The Exploit Blog

Penetration Testing Blog

Offensive security, written by the professionals who live it.

Real attacks, real writeups. The Exploit is written by Raxis penetration testers. We provide technical breakdowns of exploits, CVEs we’ve discovered, and the offensive techniques showing up in current engagements.

  • Raxis at Black Hat 2026: Come Find Us at Booth 6018

    Raxis at Black Hat USA 2026: Come Find Us at Booth 6018

    Raxis will be at Black Hat USA 2026 August 4–6 at Mandalay Bay Convention Center in Las Vegas. Find us at booth 6018.
    ,
    Brad Herring
    July 22, 2026
    Read More
  • Why We Take AI Security Training Seriously at Raxis

    AI-Augmented Series: Why We Take AI Security Training Seriously at Raxis

    Raxis CTO Brian Tant discusses the AI portion of our annual security awareness training and how we take AI security seriously.
    , , , ,
    Brian Tant
    July 14, 2026
    Read More
  • Meet the Pets of Raxis

    Meet the Pets of Raxis

    The Raxis team is serious about cybersecurity and exploits, but today we’re taking a break from that to show off our pets.
    ,
    Bonnie Smyre
    July 8, 2026
    Read More
  • usbliter8 - Apple A12 and A13 SecureROM Exploit

    usbliter8 – Apple A12 and A13 SecureROM Exploit

    The usbliter8 SecureROM exploit is big news for jailbreaking iPhones. This hardware vulnerability cannot be fixed with a software update.
    , ,
    Jason Taylor
    July 3, 2026
    Read More
  • PSE & Red Team Series: Looting

    PSE & Red Team Series: Looting

    Nathan Anderson continues his Physical Social Engineering and Red Team series with the final step: looting. Learn what shows value to stakeholders in reports.
    , ,
    Nathan Anderson
    June 30, 2026
    Read More
  • RoguePlanet: the Defender Zero-day that Survived Microsoft’s June Patch

    RoguePlanet: The Defender Zero-day that Survived Microsoft’s June Patch

    The new critical Microsoft Defender exploit, RoguePlanet (CVE-2026-50656), is confirmed active in the wild. Learn what it is and how to protect your network.
    , , , ,
    Ryan Chaplin
    June 22, 2026
    Read More
  • Building Security Tools from Source to Bypass Endpoint Security

    Building Security Tools from Source to Bypass Endpoint Security

    Endpoint security detects many malicious files created with pentest tools, but pentesters can sometimes bypass this by rebuilding source code. Learn how here.
    , ,
    Jason Taylor
    June 16, 2026
    Read More
  • The Game is Starting: Release the Fraudsters

    The Game is Starting: Release the Fraudsters

    Large tournaments bring out fraudsters just as your employees’ guard is down. Raxis CTO Brian Tant discusses recent threats and how to protect your company.
    , , ,
    Brian Tant
    June 10, 2026
    Read More
  • Cool Tools: Bloodhound CE

    Cool Tools: Bloodhound CE

    BloodHound’s Community Edition has everything a penetration tester needs to enumerate relationships in a domain in order to gain more access, even Domain Admin.
    , , , ,
    Andrew Trexler
    June 2, 2026
    Read More
  • CVE-2026-36748: XSS in Rock RMS Leads to Privilege Escalation

    CVE-2026-36748: XSS in Rock RMS Leads to Privilege Escalation

    Raxis Lead Pentester Jason Taylor recently discovered CVE-2026-36748, a high-risk XSS vulnerability in Rock RMS that allows privilege escalation to admin.
    , , ,
    Jason Taylor
    June 1, 2026
    Read More