Reflectiz

How a 𝗚𝗥𝗖 Lead got two 𝗲𝗰𝗼𝗺𝗺𝗲𝗿𝗰𝗲🛍️ businesses PCI audit-ready in six weeks, not six months. Read the full story 👉 hubs.ly/Q04DdR_10 When Card Factory brought Funky Pigeon under one roof, @Phil Shackleton, the group’s 𝗚𝗥𝗖 Lead, suddenly had two 𝗲𝗰𝗼𝗺𝗺𝗲𝗿𝗰𝗲 businesses to comply with the new PCI DSS 4.0.1 payment page requirements. “...made something that was incredibly time-consuming and frustrating to do by hand almost enjoyable🏅It just made sense.” So what did he find along the way that nobody planned for? It’s all in the full story. #PCI #GRC #Ecommerce

The scariest flaw on your checkout page🛍️ is the one that shipped after your last pentest. Read the full guide 👉 hubs.ly/Q04D4zyc0 The flaws that hurt online payments💳 most are rarely CVEs... You deal with price manipulation, cart tampering, OTP bypass, or changing one ID to see someone else’s order. So we wrote this guide to cover what to test first, why the annual pentest falls short, and how agentic pentesting runs on a live store inside guardrails you control. If you run an online checkout➡️read this before shopping season. #Reflectiz #Ecommerce #PenTesting #Retail

What if your pentest schedule ⏲️ matched your release schedule? Most teams ship every week and test once a year 🙅 In the AI era we ask ourselves, “How is it possible?!!?!” One could say they don’t need it every week, and another could say the payment page needs an even higher frequency. In any case, you can solve it🏅with agentic pentesting: adjust your testing frequency and even customize it per web page. The gap between apps running in production and testing that doesn’t really help is where hackers make their salary. Follow us🔔 for more solutions regarding web pentesting. #Reflectiz #PenTesting #CISO

$2.7M drained from 737 Polymarket accounts in about an hour ⏳ If you’re in finance, that’s a must read 👉 hubs.ly/Q04CYMCg0 Attackers hijacked DebugBear’s DNS and turned a performance-monitoring script into a wallet drainer. They didn’t touch any Polymarket server, and the script simply reused the sessions of users who were already logged in. This is Polymarket’s second third-party breach in four months 😬 Financial institutions are sitting ducks, and if you are in charge of security you have to read this article. #Finance #Polymarket #CISO

Pun time 🐔 Can you figure out what these chickens have to do with cybersecurity? Drop your answer in the comments 👇 #PenTesting #WebSecurity #CISO

OWASP’s own advice on LLM security: stop🔴trying to build a model that cannot be fooled. Read the full guide 👉 hubs.ly/Q04CLD_C0 OWASP's Top 10 for LLM Applications 2026 is out! And here is what most teams miss. The article maps all 10 risks against what agentic web pentesting🕸️can actually test, where it is strong, where it is partial, and where red teaming of the model itself still needs to happen. If you are building or securing any AI feature on a website⚠️this is required reading. #OWASP #CISO #PenTesting

It's funny 😜 because it's Halloween but we are less scared now. Yesterday's webinar on AI agents🤖 and what they mean for website security really nailed it. This is the hottest topic🔥🔥 in web security today and everyone who attended got the clear explanation of what is happening and what to do with it. Thank you to everyone who joined and our speakers Or Sahar & Rachel Curran🙏 If you registered, the recording is already in your inbox. Check your email. If you missed it, you can watch it here 👉 hubs.ly/Q04CLgtR0 #WebSecurity #CISO #Webinar

The AI Agents Running On Your Website nitter.cf/i/broadcasts/1DxLdZBDp…

Starting TODAY in 2 hours!!🔴 Join us >> hubs.ly/Q04Cylqh0 Or and Rachael will cover the PHP2SHELL and Node2SHELL vulnerabilities in context of AI Agents attacks. This is how security teams can prepare in this spooky web environment👻👻👻 See you soon.

After PHP2Shell, Node2Shell, and other security shells...meet Halloween2Shell🎃 👉 hubs.ly/Q04Chp6V0 Or Sahar and Rachel Curran are going live this Wednesday!! for a spooktacular dive into the AI agents running on your website. The ones you did not invite. And the ones you did. And they are gonna talk about the recent vulnerabillites you all heard about. #CISO #PHP #WebSecurity

October 2026 is going down as Black October⚫ for web security. PHP2Shell and Node2Shell were the headliners: two critical remote code execution vulnerabilities, both requiring no login, both exploited before patches dropped. But they were not alone... Microsoft shipped 1,413 CVEs with 3 zero-days, Oracle WebLogic took a CVSS 10.0 hit, Magento StyleSmuggler was already on CISA’s KEV list, and AI agent campaigns against banks and retailers were running through all of it. October did not give defenders a quiet week😵 The web was this month’s top attack frontier⚔️ and that made our work matter more than ever. Every Reflectiz client was informed, our team worked closely with organizations to assess their exposure, and we made sure no one was left figuring it out alone. This is what we are here for. Follow us🔔 for more web security updates #WebSecurity #PHP #NodeJS

Sign up👉

Headlines made us think the HuggingFace breach was the scariest scenario...👻 Can you handle the truth? 👉 hubs.ly/Q04BSsdH0 It wasn’t. They are the easier problem to solve🤦 The ones you should actually be worried about already have your approval, they are running on your website right now, and nobody is watching them. Join our trick or treat on October 28 with Or Sahar and Rachel Curran going live to show exactly how to protect your web apps from agents lurking in the dark. Ever heard a talk from two vampires? 🦇 #Cybersecurity #WebSecurity #CISO

🚨 Breaking: PHP2Shell is being exploited. Attackers moved before the patch dropped. Fix it ASAP 👉 hubs.ly/Q04C0zQJ0 CVE-2026-109618 and CVE-2026-109619 are rated CVSS 9.2 and require no login. A single request is enough to run code on any unpatched PHP server. WordPress, Drupal, Joomla, and Magento are all confirmed vulnerable. Amazon🛍️ recorded the first exploitation attempt on October 17. The patch shipped October 21. Attackers had a four-day head start. Patching is step one. But most teams will stop there🙅 and that is exactly the gap attackers count on. The article covers what to do after the patch, and why your server logs will look completely normal while a skimmer runs on your checkout page. #WebSecurity #PHP #CISO

That's a first ➡️ Big purple ghost hosting a webinar 👻 Everyone assumes that cases like the HuggingFace breach mean the outside threat is the scariest story. Or and Rachel are going to prove them wrong, live. Read more in this weeks newsletter 👇 linkedin.com/pulse/invite-ag… #CISO #AI #Agents

Reflectiz is heading to Pittsburgh🏙️ We’re proud to be a Steel City Sponsor at the Three Rivers Information Security Symposium (TRISS) on October 22. Dan Beauregard and Paul Kammerzelt will be onsite representing Reflectiz, ready to talk agentic pentesting. And we’re giving away Ray-Ban Meta Glasses🕶️ at our booth. Stop by, enter the raffle, and come see what continuous web exposure management actually looks like in practice. See you in Pittsburgh🤝 #TRISS2026 #Cybersecurity #Reflectiz

When Or Sahar takes the stage, security teams take notes. 👉 hubs.ly/Q04BR-Dd0 Or Sahar is a security researcher at Reflectiz with two decades of experience across software development, penetration testing, and application security🔒 OSCE certified, co-founder of Secure From Scratch, and a recognized speaker in the cybersecurity community, she has worked extensively with private and government sector organizations on application security and secure coding practices. She has spoken at many stages like BSides Las Vegas🗣️ and her research makes her and expert on what AI agents actually do on live websites, not in theory, in production. On October 28 she is joining Rachel Curran live to show exactly that, and why the agents you should be most worried about are the ones you already approved. 🎃 #Cybersecurity #AppSec #CISO

Anthropic, OpenAI, and OpenClaw had a wild 2026. 🤠 Read the full list 👉 hubs.ly/Q04BH0JM0 Not just HuggingFace. We ranked the 7 biggest AI agent attacks of 2026 by what they exposed. Rogue agents acting on their own, humans weaponizing open-source tools, and trusted AI integrations that got compromised. Banks, governments, AI platforms, and online retailers all made the list. If you are in retail 🛍️ go straight to number #1. These are exactly the kinds of attacks we cover in our webinars. The tactics, the vectors, and what each one actually exposed. Don't call yourself a security specialist if you don't know these attacks. #WebSecurity #AgenticAI #CISO

Your vendor assessment has a blind spot⚫. She found it. 👉 hubs.ly/Q04Bwgwb0 Rachel Curran is a CISM-certified GRC leader with over 15 years of experience. 🏅 Former Director of Risk and Compliance and Head of Security at Logikcull, she has built SOC 2 and security programs from the ground up across dozens of organizations. Today as Co-Founder and CEO of Locktivity she is tackling the problem every GRC team faces: third-party risk management was not built for how modern companies actually deploy software today➡️AI agents are the proof. On October 28 Rachel is joining Or Sahar live to talk about where vendor assessments break down and what approved agents are doing after go-live. If you work in compliance, vendor risk, or security leadership this one is for you. 🎃 #Cybersecurity #GRC #TPRM #CISO

Reflectiz is coming to @PCISSC EU in Edinburgh🍀See what we are bringing. 👉 This Two sessions are a must: 🎤 The Checkout Blind Spot: Payment Frame Risk in Retail Isaac Moddel, VP Sales EMEA & APAC October 21 | 13:10 - 13:40 🎤 Your Payment Page Isn’t Really Yours Anymore Leor Eliashiv, UK & I Country Manager October 20 | 14:45 - 15:10 And yes, we are giving away Ray-Ban Meta Glasses🕶️ Go to Booth 6 to enter and win!! As a Principal Participating Organization in the PCI Security Standards Council, we are not just attending the conversation, we are part of building it. Follow us👆 to get live updates from the event. #PCI #Payments #CISO