Block8.ai blog

Plain text_

Insights, guidance and updates on AI-powered penetration testing from the Block8.ai team.

Latest article · AI-Powered Penetration Testing

Where does your penetration testing data live? Three deployment models, explained

A penetration test asks a lot of trust. To do the job properly, a testing provider may need test credentials, network diagrams, architecture documents and, by the end, a detailed list of your weaknesses. So “where does all of that go?” is a fair question. For many organisations it’s the first one. Block8.ai offers three deployment models. Here’s what each one means for your data, in plain English. 1. SaaS (the default) Most customers use our multi-

4 November 2026 · 3 min read

Read article

Where does your penetration testing data live? Three deployment models, explained

The Newline That Got Away (CVE-2026-78747)

TL;DR Pluck CMS 4.7.20 and earlier has an email header injection flaw in its contact form module (CVE-2026-78747). The code strips dangerous newlines from the

CVE

When an Empty Answer Is the Right Answer (CVE-2026-78726)

TL;DR Pluck CMS 4.7.20 lets you pass the settings-page CAPTCHA by submitting nothing at all (CVE-2026-78726). The check compares the stored CAPTCHA code against

AI-Powered Penetration Testing

Guard rails start before the first scan

The most important safety decisions in an AI penetration test happen before testing starts. Here’s how Block8.ai builds scope into the platform.

CVE

The Blog Post That Writes Scripts (CVE-2026-78746)

TL;DR Pluck CMS 4.7.20 and earlier ships a stored cross-site scripting flaw in its blog module (CVE-2026-78746). When an administrator saves a blog post,

CVE

When "Save Page" Means "Save Anywhere You Like" (CVE-2026-78752)

TL;DR Pluck CMS 4.7.20 and earlier lets an authenticated administrator write PHP files anywhere the web server can reach, not just into the pages folder where they

CVE

One Link, One Admin, One Webshell (CVE-2026-78749)

TL;DR Chain two forgiving mistakes in Pluck CMS 4.7.20 and you get unauthenticated remote code execution (CVE-2026-78749). First, the CSRF guard returns true when the

CVE

The Comment Box That Tells Strangers Where It Lives (CVE-2026-78725)

TL;DR Pluck CMS 4.7.20 running on PHP 8 leaks the absolute path of its own installation to anyone who leaves a comment. The blog module's

AI-Powered Penetration Testing

Who builds your penetration testing platform matters more than you think

When you engage a penetration testing provider, you’re not just buying a report. You’re authorising someone to probe the systems that pay your staff, serve your customers and

CVE

When a Website Trusts Its Own Filing System a Little Too Much (CVE-2026-52657)

TL;DR Pluck CMS 4.7.20 writes plugin-supplied data into a live PHP file - but it trusts the name of that data, not just its value. A malicious

AI-Powered Penetration Testing

Finding the Vulnerability Is Not the Finish Line: What Happens After Your Pen Test Report

The scenario The report has landed. It's thorough, well written, and lists findings ranked by severity. And then, for a lot of organisations, very little happens for weeks,

AI-Powered Penetration Testing

Questions to Ask Before You Book a Penetration Test

The buyer's situation Before booking a penetration test, you need more than a price and a date. A useful test starts with clear scope, clear expectations and a