Insights, guides, and news from the TigerStrike security team.
A plain-English explainer of CERT-In audit scope, the empanelled auditor model, 2022 directions, and what government, CII, BFSI, listed companies, and pre-IPO firms need to prepare.
Oct 27, 2026
The CA trust-chain exposure from the eMudhra incident, where eMudhra-issued certificates live in your stack, the 24-hour playbook, and the longer-term CA diversification programme Indian BFSI and government should run.
Oct 25, 2026
Prototype pollution to RCE, insecure deserialisation, template injection (Handlebars/Pug/EJS), child_process abuse, malicious npm packages, and VM sandbox escapes — the modern Node.js attack-chain reference.
Oct 23, 2026
A pair of use-after-free bugs in PHP's fatal-error handling, disclosed by Wiz Research on 21 Oct 2026. Chains to unauthenticated RCE on WordPress, Drupal and Joomla running PHP 5.4+. CVSS 9.2. Pentester walkthrough, detection, remediation.
Oct 21, 2026
Why annual pen testing no longer satisfies SOC 2 Type 2, PCI DSS 11.4, ISO 27001 surveillance, HIPAA 164.308(a)(8), or CERT-In — and what continuous programmes replace them with.
Oct 15, 2026
A deep technical guide to file upload vulnerabilities — unrestricted upload, extension and MIME bypass, content-type confusion, polyglots, and defensive controls for secure file handling.
Oct 2, 2026
How misconfigured name servers leak the entire DNS zone — detection with dig/nslookup, exploitation workflows, compliance framing, and defensive configuration for BIND and PowerDNS.
Sep 18, 2026
A practical guide to penetration testing for startups — scope framing, affordable options, SOC 2 and HIPAA drivers, agile CI/CD integration, and a pre-seed to Series C progression.
Sep 4, 2026
A detailed comparison of HackerOne alternatives — Cobalt, Bugcrowd, Pentera, Rapid7, Intruder, Astra — and why AI-powered autonomous pentesting is reshaping the category.
Aug 21, 2026
How VAPT evidence supports GDPR Article 32 'appropriate technical measures' — from DPIA input to enforcement defense and processor obligations.
Aug 10, 2026
A comparative analysis of AWS, Azure, and GCP attack surface — IAM models, metadata endpoints, container platforms, and cross-cloud lateral movement.
Aug 5, 2026
RBI Master Direction VAPT requirements for banks, NBFCs, payment aggregators, and payment gateways — scope, methodology, and SAR reporting.
Jul 30, 2026
Why business associates increasingly need VAPT evidence for BAA compliance, and what covered entities look for in vendor security assessments.
Jul 22, 2026
Azure-specific attack paths: managed identity abuse, subscription escalation, Azure AD misconfigurations, and Key Vault exposure.
Jul 15, 2026
How to validate network segmentation as PCI DSS Requirement 11.4.5 evidence and defensibly reduce cardholder data environment scope.
Jul 2, 2026
What certification body auditors look for in VAPT evidence for ISO 27001:2022 — Annex A control mapping, coverage documentation, and remediation tracking.
Jun 25, 2026
GraphQL-specific VAPT techniques: introspection abuse, query complexity attacks, batching, nested query DoS, and field-level authorization testing.
Jun 18, 2026
How attackers move from initial pod compromise to cluster admin — RBAC misconfigurations, service account abuse, and container breakout techniques.
Jun 4, 2026
Real-world AD attack chains — Kerberoasting, AS-REP roasting, ADCS abuse, DCSync, and Golden Ticket generation that consistently succeed in enterprise networks.
May 20, 2026
PCI DSS v4.0 restructured penetration testing requirements. What changed from v3.2.1, new segmentation testing mandates, and QSA expectations for 2026.
May 12, 2026
How attackers chain IAM misconfigurations and metadata SSRF into full account takeover on AWS — with defensive controls that actually work.
May 6, 2026
The OWASP Top 10 2025 revision changed priorities. How VAPT programs should adapt testing scope and depth for the new landscape.
Apr 24, 2026
Why XSS is consistently underestimated and how attackers actually exploit it — from session hijacking and keylogging to worm propagation and CSP bypass.
Apr 22, 2026
The critical difference between VA and PT, why compliance frameworks demand both, and how to structure a testing program that satisfies auditors and reduces real risk.
Apr 15, 2026
A modern web application VAPT methodology covering discovery, authentication handling, business logic testing, chained exploits, and defensible reporting.
Apr 2, 2026
What shift-left security actually means in practice — SAST, SCA, IaC scanning, pre-commit hooks, and how to avoid the pitfalls that cause programs to fail.
Apr 5, 2026
A technical guide to SSRF in cloud environments, covering metadata endpoint exploitation, IMDSv1 vs IMDSv2, blind SSRF, and DNS rebinding.
Mar 8, 2026
Error-based, blind, time-based, and out-of-band SQLi, second-order injection, ORM bypass techniques, WAF evasion, and layered defenses.
Feb 14, 2026
Algorithm confusion attacks, weak signing secrets, JWK injection, kid parameter injection, token sidejacking, and how to implement JWTs securely.
Jan 18, 2026
Hands-on techniques for finding BOLA/IDOR, broken authentication, excessive data exposure, mass assignment, SSRF, and GraphQL-specific vulnerabilities in APIs.
Dec 12, 2025
An in-depth look at the current application security landscape and emerging threats.
Nov 15, 2025
Exploring how artificial intelligence is revolutionizing the way we find and fix security issues.
Nov 10, 2025
A practical guide to successfully implementing DevSecOps in your organization.
Nov 5, 2025
Breaking down the latest OWASP Top 10 vulnerabilities and how to protect against them.
Oct 28, 2025
Essential security measures for your continuous integration and deployment pipeline.
Oct 20, 2025
Modern approaches to penetration testing with AI-powered automation.
Oct 15, 2025