https://clicksecure.ai/blog Penetration testing, AI/LLM security, NIS 2 & DORA, and human risk. en https://clicksecure.ai/blog/nginx-cve-2026-42533-regex-map-rce https://clicksecure.ai/blog/nginx-cve-2026-42533-regex-map-rce Mon, 20 Jul 2026 09:00:00 GMT Nginx sits in front of a very large share of the world's web applications — as reverse proxy, load balancer or ingress controller. That is exactly why CVE-2026-42533, patched by F5 on July 15, deserves a spot at the top of this week's patching list: a remote, unauthenticated attacker can trigger a heap buffer overflow in the nginx worker process using nothing but crafted HTTP requests. #penetrationtesting #nginx #vulnerability #patchmanagement #NIS2 https://clicksecure.ai/blog/nginx-cve-2026-42533-regex-map-rce penetration testing nginx vulnerability patch management NIS 2 https://clicksecure.ai/blog/wp2shell-wordpress-core-rce https://clicksecure.ai/blog/wp2shell-wordpress-core-rce Sun, 19 Jul 2026 09:00:00 GMT Most WordPress security advice fits in one sentence: keep your plugins updated, because that is where the bugs live. wp2shell breaks that model. The vulnerability chain, found by Adam Kues of Assetnote (Searchlight Cyber) and patched on July 17 in WordPress 6.9.5 and 7.0.2, sits in WordPress core. A bare install with zero plugins is exploitable, and the researchers describe the attack as having "no preconditions" — an anonymous HTTP request ends in code execution on the server. #penetrationtesting #WordPress #websecurity #remotecodeexecution #patchmanagement https://clicksecure.ai/blog/wp2shell-wordpress-core-rce penetration testing WordPress web security remote code execution patch management https://clicksecure.ai/blog/does-nis2-require-penetration-testing https://clicksecure.ai/blog/does-nis2-require-penetration-testing Tue, 14 Jul 2026 09:00:00 GMT It is one of the most common questions we get from CISOs and IT managers preparing for NIS 2: does the directive actually require a penetration test? The short answer is that NIS 2 never uses the word "penetration testing" — but for most in-scope organizations, a pentest is the most practical, defensible way to satisfy what Article 21 does require. #NIS2 #penetrationtesting #compliance #DORA https://clicksecure.ai/blog/does-nis2-require-penetration-testing NIS 2 penetration testing compliance DORA https://clicksecure.ai/blog/owasp-api-top-10-pentest-findings https://clicksecure.ai/blog/owasp-api-top-10-pentest-findings Tue, 14 Jul 2026 09:00:00 GMT APIs are where modern applications actually live. The browser is just a thin shell; the real logic, data and authorization decisions sit behind a growing surface of REST and GraphQL endpoints. That is also where we find the most impactful bugs during penetration tests. The OWASP API Security Top 10 (2023 edition) is a good map of the terrain, and after enough engagements the same handful of categories keep coming back. #penetrationtesting #APIsecurity #OWASP #NET #RCE https://clicksecure.ai/blog/owasp-api-top-10-pentest-findings penetration testing API security OWASP .NET RCE https://clicksecure.ai/blog/device-code-phishing-mfa-bypass https://clicksecure.ai/blog/device-code-phishing-mfa-bypass Fri, 10 Jul 2026 09:00:00 GMT Most phishing training teaches one lesson: check the URL before you type your password. Device code phishing wins precisely because the victim never types a password on a fake site. There is no lookalike login page to spot, and multi-factor authentication does not help. That is why it has quietly become one of the defining attack techniques of 2026. #phishing #MFA #humanrisk #identity #awareness https://clicksecure.ai/blog/device-code-phishing-mfa-bypass phishing MFA human risk identity awareness https://clicksecure.ai/blog/poisoned-ai-skills-supply-chain https://clicksecure.ai/blog/poisoned-ai-skills-supply-chain Thu, 09 Jul 2026 09:00:00 GMT Supply chain attacks used to mean poisoned npm packages and typosquatted Python libraries. In mid-2026, two campaigns showed the same playbook moving to two new targets: the skills your AI agents install, and the proof-of-concept code your security team downloads. #supplychainsecurity #AIsecurity #malware #developers #agentskills https://clicksecure.ai/blog/poisoned-ai-skills-supply-chain supply chain security AI security malware developers agent skills https://clicksecure.ai/blog/ai-agent-identity-governance https://clicksecure.ai/blog/ai-agent-identity-governance Wed, 08 Jul 2026 09:00:00 GMT Every identity system your company runs — Active Directory, your IdP, your access reviews — rests on one quiet assumption: behind every account there is a human being whose status changes through HR events. Someone is hired, an account is provisioned. Someone changes roles, access is adjusted. Someone leaves, access is revoked. #AIsecurity #identity #IAM #nonhumanidentities #governance https://clicksecure.ai/blog/ai-agent-identity-governance AI security identity IAM non-human identities governance https://clicksecure.ai/blog/ai-browser-prompt-injection https://clicksecure.ai/blog/ai-browser-prompt-injection Tue, 07 Jul 2026 09:00:00 GMT AI browsers — Chrome-like products where an agent clicks, reads and fills forms for you — are moving into companies fast, often through employees who simply install them. Two pieces of research published in June 2026 show why security teams need a position on them now, not later. #AIsecurity #promptinjection #agenticAI #browsersecurity #LLM https://clicksecure.ai/blog/ai-browser-prompt-injection AI security prompt injection agentic AI browser security LLM https://clicksecure.ai/blog/fortibleed-edge-devices https://clicksecure.ai/blog/fortibleed-edge-devices Tue, 07 Jul 2026 09:00:00 GMT For years the mental model was simple: the firewall protects the network. In 2026 the model needs an update, because the firewall — and every other internet-facing appliance — is increasingly the thing being attacked. #networksecurity #ransomware #FortiGate #credentialtheft #incidentresponse https://clicksecure.ai/blog/fortibleed-edge-devices network security ransomware FortiGate credential theft incident response https://clicksecure.ai/blog/jadepuffer-ai-ransomware-patching https://clicksecure.ai/blog/jadepuffer-ai-ransomware-patching Tue, 07 Jul 2026 09:00:00 GMT On July 1, 2026, the Sysdig Threat Research Team published its analysis of what it assesses to be the first documented case of agentic ransomware — a complete extortion operation driven from start to finish by a large language model, with no human at the keyboard. The team named the operator JADEPUFFER. The techniques it used were not new or clever. What is new is that a machine strung them together into a full attack against a neglected, internet-facing server, on its own. #ransomware #AI #vulnerabilitymanagement #patching #NIS2 https://clicksecure.ai/blog/jadepuffer-ai-ransomware-patching ransomware AI vulnerability management patching NIS 2 https://clicksecure.ai/blog/ai-identity-consent-registry https://clicksecure.ai/blog/ai-identity-consent-registry Fri, 03 Jul 2026 09:00:00 GMT The debate about artificial intelligence has shifted. For a while the question was "what can AI create?" Increasingly it is "whose name, face, voice and work was used to create it — and did they agree?" In June 2026, that question got a concrete answer for individuals: the Human Consent Registry, a free tool to tell AI systems how — or whether — they may use your identity. #AIsecurity #LLM #dataprotection #consent #EUAIAct https://clicksecure.ai/blog/ai-identity-consent-registry AI security LLM data protection consent EU AI Act https://clicksecure.ai/blog/nis2-dora-readiness https://clicksecure.ai/blog/nis2-dora-readiness Mon, 29 Jun 2026 09:00:00 GMT Two EU frameworks are reshaping how organizations are expected to manage cyber risk: NIS 2 (Directive (EU) 2022/2555) and DORA (Regulation (EU) 2022/2554). They apply to different populations — NIS 2 to a broad set of essential and important entities across many sectors, DORA to financial entities and their ICT providers — but they pull in the same direction: measurable security measures, fast incident reporting, supply-chain scrutiny, and personal accountability for management. #NIS2 #DORA #compliance #operationalresilience https://clicksecure.ai/blog/nis2-dora-readiness NIS 2 DORA compliance operational resilience https://clicksecure.ai/blog/human-risk https://clicksecure.ai/blog/human-risk Sat, 27 Jun 2026 09:00:00 GMT For two decades, most security budgets flowed toward technical controls: firewalls, endpoint agents, segmentation, patching. Those controls still matter. But the dominant way into a modern organization is no longer an unpatched server — it is a person. When an employee clicks a crafted link, approves a fraudulent invoice, or reuses a password, the most expensive perimeter in the world is bypassed in seconds. #NIS2 #humanrisk #securityawareness #phishing #DORA https://clicksecure.ai/blog/human-risk NIS 2 human risk security awareness phishing DORA https://clicksecure.ai/blog/pentest-vs-vulnerability-assessment https://clicksecure.ai/blog/pentest-vs-vulnerability-assessment Thu, 25 Jun 2026 09:00:00 GMT "Pentest" and "vulnerability assessment" are used interchangeably far too often. They are different tools for different jobs. #penetrationtesting #vulnerabilityassessment https://clicksecure.ai/blog/pentest-vs-vulnerability-assessment penetration testing vulnerability assessment https://clicksecure.ai/blog/nis2-readiness-checklist https://clicksecure.ai/blog/nis2-readiness-checklist Sat, 20 Jun 2026 09:00:00 GMT NIS 2 raises the bar for cybersecurity across a much wider range of organizations than its predecessor. If you are not sure where you stand, this short checklist is a good place to start. #NIS2 #compliance #DORA https://clicksecure.ai/blog/nis2-readiness-checklist NIS 2 compliance DORA