Technical articles, offensive security methodologies, AI-driven cyber operations and emerging threat analysis.
From 19 October to 12 November 2026, hoax bomb threats sent by email under at least six different names hit flights, newsrooms and thousands of schools across Europe. With the Threat Hunter profile of BackBox AI we reconstructed the waves, compared the messages and weighed who could be behind them, checked every source before publishing, and built a dashboard that will follow the investigation.
ReadIn three weeks, attacks on the refrigeration systems of supermarkets and food businesses went from scattered incidents to two nights of sabotage across Europe. With the Threat Hunter profile of BackBox AI we reconstructed the incidents, techniques, actors and links from open sources, checked every source before publishing, and built a dashboard that will follow the investigation as it continues.
ReadWe used the Threat Hunter profile of BackBox AI to follow the October 2026 protest wave in France and Italy from open sources, from the first reconstruction of events to the second day of mobilization. This is how the investigation was run, what it established, where open sources stop, and the dashboard that publishes its results.
ReadBackBox AI built a complete exploit chain against the v8CTF Chrome 152 target: an address leak, arbitrary read and write inside the V8 sandbox, a parser overflow that writes outside it, and a ROP chain that opens and reads a file on disk. Here is how each stage works, and what it says about patch lag.
ReadWe ran BackBox AI through the whole of Hack The Box Season 11, thirteen machines from Easy to Insane, and closed the season with every flag. The score is the least interesting part: what matters is how far an agent gets on its own, and where a person still has to step in.
ReadDuring a client-commissioned penetration test, BackBox AI pivoted from gray-box to white-box, fingerprinted the exact nopCommerce version, pulled the matching source, and found a stored XSS: an SVG animate onbegin handler that slips past the platform's HtmlFormatter blocklist and a fronting web application firewall. The sanitizer root cause is unfixed through the latest release (4.90.6).
ReadThe real breakthrough in AI-powered security is not a proprietary model. It is the harness: the tools, context, orchestration, interfaces and guardrails that let the best available models operate safely in the real world.
ReadBackBox Labs analyzed the NetBird client daemon on Linux and chained several individually moderate weaknesses in its local gRPC interface into a full root privilege escalation affecting versions up to and including 0.75.0, with no memory corruption, kernel bugs, or race conditions involved.
ReadWe pointed BackBox AI at a live Android RAT and asked for a full analysis. It unpacked a dropper, decoded an XOR-obfuscated C2 URL straight from smali bytecode, confirmed that the C2 infrastructure was still responding by speaking the malware's own protocol, and attributed the operation. This is what evidence-driven analytical reasoning looks like when it reaches past red teaming.
ReadIn the age of artificial intelligence, whoever controls models, data and infrastructure controls far more than technology. Why technological sovereignty has become a strategic question, and the contribution of a project born in Italy.
ReadBackBox AI found a local root escalation on Linux distributions that package Bettercap with a systemd service. The flaw is not in Bettercap's code but in the packaging: the service runs its REST API as root with authentication disabled. The unit was removed upstream.
ReadBackBox AI found that a small crafted file could exhaust available memory during an ordinary Binwalk scan, with no extraction flag required. The Binwalk maintainer confirmed the issue and fixed it by capping decompression at 100 MB.
ReadBackBox AI surfaced two header-trust weaknesses in SearXNG: a Host header injection leading to open redirect and cache poisoning, and an X-Forwarded-For rate-limiter bypass. Disclosed responsibly, both come down to trusting client-controlled HTTP headers.
ReadWhy BackBox AI bets on architecture over model size, and how we partner, pro bono, with a selected group of open source projects.
ReadA data-driven comparison of BackBox AI against Aikido Security and XBOW on the Photoview application, using Doyensec's independent severity review as a common yardstick. The focus is signal over noise: matching the serious-vulnerability coverage of a higher-volume competitor with far fewer low-value findings.
ReadComparative security benchmark between BackBox AI and Neo (ProjectDiscovery) on the MedPortal application, focusing on vulnerability coverage, false positive validation, and attack chain analysis
ReadHow BackBox AI leveraged multimodal visual capabilities to analyze PCB production files and autonomously identify hidden anomalies in the Hack The Box Critical Flight scenario
ReadHow BackBox AI autonomously exploited a hard Hack The Box machine by chaining real-world CVEs without human intervention
ReadA detailed analysis of how BackBox AI autonomously compromised a vulnerable SOAP service by exploiting XXE and default credentials in the XBOW Validation Benchmark.
ReadHow BackBox Labs applies an adversary-driven Threat Led Penetration Testing (TLPT) methodology that combines threat intelligence, AI-powered attack surface discovery, and human expertise to measure real operational resilience.
ReadA controlled demonstration of BackBox AI operating in an OT/ICS environment, interpreting industrial systems and safely interfacing with PLCs in a virtual lab setting.
ReadA detailed technical analysis of how BackBox AI successfully exploited a complex PHP deserialization vulnerability in PortSwigger Web Security Academy's expert-level lab, developing a custom gadget chain for remote code execution.
ReadExplore how AI is transforming cybersecurity with BackBox AI's platform enabling both offensive and defensive intelligence operations.
Read