Threat landscape
HTTP2Shell: the Brotli flaw reaches far beyond Node.js
HTTP2Shell is not a new flaw but CVE-2026-111497 in any software with a Brotli decoder. Who is affected, and why the version number misleads.
- 5 min read
Insights
Analysis, threat landscape and release notes
Current attacks put into context, guides for decision makers and what is new in the platform.
Our articles are published in German first. English translations follow for selected posts.
More articles
Threat landscape
Node2Shell: why patching Node alone is not enough
Node2Shell exploits a flaw in the Brotli decoder that Node.js bundles. The fix ships in Node 22.23.4, 24.22.1 and 26.12.1 – and in Brotli itself.
- 5 min read
Threat landscape
PHP2Shell: the attacks began four days before the patch
Amazon found the first PHP2Shell exploitation attempt on 17 October 2026, four days before disclosure. That changes the window your investigation must cover.
- 5 min read
Threat landscape
Fortinet hardening release: patching without an advisory
Fortinet shipped critical fixes for FortiOS, FortiManager and FortiAnalyzer on 22 October 2026. The advisories with CVE ids only follow on 10 November.
- 5 min read
Threat landscape
PHP2Shell: the patches are out, the cause was something else
PHP released patches for two critical RCE flaws on 21 October 2026. The cause sits in the PHP core, not in session upload progress.
- 9 min read
Analysis
REA: What AI reverse engineering finds in your applications
With REA, AI agents take apart apps, binaries and firmware without source code. Which keys, interfaces and flaws that exposes, and what helps.
- 4 min read
Threat landscape
Citrix NetScaler: two zero-days, and patching alone is not enough
Two zero-days in Citrix NetScaler ADC and Gateway are under active exploitation: which builds are affected and what to do before and after updating.
- 4 min read
Release notes
Threat Center: From CVE alarm to confirmed exposure
The blacklens.io Threat Center is your early warning system for new vulnerabilities: it shows which CVEs affect your systems and confirms it by scan.
- 3 min read
Guide
NISG 2026: Austria's NIS2 deadlines from 1 October
Austria's NISG 2026 enters into force on 1 October. Which deadlines apply for registration and self-declaration, and what evidence you need to produce them.
- 5 min read
Release notes
What first? Intelligent vulnerability prioritisation with blacklens.io
Vulnerability prioritisation with blacklens.io: the Remediation Plan groups open findings by fix, ranks them by risk reduction and explains every choice.
- 5 min read
Threat landscape
FortiBleed: when tens of thousands of firewalls become an open door
In FortiBleed, attackers hijacked tens of thousands of FortiGate firewalls with leaked credentials and used them to harvest further credentials.
- 3 min read
Analysis
Access Broker Economy: When network access is sold on the dark web
Initial Access Brokers sell access to corporate networks on the dark web to ransomware groups. How this market works and what a listing reveals.
- 2 min read
Threat landscape
Claude Mythos: When vulnerabilities arrive faster than patches
Claude Mythos finds vulnerabilities faster than patches can ship. Why current visibility of exposed systems now decides how much risk you carry.
- 3 min read
Guide
ROI of security investments: measuring and communicating value
How CISOs measure the ROI of security investments with metrics such as MTTD, MTTR and loss avoidance, and explain it to management in business terms.
- 2 min read
Threat landscape
European Commission: cloud breach at Europa.eu
The European Commission has confirmed a cloud breach at Europa.eu. ShinyHunters claims to have stolen over 350 GB, allegedly including DKIM signing keys.
- 3 min read
Analysis
Trust no Origin: the CORS mirage in Azure AKS ingress
A CORS flaw in the Azure Application Routing add-on for AKS accepts malicious origins when they appear before an allowed value in the Origin header.
- 6 min read
Release notes
February release: Active Directory scanning and new integrations
The blacklens.io February release adds Active Directory scanning to Sentry, Cloudflare and Hetzner Cloud connectors and four new tool integrations.
- 2 min read
Release notes
Alert engine: more control, better prioritisation, a clear overview
The new blacklens.io alert engine prioritises alerts across their whole lifecycle and turns them into shared team work, alongside a redesigned dashboard.
- 3 min read
Guide
Dark Web Monitoring: an indispensable tool against cyber threats
Dark Web Monitoring shows which stolen credentials and identities of your company are traded on darknet black markets before attackers can put them to use.
- 4 min read
Threat landscape
Cisco zero-day: the email gateway as an entry point
The Cisco zero-day CVE-2025-20393 in AsyncOS turns email security appliances into an entry point: attackers run code as root without authenticating.
- 3 min read
Threat landscape
Operation Endgame: Europe's biggest takedown
Operation Endgame took down more than 1,025 Rhadamanthys, VenomRAT and Elysium servers in November 2025. Why stolen credentials are still in circulation.
- 4 min read
Analysis
Browser sync: synchronised, compromised, lost
Browser sync carries company passwords, cookies and sessions onto personal devices, where infostealers harvest them. Here is how companies close the gap.
- 3 min read
Guide
Pentest vs. bug bounty: structure or hope
Pentest or bug bounty? Why structured penetration tests deliver the predictability, solid evidence and compliance that bug bounty programmes cannot.
- 3 min read
Threat landscape
Supply chain shock: CrowdStrike npm packages compromised
Compromised CrowdStrike npm packages ship a malicious bundle.js that steals secrets and uses GitHub Actions to gain a lasting foothold in repositories.
- 4 min read
Threat landscape
The biggest attack on the npm supply chain
The biggest attack on the npm supply chain hit chalk, debug and other packages with over 2 billion weekly downloads. Here is how to check if you are affected.
- 5 min read
Guide
Unified cloud vulnerability scanning for NIS2 compliance
Unified cloud vulnerability scanning checks AWS, Azure, Google Cloud and Entra ID in one place and produces the evidence that NIS2 requires.
- 8 min read
Guide
Cyber insurance: The checklist to get you ready
A cyber insurance checklist: which security requirements insurers check before granting cover and which questions you should ask your insurer.
- 3 min read
Guide
Visibility and security: Protecting your cloud infrastructure
Protecting cloud infrastructure: how to connect Azure, AWS and Google Cloud to blacklens.io, detect misconfigurations and check new resources automatically.
- 2 min read
Guide
How Pentesting as a Service (PTaaS) is changing IT security
Pentesting as a Service (PTaaS) turns penetration testing into an ongoing service. The advantages over traditional, project-based pentests at a glance.
- 3 min read
Guide
Proactive protection against ransom threats in your supply chain
Ransom threats in the supply chain: blacklens.io monitors the domains of your suppliers and service providers for ransomware threats and warns you early.
- 2 min read
Release notes
Blacklens Query Language (BQL): efficient data search made easy
The Blacklens Query Language (BQL) filters every table view in blacklens.io by query, with autocomplete as you type and a query builder that needs no syntax.
- 1 min read
Analysis
Consent phishing: an underestimated risk and how to protect yourself
Consent phishing uses OAuth consent to gain access to mailboxes and data without asking for a password, sidestepping password changes and two-factor login.
- 2 min read
Guide
Why internal vulnerability scanning must cover your entire IT
Internal vulnerability scanning has to cover switches, printers and IoT devices as well as servers, because these devices are often the overlooked entry points.
- 3 min read
Release notes
Dark Web Monitoring: cookies, AI analysis and leak classification
blacklens.io Dark Web Monitoring detects stolen session cookies, assesses them with AI and automatically assigns leaks to employees or customers.
- 2 min read
What does your attack surface look like?
The free exposure check shows within seconds which systems and dark web traces of your company are publicly visible.
- 14 days free, all features
- No credit card required
- We walk you through your first findings