Reflectiz

Reflectiz Reflectiz is the AI-powered web exposure company, monitoring everything that runs on live websites.

Explore agentic pentesting, client-side risks, AI agent vulnerabilities, Magecart, supply chain attacks, and PCI DSS gaps most security tools never catch.

October 2026 is going down as Black October⚫ for web security.PHP2Shell and Node2Shell were the headliners: two critical...
26/10/2026

October 2026 is going down as Black October⚫ for web security.

PHP2Shell and Node2Shell were the headliners: two critical remote code ex*****on vulnerabilities, both requiring no login, both exploited before patches dropped.

But they were not alone...

Microsoft shipped 1,413 CVEs with 3 zero-days, Oracle WebLogic took a CVSS 10.0 hit, Magento StyleSmuggler was already on CISA’s KEV list, and AI agent campaigns against banks and retailers were running through all of it.

October did not give defenders a quiet week😵

The web was this month’s top attack frontier⚔️ and that made our work matter more than ever. Every Reflectiz client was informed, our team worked closely with organizations to assess their exposure, and we made sure no one was left figuring it out alone.

This is what we are here for.

Follow us🔔 for more web security updates

Headlines made us think the HuggingFace breach was the scariest scenario...👻Can you handle the truth? 👉 https://hubs.ly/...
23/10/2026

Headlines made us think the HuggingFace breach was the scariest scenario...👻

Can you handle the truth? 👉 https://hubs.ly/Q04BSsjv0

It wasn’t.

They are the easier problem to solve🤦 The ones you should actually be worried about already have your approval, they are running on your website right now, and nobody is watching them.

Join our trick or treat on October 28 with Or Sahar and Rachel Curran going live to show exactly how to protect your web apps from agents lurking in the dark.

Ever heard a talk from two vampires? 🦇

🚨 Breaking: PHP2Shell is being exploited. Attackers moved before the patch dropped.Fix it ASAP 👉 https://hubs.ly/Q04C0B5...
22/10/2026

🚨 Breaking: PHP2Shell is being exploited. Attackers moved before the patch dropped.

Fix it ASAP 👉 https://hubs.ly/Q04C0B5S0

CVE-2026-109618 and CVE-2026-109619 are rated CVSS 9.2 and require no login. A single request is enough to run code on any unpatched PHP server. WordPress, Drupal, Joomla, and Magento are all confirmed vulnerable.

Amazon🛍️ recorded the first exploitation attempt on October 17. The patch shipped October 21. Attackers had a four-day head start.

Patching is step one. But most teams will stop there🙅 and that is exactly the gap attackers count on. The article covers what to do after the patch, and why your server logs will look completely normal while a skimmer runs on your checkout page.

That's a first ➡️ Big purple ghost hosting a webinar 👻Everyone assumes that cases like the HuggingFace breach mean the o...
22/10/2026

That's a first ➡️ Big purple ghost hosting a webinar 👻

Everyone assumes that cases like the HuggingFace breach mean the outside threat is the scariest story. Or and Rachel are going to prove them wrong, live.

Read more in this weeks newsletter 👇
https://hubs.ly/Q04B_vfd0

Reflectiz is heading to Pittsburgh🏙️We’re proud to be a Steel City Sponsor at the Three Rivers Information Security Symp...
21/10/2026

Reflectiz is heading to Pittsburgh🏙️

We’re proud to be a Steel City Sponsor at the Three Rivers Information Security Symposium (TRISS) on October 22.

Dan Beauregard and Paul Kammerzelt will be onsite representing Reflectiz, ready to talk agentic pentesting.

And we’re giving away Ray-Ban Meta Glasses🕶️ at our booth. Stop by, enter the raffle, and come see what continuous web exposure management actually looks like in practice.

See you in Pittsburgh🤝

When Or Sahar takes the stage, security teams take notes.👉 https://hubs.ly/Q04BR-zH0Or Sahar is a security researcher at...
21/10/2026

When Or Sahar takes the stage, security teams take notes.

👉 https://hubs.ly/Q04BR-zH0

Or Sahar is a security researcher at Reflectiz with two decades of experience across software development, pe*******on testing, and application security🔒 OSCE certified, co-founder of Secure From Scratch, and a recognized speaker in the cybersecurity community, she has worked extensively with private and government sector organizations on application security and secure coding practices.

She has spoken at many stages like BSides Las Vegas🗣️ and her research makes her and expert on what AI agents actually do on live websites, not in theory, in production.

On October 28 she is joining Rachel Curran live to show exactly that, and why the agents you should be most worried about are the ones you already approved. 🎃

Anthropic, OpenAI, and OpenClaw had a wild 2026. 🤠Read the full list 👉 https://hubs.ly/Q04BH0QD0Not just HuggingFace. We...
20/10/2026

Anthropic, OpenAI, and OpenClaw had a wild 2026. 🤠

Read the full list 👉 https://hubs.ly/Q04BH0QD0

Not just HuggingFace. We ranked the 7 biggest AI agent attacks of 2026 by what they exposed. Rogue agents acting on their own, humans weaponizing open-source tools, and trusted AI integrations that got compromised.

Banks, governments, AI platforms, and online retailers all made the list.

If you are in retail 🛍️ go straight to number #1.

These are exactly the kinds of attacks we cover in our webinars. The tactics, the vectors, and what each one actually exposed.

Don't call yourself a security specialist if you don't know these attacks.

Your vendor assessment has a blind spot⚫. She found it.👉 https://hubs.ly/Q04Bwg020Rachel Curran is a CISM-certified GRC ...
19/10/2026

Your vendor assessment has a blind spot⚫. She found it.

👉 https://hubs.ly/Q04Bwg020

Rachel Curran is a CISM-certified GRC leader with over 15 years of experience. 🏅 Former Director of Risk and Compliance and Head of Security at Logikcull, she has built SOC 2 and security programs from the ground up across dozens of organizations.

Today as Co-Founder and CEO of Locktivity she is tackling the problem every GRC team faces: third-party risk management was not built for how modern companies actually deploy software today➡️AI agents are the proof.

On October 28 Rachel is joining Or Sahar live to talk about where vendor assessments break down and what approved agents are doing after go-live.

If you work in compliance, vendor risk, or security leadership this one is for you. 🎃

Reflectiz is coming to PCI EU in Edinburgh🍀See what we are bringing. 👉This Two sessions are a must:🎤 The Checkout Blind ...
19/10/2026

Reflectiz is coming to PCI EU in Edinburgh🍀See what we are bringing. 👉

This Two sessions are a must:

🎤 The Checkout Blind Spot: Payment Frame Risk in Retail
Isaac Moddel, VP Sales EMEA & APAC
October 21 | 13:10 - 13:40

🎤 Your Payment Page Isn’t Really Yours Anymore
Leor Eliashiv, UK & I Country Manager
October 20 | 14:45 - 15:10

And yes, we are giving away Ray-Ban Meta Glasses🕶️ Go to Booth 6 to enter and win!!

As a Principal Participating Organization in the PCI Security Standards Council, we are not just attending the conversation, we are part of building it.

Follow us👆 to get live updates from the event.

Address

Shoham Street 5
Ramat Gan

Website

Alerts

Be the first to know and let us send you an email when Reflectiz posts news and promotions. Your email address will not be used for any other purpose, and you can unsubscribe at any time.

Contact The Business

Send a message to Reflectiz:

Shortcuts

Share

Category