I've been working as a pentester for about two years (initially part-time, then switched to full-time), and lately I've started feeling burned out and losing interest in studying because of how int...

arXiv:2609.29126 · cs.CR

Un honeypot Livewire qui piège un pentester, Pest 5.1 qui ne rejoue que l'utile, Difflock qui relit vos migrations, et Laravel 13.33 qui calme la prod — l'actu qui donne envie de coder.

A Livewire honeypot trapping a pentester, Pest 5.1 replaying only what matters, Difflock re-reading your migrations, and Laravel 13.33 calming prod down — the news that makes you want to code.

impacket-tstool uses MSRPC to remotely enumerate, control, disconnect, log off, reboot, and even hijack Windows Terminal Services sessions without dropping a binary or opening an RDP client. It also supports passwordless authentication methods like Pass-the-Hash, Pass-the-Key, and Pass-the-Ticket, making it a stealthy post-exploitation tool against systems such as the DC1 domain controller in ignite.local. #impacket-tstool #TerminalServices #DC1 #ignite.local #tscon #qwinsta

Shannon is an autonomous, white-box AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes real exploits to prove vulnerabilities before they reach production.

This article gives a succinct overview of seven in-demand job roles in IT and cybersecurity. Key job responsibilities, skills, and certifications for the following IT and cybersecurity roles are cover...

OpenAI shares findings from the Hugging Face security incident and the steps we’re taking to strengthen AI model security, monitoring, and alignment.

Keygraph released Shannon 3.0, an open-source AI pentester for web apps and APIs. It analyses code, validates findings only through live exploits, adds CI/CD support, resumable scans, and reports with evidence under AGPL-3.0.

Keygraph has released Shannon 3.0, the third major version of its open-source AI pentester for web applications and APIs. Shannon is a CLI agent that reads an application's source code, works out where it is likely to break, then attacks the running app with real exploits. Anything it cannot demonstrate against the live target gets discarded, a rule the project states as no exploit, no report. It is out now under AGPL-3.0, run locally through npx or from source. 0:00 /0:10 1× The headline change is a multi-stage security code analysis pipeline, adapted from the open-source Mantis security review skills. It runs alongside the recon and vulnerability agents, first building its own picture of the application: components, interfaces, dependencies, data flows, trust boundaries, and high-value assets. Agents then follow attacker-controlled data from entry point to sensitive operation, and the candidates they produce are deduplicated, challenged by a review agent, checked for production viability, and confirmed against their code paths before entering the exploitation queue. The pass is opt-in through a config flag, and a code analysis hypothesis never becomes a finding on its own. Keygraph published its own comparison. Doyensec, in an Aikido-sponsored study, had run Aikido and XBOW against two self-hosted apps. Keygraph ran Shannon 3.0 against one of them, Photoview 2.4.0, on a matching deployment with three models, and scored the results itself. DeepSeek v4 Flash reported 18 findings for $6.10, Grok 4.6 reported 10 for $35.07, and Opus 5 reported 24 for $115 with one false positive. All three runs flagged the critical pre-auth SQL injection Photoview has since patched, and the Opus run caught six of the seven issues fixed in that round. Doyensec listed 32 validated findings for Aikido and 7 for XBOW, at $4,000 per scan each. Version 3.0 also rebuilds the CLI so scan status, phase progress, and per-agent logs read in the terminal, and checkpoints progress into named workspaces so interrupted runs resume where they stopped. An official GitHub Action and a GitLab CI/CD component run the same scan inside a pipeline, keep reports and logs as artifacts, and can fail a build on proven vulnerabilities above a chosen severity. Reports come out as PDF and Markdown with evidence attached, plus SARIF 2.1.0 for GitHub code scanning. Shannon runs self-hosted on operator-supplied models, across Anthropic, OpenAI, xAI, Bedrock, and local runtimes. SPONSORED Check out the official repo Learn more Keygraph is the San Francisco company behind Shannon, founded in 2024 by Varun Sivamani, previously engineering lead for HRIS and payroll at Lattice, and backed by Pear VC and Authentic Ventures. The project passed 47,000 GitHub stars before this release and is named after Claude Shannon. Keygraph also sells a commercial platform that runs an extended build of the same agent continuously. Shannon Open Source is pitched as a complete pentester in its own lane, aimed at developers and small teams testing staging environments they own.

Keygraph released Shannon 3.0, an open-source AI pentester that maps app architecture in source before exploiting the live app.

A user is asking for opinions on their learning path to become a pentester. They are considering taking Cyber Security 101 first, then following the complete Pentester Roadmap through to Red Teaming, all within the TryHackMe platform.

Are big companies still hiring penetration testers? I feel like penetration testing jobs barely exist at big companies anymore. Most of the openings I see seem to be at small startups or small secu...