Ostorlab (@OstorlabSec) header
Ostorlab (@OstorlabSec) profile picture

Ostorlab

@OstorlabSec

Security testing for mobile, web, APIs and code. Agentic Deep Scan backs each confirmed finding with a working exploit.

 Delaware, USA
ostorlab.co
Joined April 2015
  • Tweets595
  • Following1.1K
  • Followers559
280Media
Photo by Ostorlab (@OstorlabSec)Photo by Ostorlab (@OstorlabSec)Photo by Ostorlab (@OstorlabSec)Photo by Ostorlab (@OstorlabSec)Photo by Ostorlab (@OstorlabSec)Photo by Ostorlab (@OstorlabSec)Photo by Ostorlab (@OstorlabSec)Photo by Ostorlab (@OstorlabSec)Photo by Ostorlab (@OstorlabSec)Photo by Ostorlab (@OstorlabSec)
🚀 We’re launching Agentic Deep Scan Our next-generation vulnerability scanner for web, APIs, and mobile apps (iOS, Android, soon HarmonyOS). We’re the first and only platform delivering deep agentic scanning for mobile, while also covering web & APIs, helping security teams go beyond traditional scans with greater confidence and control.
1
6
1
13
1,093
Metabase's password reset was meant to check a token. It ran the attacker's SQL first. One extra field was enough to become admin and reach every database Metabase is connected to. No login needed. CVE-2026-72898 was exploited as a zero-day.
Image from Ostorlab (@OstorlabSec)
1
1
1
159
more replies
Image from Ostorlab (@OstorlabSec)
1
12
JPCERT/CC lists attacks on Metabase among the methods behind Japan's recent wave of breaches. Fixed versions, indicators of compromise and the full technical breakdown are in The Breach Brief: substack.com/home/post/p-221…
Image from Ostorlab (@OstorlabSec)
35
New Breach Brief is out ! Japan's breaches got serious enough to be called an emergency. Sourcenext, Burger King Japan and Studio disclosed breaches within days. Inside: ShopServe, where even stores tha were affected. Full Issue: ostorlab.substack.com/p/japa…
🤖 Made with AI
Image from Ostorlab (@OstorlabSec)
2
2
71
New in Ostorlab Threat Center: detection for PHP2Shell (CVE-2026-109618, CVE-2026-109619). Ostorlab scans flag web servers that report an affected PHP version, without sending any exploit. If you're affected, update to the 21 October PHP release.
Image from Ostorlab (@OstorlabSec)
1
3
3
366
Run a scan to check your servers: report.ostorlab.co/scan/new
1
20
Every security team has tickets that matter but never get picked up. Ticket Agents take them on. Give one a job in plain words, and it picks up matching tickets and opens a PR for your engineers to review. Watch one find out why a server hit 100% CPU. Setup guide below 👇
1
3
46
Easy tickets shouldn't wait for days while your engineers handle the hard ones. We built an AI agent for our own backlog. It picks up a ticket, writes the fix and opens a PR for review. Now you can set one up in Ostorlab.
Image from Ostorlab (@OstorlabSec)
1
1
3
82
more replies
Image from Ostorlab (@OstorlabSec)
1
7
Full guide: blog.ostorlab.co/ticket-agen…
Image from Ostorlab (@OstorlabSec)
8
A critical alert is easy to serve. The PoC is where the real work begins. This week’s Breach Brief: 1,458 successful PoCs, BragJack, herdr, a convincing GitHub phish and Daniel Miessler as Person of the Week. Would you like a PoC with that? 👇 linkedin.com/pulse/would-you…
Image from Ostorlab (@OstorlabSec)
1
1
73
A vulnerability can be fixed in public source code and still remain a zero-day for users. Our carousel breaks down how BlueMoon exploited that patch gap and chained three vulnerabilities across V8, Chrome and Windows. #ZeroDay #BlueMoon
Image from Ostorlab (@OstorlabSec)
1
84
more replies
Image from Ostorlab (@OstorlabSec)
1
14
Read the full technical research for the complete BlueMoon exploit chain, campaign details and indicators of compromise: ostorlab.substack.com/p/agen…
Image from Ostorlab (@OstorlabSec)
25
Load more