Blog · 236 articles

Field notes from the offensive side

Attack chains, vulnerability deep dives, and hard-won lessons in API security from the Axeploit team.

Same Extension ID, Different Code: What Actually Installs When Your Team Moves to Cursor
LatestSupply Chain

10 min read

Same Extension ID, Different Code: What Actually Installs When Your Team Moves to Cursor

Cursor cannot use the Microsoft extension marketplace, so the same extension ID can resolve to different code. Learn the risks and how to audit your team.…

By Axeploit Team
Read article
Your Tools Automate Attacks. Schneier's DEF CON Talk Warns of Machines That Invent Them
API Auth

12 min read

Your Tools Automate Attacks. Schneier's DEF CON Talk Warns of Machines That Invent Them

GitSpawn: The Git Performance Flag That Turns Coding Agents Into Command Runners
Supply Chain

11 min read

GitSpawn: The Git Performance Flag That Turns Coding Agents Into Command Runners

One Laptop, 469 Credential Hiding Spots: What the New Shai-Hulud Worm Is Really After
Supply Chain

11 min read

One Laptop, 469 Credential Hiding Spots: What the New Shai-Hulud Worm Is Really After

An Agent Swarm That Takes Over the Internet Needs Four Capabilities. July's Sandbox Escape Proved One.
Supply Chain

14 min read

An Agent Swarm That Takes Over the Internet Needs Four Capabilities. July's Sandbox Escape Proved One.

Keep reading

More articles

Patching Elementor Pro Doesn't Remove the Webshell. Here's How to Check

Patching Elementor Pro Doesn't Remove the Webshell. Here's How to Check

supply chain

A Forgotten DNS Record Just Handed a Stranger Hundreds of Thousands of Military Base Call Logs

A Forgotten DNS Record Just Handed a Stranger Hundreds of Thousands of Military Base Call Logs

soc2

GPT-6 Astra Fell in Under 24 Hours to a Prompt With Nothing Malicious in It

GPT-6 Astra Fell in Under 24 Hours to a Prompt With Nothing Malicious in It

soc2

Your Detections Assume a Single Attacker. The Hugging Face Swarm Had 700

Your Detections Assume a Single Attacker. The Hugging Face Swarm Had 700

AI Slop Cut Bug Bounty Payouts in Half. The Talent Pipeline Gets the Bill

AI Slop Cut Bug Bounty Payouts in Half. The Talent Pipeline Gets the Bill

dast

Your Coding Agent Installed 23 Packages in a Minute. Your SBOM Saw Zero.

Your Coding Agent Installed 23 Packages in a Minute. Your SBOM Saw Zero.

supply chain