My name is Ariel Garcia. I’m a Security Researcher and part of the Public-XBOW Team. One of the things we do in Public-XBOW is run XBOW against real-world bug bounty programs and vulnerability ...
In a typical engagement, the testing firm writes the report and delivers it on its own timeline. XBOW runs continuously or on demand, with results in hours, and your reports keep the same pace. You ...
Product Manager @ XBOW Introducing Self-Serve Reporting: Evidence You Generate Yourself David MinkovskiDavid Minkovski Product Manager @ XBOW ...
On October 21, the PHP Project shipped emergency fixes for two unauthenticated RCE flaws, together known as PHP2shell, rated 9.2 on CVSS 4.0. Probing started the same day, at least one attempt ...
How attackers are using AI across the attack chain Attackers can apply AI throughout the attack chain, beginning with reconnaissance. AI can process large volumes of publicly available information, ...
Why looking is not enough PHP turns up in more places than the list of applications you think of as yours. It is tucked inside vendor appliances, baked into container images, running a marketing site ...
For security teams responding to PHP2shell, this 10-point checklist walks you through steps to take today. Patching is only step one. Steps four through 10 are where the real exposure hides.
Sarah Hyatt is a product manager at XBOW, where she leads offensive capabilities such as API and authorization testing for XBOW's autonomous AI agents. She came to product from penetration testing and ...
Why patching answers half the PHP2shell question. What validation looks like, what inventories miss and what to do this week. Read the white paper.
On October 21, PHP shipped emergency fixes for two flaws that let an attacker with no login run code on a web server. Probing had started before most teams had even read the advisory. Since then, the ...
A single human researcher collaborating with AI agents built a three-vuln attack chain, earning Google’s first $250,000 Chrome full-chain reward of 2026.
XBOW recently discovered and built a Chrome full-chain exploit affecting an estimated billion users globally.
Some results have been hidden because they may be inaccessible to you
Show inaccessible results