Blog

Daily notes on AI, testing, and building software.

June 7, 2026Vulnerability Analysis
CVE-2026-28318: SolarWinds Serv-U Unauthenticated DoS — Actively Exploited, Patch Now
CISA added CVE-2026-28318 to its Known Exploited Vulnerabilities (KEV) catalog on June 5, 2026, confirming active in-the-wild exploitation of a high-severity denial-of-service flaw in SolarWinds Serv-U managed file…
June 7, 2026AI/LLM Updates
Claude Opus 4.8 Fixes the Drift Problem — And That's a Big Deal for AI-Driven Test Automation
When AI agents run your test suites, mid-task drift and instruction decay turn deterministic automation into unpredictable noise. Claude Opus 4.8's targeted fixes for these exact failure modes directly improve the…
June 6, 2026Vulnerability Analysis
CVE-2026-20230: Cisco Unified CM WebDialer SSRF-to-Root — What It Is & How to Fix It
CVE-2026-20230 is a critical server-side request forgery (SSRF) vulnerability in Cisco Unified Communications Manager's WebDialer service that allows an unauthenticated remote attacker to write arbitrary files to the…
June 1, 2026Test Automation
RAG Is Fixing LLM Test Case Generation — Here's How the Research Stacks Up
A new April 2026 arxiv paper demonstrates that pairing LLMs with Retrieval Augmented Generation (RAG) pipelines significantly reduces hallucination in AI-generated test cases, meaning the test suites LLMs write are more…
June 1, 2026AI/LLM Updates
1,000 Subagents in One Session: What Claude Opus 4.8's Dynamic Workflows Mean for QA Teams
Claude Opus 4.8's new Dynamic Workflows feature lets a single orchestrator agent spin up and coordinate up to 1,000 parallel subagents in one session — a capability that transforms how large-scale test execution,…
June 1, 2026Vulnerability Analysis
CVE-2026-20127: Cisco Catalyst SD-WAN Authentication Bypass — What It Is & How to Fix It
CVE-2026-20127 is a maximum-severity (CVSS 10.0) authentication bypass in Cisco Catalyst SD-WAN Controller and Manager that allows an unauthenticated remote attacker to gain high-privileged administrative access —…
June 1, 2026Vulnerability Analysis
CVE-2026-45321: How Attackers Hijacked 42 TanStack npm Packages Using GitHub Actions — And How to Protect Yourself
On May 11, 2026, attackers published 84 malicious versions across 42 @tanstack/ npm packages in a six-minute window by chaining three separate GitHub Actions vulnerabilities: a pullrequesttarget Pwn Request,…
May 31, 2026Vulnerability Analysis
CVE-2026-0257: PAN-OS GlobalProtect Authentication Bypass — What It Is & How to Fix It
CVE-2026-0257 is an authentication bypass vulnerability in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS software that allows unauthenticated remote attackers to forge authentication override cookies…
May 31, 2026Testing Tools
Microsoft RAMPART Brings pytest-Native Safety Testing to AI Agents
AI agents are being deployed into production pipelines at scale, but most teams have no systematic way to test their safety and security properties — Microsoft's RAMPART fills that gap with a framework QA engineers…
May 31, 2026Testing Tools
Microsoft Just Open-Sourced a pytest Framework for Testing AI Agents — Here's What QA Teams Need to Know
Microsoft's newly open-sourced RAMPART framework brings red team-style safety and security testing directly into the pytest workflow, meaning QA engineers can now write standard test files that evaluate agentic AI…

Latest from the blog