Copy Fail – Local Linux Privilege Escalation in 4 lines
CVE-2026-31431, dubbed Copy Fail, allows privilege escalation to root on Linux distros missing the latest kernel patches. Learn what to do in this blog.
Penetration Testing Blog
Offensive security, written by the professionals who live it.
Bypassing ChatGPT’s Open-Source Model Security Restrictions for Agentic Hacking
Ryan Chaplin wondered what it would take to bypass ChatGPT’s open-source model security restrictions to allow AI to hack his website. See how he did it here.
No Malware Required
The March 2026 attack on Stryker Corporation was not Malware and did not make Ransomware demands. Instead it used compromised credentials to disrupt business.
Cool Tools Series: SCP
Raxis Lead Penetration Tester Nathan Anderson continues our Cool Tool Series with SCP for data exfiltration on internal network pentests and red teams.
Deepfakes: The Face on Your Screen Might Not Be Real
Phishing and other social engineering techniques have crossed a threshold with deepfake attacks. Scottie Cole discusses how to protect your organization.
Smart Slider 3 Pro WordPress/Joomla Plugin Supply Chain Compromise
Last week’s supply chain attack caused many users of the WordPress and Joomla plugin Smart Slider 3 Pro to inadvertently patch to a malicious version.
Two Critical Telnet Flaws in 2026 Allow Unauthenticated Root Access
Lead Penetration Ryan Chaplin explains how to protect your network against CVE-2026-24061 and CVE-2026-32746, two critical Telnet flaws released this year.
Cool Tools Series: Reptyr
Jason Taylor brings highlights reptyr in our Cool Tools series, showing how to take a long-running process, like an Nmap scan, and move it to a new screen.
Raxis at RSAC 2026: A Week Well Spent in San Francisco
The Raxis team reflects on RSAC 2026 from organizations looking to secure their systems with pentesting to PTaaS and partners looking to secure their customers.
Five Things to Always Do After Getting Domain Admin
So you got DA on your red team or internal network penetration test. Here are the five things that Principal Penetration Tester Andrew Trexler does next.
BYOVD Attacks and EDR Evasion: Why Your Endpoint Security May Not Be Enough
With Reynolds Ransomware in the wild, Brian Tant dives into BYOVD attacks, how they evade enterprise defense like EDRs, and what your organization can do.
Sponsored Malware: When the Bad Guys Pay for Views
When a Raxis pentester Jason Taylor found a suspicious sponsored search result, he broke down the code it would have run and discovered it was malware.
292 posts, newest first.