Threat · PHP
PHP2Shell: critical PHP vulnerabilities
CVE-2026-109618 and CVE-2026-109619: affected versions, timeline, remediation and detection indicators.
Threat analysis · November 2026
Research
Research, lab and tools
We do research in our own lab, build our own tools and share results following responsible disclosure principles.
Lab
Research and test environment
Industrial lab
PLC modules on a separate OT segment, industrial routers and an OPC UA aggregator: real protocols, real flaws, real fixes.
Simulated plant
An OPC UA-based injection moulding plant with MES: a training and demo environment that puts no production system at risk.
Honeypot network
SSH and Telnet honeypots that collect real attack patterns and malware download chains.
Publications
Research notes and guides
Monthly brief · CISA KEV
Actively exploited vulnerabilities: October 2026
36 new KEV entries: edge devices, web platforms, industrial relevance.
Monthly brief · November 2026
OT · OPC UA
OPC UA security modes in practice
Security modes and policies, what an attacker sees, how we test them and the recommended configuration.
Research note · November 2026
NIS2 · Suppliers
Ten pitfalls of the NIS2 supplier questionnaire
The most common mistakes in answering a supplier security questionnaire, and how to avoid them.
Executive guide · November 2026
Our tools
In-house tooling
Honeypot platform
A decoy network that collects real attack patterns and malware download chains, with automatic alerting and malware analysis.
Threat intelPython
Reconnaissance pipeline
Automated subdomain and attack surface discovery from passive and active sources, with service fingerprinting.
ASMBash
otscan v0.1
Passive OT asset inventory from pcap: Modbus, S7, EtherNet/IP, OPC UA, DNP3, BACnet, PROFINET. It highlights write and programming operations and sends nothing to the network.
OTPassive
Methodology
Built on standards, proven in practice
Web and API
OWASP WSTG, ASVS, API Security Top 10, LLM Top 10
Infrastructure
MITRE ATT&CK, BloodHound-based attack path analysis, CIS Benchmarks
OT
IEC 62443 (3-2, 3-3, 4-2), NIST SP 800-82 Rev. 3, ATT&CK for ICS
Severity
CVSS v3.1/v4.0 plus business and safety context, with recommended deadlines
Responsible disclosure
When we find a vulnerability in a third-party product, we notify the vendor and the relevant CERT first (typically with a 90-day deadline), and publish only afterwards. We never disclose identifiable information about our clients or their vulnerable systems.
Contact
Request a proposal
Briefly describe the system you would like tested and the reason for the engagement: a partner or regulatory requirement, an audit, or a new system going live. We will get back to you within one business day.
ConfidentialityNDA from the first call
Fixed feein writing, once the scope is agreed