Robotic Process Automation (RPA) for penetration testing

Our offensive security research team found two authentication flaws in phpBB, one of the most widely deployed forum platforms on the web. Detection for both is now live in the Network Scanner.

PTT-2026-004 is a critical, unauthenticated authentication bypass (CVSS 9.4). One HTTP request with a target username and a wrong password phpBB never checks returns a valid session cookie for that account, admins included. It works on every default install up to and including phpBB 3.3.16, with no prior access needed. The vulnerable code path sat in the codebase for over a decade, surviving multiple major releases and security reviews.

PTT-2026-005 is a high-severity OAuth account takeover (CVSS 8.3). It chains two OAuth defects for a silent takeover on boards with OAuth configured. In some cases the victim doesn't click anything: an image tag embedded in a forum post is enough to trigger it.

Why it matters

A bypass that hands an attacker an admin session on a default install means full control of the board, its users, and whatever sits behind it. phpBB runs on countless community and corporate forums, so a single exposed instance is a foothold with real blast radius. We reported both to phpBB on June 4, 2026, and a fix shipped two days later in phpBB 3.3.17.

How to use

Detect with the Network Scanner → patch to phpBB 3.3.17 → re-scan to confirm the fix is in place and rule out residual exposure across multiple assets.

If the board has OAuth configured, audit the oauth_accounts table for unexpected entries after upgrading. A successful PTT-2026-005 exploit leaves a record there.

👉 Read the research 👈

A critical, unauthenticated, remote code execution vulnerability in NGINX.

Why it matters

RCE on an unpatched NGINX instance is a short trip to a very bad day. NGINX sits everywhere it counts: reverse proxies, load balancers, and front-line web servers, so a single exposed instance can hand an attacker a foothold into the systems behind it. Our detection is evidence-based: confirmation comes from the server's actual response, not a banner check.

How to use

Detect with the Network Scanner → validate the risk with a one-click proof-of-concept in Sniper → re-scan to confirm remediation and rule out residual exposure across multiple assets.

You're a quick scan away from being the one who finds it, not the one who gets the call at 2am because someone else did.

👉 Scan for CVE-2026-42945 👈

As always, if Sniper can exploit it, our Network Scanner can detect it.

If you manage large accounts, you've felt the wait. Loading a Findings page packed with hundreds of thousands of results meant watching a spinner long enough to lose your train of thought.

We've added a composite index to the findings table, and the difference is hard to overstate.

Why it matters

On accounts with over 900K findings, load times dropped from 17–43 seconds to 300–600 milliseconds. On the largest accounts, over 4 million findings, that's a fall from up to 111 seconds down to about 1.4 seconds. Faster pages mean faster triage, and faster triage means you spend your time on the findings that matter instead of waiting to see them.

How to use

The improvement is automatic. No configuration, no setup. The next time you log in, open the Findings page and put it to the test.

👉 Go to the Findings page 👈

CVE-2026-41940 is a CVSS 9.8 authentication bypass in cPanel & WHM, added to CISA's Known Exploited Vulnerabilities catalog and actively exploited in the wild for 64 days before any patch or advisory existed. No credentials. No user interaction. Full server access.

The Network Vulnerability Scanner detects it by sending a crafted CRLF payload to the login endpoint and assessing exploitability from the actual server response. Version banners won't tell you if your target is genuinely at risk. This will.

IT Security Guru covered the scanner release during active exploitation. If your targets were internet-accessible between February 23 and April 28 without port restrictions, treat them as compromised until confirmed otherwise.

Scan for CVE-2026-41940

Two new data points are now visible on every XSS Exploiter callback:

• IP address: see exactly which IP the callback came from. Confirms whether it originated from the target's browser, a bot, or an unintended third party.

• Request headers: now visible alongside cookies, page content, screenshots, and keystrokes. Session tokens, authentication cookies, and custom app headers, all at callback time.

Both surface directly in tool results. Two common validation gaps, closed without leaving the product.

Use it to see callbacks

The Website Scanner now detects private keys exposed in HTTP responses. The check runs passively - no configuration required, no extra setup.

RSA, EC, and other common formats are included. If a private key is leaking from your target, this surfaces it. An attacker with that key has full access to whatever server infrastructure it belongs to. These findings get missed in manual testing because the response looks like noise until you look closely.

Useful for external pentests and internal security reviews of web application infrastructure.

Run a web scan