849 lets attackers take over an Authentik session via a crafted link. Finding, impact, and patch.
Jan Kahmen
Jan Kahmen
6 min read
DevSecOps

Hardening npm Supply Chains: Lessons from Mini Shai-Hulud

Mini Shai-Hulud compromised 42 TanStack packages via GitHub Actions. Three hardening layers against npm supply chain attacks in practice.
Jan Kahmen
Jan Kahmen
7 min read
Penetration Test

Secure MFA Despite Reverse Proxy: What Actually Holds Up in 2026

Reverse proxy phishing bypasses classic MFA. ENISA Q1 2026 and §38 BSIG now require phishing-resistant factors. What actually defends today and how migration looks.
Jan Kahmen
Jan Kahmen
7 min read