Prompt injection
3 posts
20 min read
PHP2Shell: why a WAF alone won't stop this PHP RCE
PHP2Shell (CVE-2026-109618, CVE-2026-109619) is fixed in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Why a proxy alone fails, and how AI agents widen the gap.
- Vulnerability management
- LLM security
- AI agents
29 min read
The agentic SOC is real, and your logs are now prompts: how AI security monitoring actually works, and where it breaks
Microsoft, Google and CrowdStrike now ship autonomous agents that triage alerts in real time with no analyst in the loop. What agentic SOC tooling actually does, the research showing attackers can prompt-inject it through ordinary log fields, and the control set that holds under APRA scrutiny.
- AI agents
- Detection engineering
- SOC
15 min read
Jailbroken AI as an attack tool: how attackers actually use it, and how to defend
Attackers jailbreak frontier models, rent dark LLMs like WormGPT, and bolt AI onto phishing, deepfake fraud, and agentic intrusions. The documented tradecraft, the real incidents, and the defence-in-depth controls that hold, with Rust guardrail code.
- AI agents
- Jailbreaking
- Prompt injection
Get started
Talk to the security lead who would do the work.
A thirty-minute discovery call costs nothing. We confirm fit, scope, and timing, then issue a fixed-fee statement of work within two business days.