Cyber Security Blog

Blog posts about Cyber Security, Pentesting, Cloud Security and Red Teaming from our team.

Web/API Penetration Test

CVE-2026-42849: How One Link Can Take Over an Authentik Session

Found during a customer pentest: CVE-2026-42849 lets attackers take over an Authentik session via a crafted link. Finding, impact, and patch.
Jan Kahmen
Jan Kahmen
6 min read
DevSecOps

Hardening npm Supply Chains: Lessons from Mini Shai-Hulud

Mini Shai-Hulud compromised 42 TanStack packages via GitHub Actions. Three hardening layers against npm supply chain attacks in practice.
Jan Kahmen
Jan Kahmen
7 min read
Penetration Test

Secure MFA Despite Reverse Proxy: What Actually Holds Up in 2026

Reverse proxy phishing bypasses classic MFA. ENISA Q1 2026 and §38 BSIG now require phishing-resistant factors. What actually defends today and how migration looks.
Jan Kahmen
Jan Kahmen
7 min read
Web/API Penetration Test

OWASP Top 10 Mapping: From 2021 to 2025

The OWASP Top 10:2025 introduces two new categories, one rename, and a quiet goodbye to SSRF. What that means for pentest scopes and finding templates.
Jan Kahmen
Jan Kahmen
7 min read
Penetration Test

Grundschutz++ OSCAL Catalog: What the BSI Actually Requires for Pentests

We analyzed the Grundschutz++ OSCAL catalog: 998 requirements, penetration tests only optional. What this means for organizations under NIS-2.
Jan Kahmen
Jan Kahmen
5 min read
Cloud Security

Cloud Attacks 2026: What the IBM X-Force Report Means for Your Cloud Security

IBM X-Force 2026: 44% more attacks on cloud applications, 16M infected devices, identity as the primary risk. What organizations must do now.
Jan Kahmen
Jan Kahmen
7 min read