Resources
Articles from the IntruForce team on external attack surfaces, exposed data and practical remediation.
In four weeks, attackers changed fridge settings in European supermarkets, reached a blood service through its supplier, wiped a hosting provider's cloud and broke into firewalls. What the cases share and what to check.
Read the article →OpenVAS and Nuclei are free and can detect known flaws on the systems you include in a scan. What work stays with your team, when they are enough, and when to look at a platform.
Read the article →In 2026 more than twice as many vulnerabilities have been published as a year earlier, and about half of the new ones attackers use are confirmed within a week. Why a company should check its internet-facing systems regularly, not once a year.
Read the article →Between 17 and 22 October 2026, PHP, Laravel, Node.js, GitLab and the certificate authority eMudhra all needed fixes. Our view: before asking which flaw is worst, find out where you run each product.
Read the article →W3Techs counts PHP on 69.3% of the websites whose server-side language it can identify. On 21 October 2026 PHP fixed two critical flaws in PHP itself. Updating is the fix; the harder part is knowing every PHP site you run.
Read the article →A domain one letter away from yours can host a fake login page or send invoices in your name, and it may belong to a third party, outside the scope of your existing monitoring. How typosquatting works, why DMARC does not stop it, and what to do when you find one.
Read the article →An infostealer steals data from an infected device — saved passwords, the session cookies that keep a person signed in, payment details — sometimes on a computer the company does not manage, and the result ends up in logs that others buy and reuse. How it happens, what it gives an attacker and what reduces the damage.
Read the article →What a hands-on test of a web application covers that a scanner alone cannot judge — access control, business logic, sessions and the APIs behind the screens — and how to scope one.
Read the article →What a penetration test is, which types exist, how to scope one, and what the report you receive at the end should contain. A guide for the person who commissions the test.
Read the article →A vulnerability scan checks your systems for known weaknesses; a penetration test checks whether those weaknesses can be exploited within an agreed scope. What each one answers, where each one stops, and how to tell which one you need.
Read the article →CISA added CVE-2023-49105 to the Known Exploited Vulnerabilities catalog: an authentication bypass in the ownCloud WebDAV API involving pre-signed URLs. Here is how to check whether your own perimeter exposes an affected instance, and where the patching chain usually breaks.
Read the article →CVE-2026-59310 in VMware vCenter Server entered the CISA KEV catalog on 18 August 2026. This article separates two questions that often get merged — whether the defect is present, and whether the management interface is reachable from outside — and shows how to check the second one.
Read the article →CVE-2024-21762 has been in the CISA KEV catalog as actively exploited since February 2024. The vendor advisory could not be read during this research, so this note keeps strictly to what the primary records state — including why the usual “RCE via SSL-VPN” phrasing stays unconfirmed.
Read the article →In February 2025 Palo Alto Networks reported observed attempts to chain CVE-2025-0108, CVE-2025-0111 and CVE-2024-9474 against PAN-OS devices whose web management interface was reachable from untrusted networks. What decides exposure is the release train in use and where the management profile is bound.
Read the article →CVE-2026-60004 is in the CISA KEV catalog and Gitea has published an advisory. The external check is concrete: find Gitea instances that answer from the internet, establish their actual versions, and compare them with the affected ranges.
Read the article →The scope listed three domains and two IP addresses. Two hours in, that list no longer matched what was reachable from the internet. How an external test reconciles the declared perimeter with the real one — and where the tester's authority ends.
Read the article →A penetration test describes the perimeter as it was on the day of the test, while domains, IP addresses and services keep appearing between audits. What continuous observation of the external perimeter covers, and what only expert-led testing can find.
Read the article →Two vulnerabilities, one maintenance window. NIS2 does not say that an exploited vulnerability is fixed first — it asks you to connect the remediation decision to the risk to your own services, and to be able to show that reasoning.
Read the article →DORA testing gives an accurate picture on the date it was run; the external perimeter keeps changing after that date. What each control shows, where they overlap, and what neither of them decides.
Read the article →Cisco confirmed exploitation of the CVE-2023-20198 and CVE-2023-20273 chain in the IOS XE Web UI. The check starts with two questions: where the Web UI is enabled, and where it is reachable from outside — with the commands, versions and indicators to record for each device.
Read the article →CVE-2024-12356 is listed in the CISA KEV catalog, and BeyondTrust fixed its own cloud instances. For on-premise Privileged Remote Access and Remote Support, the decision has to be made instance by instance: hosting model, version, BT24-10 state and external reachability.
Read the article →Two Ivanti vulnerabilities that looked manageable on their own formed a working chain from the internet to command execution on the VPN gateway. A walkthrough of the chain, and of the points where it could have been broken.
Read the article →An authentication bypass in self-hosted ConnectWise ScreenConnect gave administrative control of a central RMM component. The chain, its limits, and the checks that could have caught it earlier.
Read the article →A new public host or cloud endpoint can appear between two scheduled inventories. What DORA asks financial entities to do about it, and where external perimeter monitoring stops and internal process begins.
Read the article →Get started
Discover your external assets, identify security weaknesses and check for exposed corporate credentials with a free SeguriScan pilot. Get access to the platform, findings and reports to understand what needs attention.