In a typical engagement, the testing firm writes the report and delivers it on its own timeline. XBOW runs continuously or on demand, with results in hours, and your reports keep the same pace. You ...

Product Manager @ XBOW Introducing Self-Serve Reporting: Evidence You Generate Yourself David MinkovskiDavid Minkovski Product Manager @ XBOW ...

My name is Ariel Garcia. I’m a Security Researcher and part of the Public-XBOW Team. One of the things we do in Public-XBOW is run XBOW against real-world bug bounty programs and vulnerability ...

How attackers are using AI across the attack chain Attackers can apply AI throughout the attack chain, beginning with reconnaissance. AI can process large volumes of publicly available information, ...

On October 21, the PHP Project shipped emergency fixes for two unauthenticated RCE flaws, together known as PHP2shell, rated 9.2 on CVSS 4.0. Probing started the same day, at least one attempt ...

Why looking is not enough PHP turns up in more places than the list of applications you think of as yours. It is tucked inside vendor appliances, baked into container images, running a marketing site ...

For security teams responding to PHP2shell, this 10-point checklist walks you through steps to take today. Patching is only step one. Steps four through 10 are where the real exposure hides.

Sarah Hyatt is a product manager at XBOW, where she leads offensive capabilities such as API and authorization testing for XBOW's autonomous AI agents. She came to product from penetration testing and ...

Why patching answers half the PHP2shell question. What validation looks like, what inventories miss and what to do this week. Read the white paper.

On October 21, PHP shipped emergency fixes for two flaws that let an attacker with no login run code on a web server. Probing had started before most teams had even read the advisory. Since then, the ...

In town for a security event? Skip the hotel bar. XBOW is putting security leaders from banks, insurers and fintechs on two very large bike bars. Let's pedal, drink and enjoy Austin bars together.

XBOW found and exploited CVE-2026-72018, a Linux kernel bug human reviewers had passed over. The primitive looked too weak to matter, but it wasn't. Here's how a 16-byte write became root, and where ...