Posts about Pentr, security testing and audit evidence.
Two unauthenticated remote code execution bugs in the PHP interpreter, exploited before the fix shipped. What they are, how to patch, and how to confirm the fix on each host.
Qué espera el auditor del ENS de tus pruebas de penetración en sistemas MEDIA y ALTA, dónde falla el informe PDF y qué conviene preparar.
CRA Article 14 reporting has applied since 11 September. What it asks, what it does not, and why the work starts before the 24-hour clock does.
A pen test report is a document written after the test. We think the auditor should get the test itself: every artifact, hashed, chained and signed.
Pentr