Blog | Fast Pen Tests

Get Fix This Week by email

One security issue a week, explained plainly, with the fix. No spam, unsubscribe anytime.

EU Penetration Testing Requirements: GDPR, NIS2 and DORA

By Andrew Owens | November 11, 2026

Only one EU law actually names penetration testing, and it is not GDPR. What Article 32, NIS2 and DORA each demand, and which companies they catch.

Why Cybersecurity Rules Can't Keep Up With the Attacks

By Andrew Owens | November 10, 2026

Attacks move in hours and the rules move in years. Four gaps that hit regular people, with real cases from the last three months, and what to do about them.

Which US Regulations Actually Require a Penetration Test?

By Andrew Owens | November 9, 2026

A rule-by-rule guide to who each US regulation applies to, and which ones name penetration testing outright versus leaving the method up to you.

The Pen Test Findings We Report Most Often (and What They Cost to Fix)

By Andrew Owens | November 6, 2026

The findings our external scans report most often, what each one actually means, and an honest fix time. Most are hygiene, not emergencies.

LiteLLM Got Poisoned Again: What to Do When an AI Package Turns on You

By Andrew Owens | November 4, 2026

LiteLLM 1.107.0 shipped a credential stealer on PyPI and Docker on Oct 21. What happened, what's still disputed, and what to pin, rotate, and rebuild.

PHP2Shell: Find the PHP Version Actually Serving Your Site

By Andrew Owens | November 2, 2026

PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is on CISA's KEV list. How to find the PHP version actually serving your site, and what to patch it to.

Who Has to Sign Your Amazon SP-API Pen Test?

By Andrew Owens | November 3, 2026

A developer ran their own SP-API pen test and Amazon's pushback was about independence. What the policy actually says, and what your report should show.

Authenticated vs Unauthenticated Pen Testing: What the Login Changes

By Andrew Owens | November 2, 2026

An unauthenticated test asks whether an outsider gets in. An authenticated one asks how far a stolen login goes. Which you need, and what our $495 test covers.

Node2Shell: Check Your Node.js Version Before November 10

By Andrew Owens | October 30, 2026

CVE-2026-111497 lets a crafted Brotli stream crash or take over a Node.js app. It's now on CISA's KEV list. How to tell if you're exposed and what to do.

Need a Pen Test Fast? You Have Three Deadlines, Not One

By Andrew Owens | October 28, 2026

A fast pen test is more than a quick first report. Testing, your fixes and the retest each take time. How to plan backward and what to ask before you pay.

What UK Rules Actually Require: Penetration Testing and Compliance

By Andrew Owens | October 27, 2026

Almost no UK regulation says the words “penetration test”. Here is what UK GDPR, Cyber Essentials and PCI DSS really ask for, and which ones name it outright.

What a Lending Platform Should Ask For in a Pen Test

By Andrew Owens | October 23, 2026

Several portals, signed term sheets, payment requests and other people's financial data. What to ask for in a pen test, and whether the FTC rule applies.

MCP Servers Are the New npm Packages (and That's Not a Compliment)

By Andrew Owens | October 21, 2026

Every MCP server you add to an AI tool is someone else's code running with your keys. What this year's MCP bugs look like, and how to use MCP safely.

77,000 Vulnerable n8n Servers: Your Automation Stack Is Your Attack Surface

By Andrew Owens | October 19, 2026

Censys found nearly 114,000 n8n servers online; about 77,000 ran versions with a known critical flaw. Why your workflow tool is a bigger target than your site.

Four Days From Disclosure to Exploit

By Andrew Owens | October 16, 2026

An AI agent found a critical bug and attackers used it four days after disclosure. What Google's new data says about patch windows, and what to do about it.

How to Read Your Pen Test Report (and What to Fix First)

By Andrew Owens | October 14, 2026

You got your pen test report back and it has a lot of findings in it. Don't panic. Here's how to read it and what order to fix things in.

Your First Security Questionnaire: How to Answer It Without Lying

By Andrew Owens | October 12, 2026

Your first big customer just sent a 150-question security spreadsheet. What they're really asking, how to answer honestly, and how to turn a no into a yes.

Pen Testing a Multi-Tenant SaaS: What Tenant Isolation Really Means

By Andrew Owens | October 9, 2026

If one customer can reach another customer's data, nothing else in your report matters. What a multi-tenant SaaS pen test should cover and how to set it up.

OpenAI Daybreak, Explained (and Why You're Not In It)

By Andrew Owens | October 7, 2026

What OpenAI's Daybreak Blue and Red tiers are, who gets access to its best cyber models, and what it means for small companies that never will.

The Security Holes AI Coding Tools Leave Behind

By Andrew Owens | October 5, 2026

AI coding tools write code that works. They don't think about who else is going to use it. Here are the gaps I'd check first in any app built mostly by an AI.

TruffleHog: The Secret Scanner Attackers Use Too

By Andrew Owens | October 1, 2026

TruffleHog finds leaked API keys, and attackers love it for the same reason. Here's how it gets used against you, and where a pen test fits in.

The AI That Hacked Hugging Face to Cheat on a Test

By Andrew Owens | September 28, 2026

OpenAI's own models escaped a test sandbox and broke into Hugging Face. The science fiction part gets the headlines. The boring bugs they used to get in are the part you should worry about.

Does SOC 2 Require a Pen Test?

By Andrew Owens | September 25, 2026

Technically no. In practice, almost always. Here's what the SOC 2 criteria actually say, what auditors look for, and when to schedule it.

GPT-6 Astra Is Rated "Critical" for Cyber Risk. What That Means for You

By Andrew Owens | September 23, 2026

OpenAI has shipped the first model it classifies as Critical for cybersecurity risk. The headline number is how fast it turns a known bug into a working attack, and that's the one small companies should care about.

I Failed My Own Security Scan

By Andrew Owens | September 21, 2026

I took over a pen testing company and ran its own free scanner against its own website. It got a D. Here's what was wrong and how I fixed it in an afternoon.

Fable 5.1 and Mythos 5.1: Same Model, Different Rules

By Andrew Owens | September 18, 2026

Anthropic's newest models are one model with two sets of rules. The public one can now find vulnerabilities in your code but won't write exploits. Here's what that means for you and for attackers.

What a $495 Pen Test Covers (and What It Doesn't)

By Andrew Owens | September 16, 2026

A straight answer on what you get for $495, what you don't, and when you should spend more on a bigger engagement instead.

What Claude Mythos Means for Your Website

By Andrew Owens | September 14, 2026

Anthropic built a model that finds and exploits zero-days in every major operating system and browser. You're not running an operating system company. Here's why it still matters to you.

Do I Need a Pen Test? Why You Should Test Early (Even Without Compliance Requirements)

By Dan Goldin | February 20, 2026

Discover why penetration testing matters even without SOC 2 or compliance mandates, why testing early saves you headaches, and how the rise of AI-generated code makes pen testing more important than ever.

Top Tips to Prevent Information Leakage

By Dan Goldin | October 18, 2024

Learn essential strategies to protect your website from revealing sensitive information to potential hackers.

Black, Grey, and White Box Penetration Testing

By Dan Goldin | September 10, 2024

Learn about the different types of penetration testing and how they can be used to assess the security of your systems.

AI-Powered Hacking: The Growing Threat

By Dan Goldin | August 26, 2024

How attackers are using AI to find and exploit website weaknesses faster, and what that means for how often a small business should test.

Red Team vs Blue Team: Understanding Cybersecurity Roles

By Dan Goldin | August 20, 2024

Explore the differences between red teams and blue teams in cybersecurity, their roles, and how they work together to strengthen an organization's security posture.

The Importance of Regular Penetration Testing

By Dan Goldin | August 16, 2024

Why one pen test isn't enough: how often to test, what changes between tests, and how regular testing protects your business as threats change.

What is Penetration Testing and How is it Done?

By Dan Goldin | August 10, 2024

Discover the basics of penetration testing, its purpose, and the process involved in conducting these critical security assessments.