BoletimSec•October 6, 2026•🇵🇹Translated from Portuguese

Web Application Vulnerabilities Surge as AI-Driven Development Outpaces Security Testing

The number of vulnerabilities in web applications continues to grow each quarter, with a significant portion of this increase linked to the adoption of artificial intelligence in development workflows.

Integrating AI into the software development process represents a genuine advancement that raises productivity and shortens delivery timelines. The critical issue lies elsewhere: in the rush to launch new products, organizations have accelerated release cycles without scaling security testing and validation at the same rate.

The outcome is a rising volume of code moving into production environments without ever being evaluated through the lens of a potential attack. Cybercriminals recognized this pattern earlier than most organizations. Applications deployed without security reviews tend to repeat the same classes of flaws, allowing attackers to compromise systems built over weeks in a matter of minutes.

Companies are being breached and sensitive data exposed through gaps that proper validation would have detected prior to any incident. This is the point at which pentest activities must be embedded directly into the development cycle. When code changes every week, security testing must occur at matching frequency, whether on a weekly or monthly recurring basis.

Each production update creates a fresh opportunity for attackers, and only continuous testing closes the gap between rapid development and secure development. Treating pentest as an integral process element keeps security aligned with development velocity. This ongoing approach enables teams to detect and fix weaknesses before they reach adversaries seeking to exploit them.

Developing quickly with AI is not the core problem. Publishing code without validating what was generated is what converts velocity into exposure. While development accelerates and the attack surface expands, organizations that test their systems continuously are the ones able to release with the same confidence they apply to innovation.

Related articles

Security NEXT•Vulnerabilities & Exploits

Critical CVE-2026-111497 Out-of-Bounds Write Flaw in Google Brotli Decoder Impacts Broad Range of Environments

A severe vulnerability has been identified in the Google-developed Brotli decoder used for decompressing data in web communications and other applications. The flaw, tracked as CVE-2026-111497, allows out-of-bounds writes when processing specially crafted compressed data, potentially enabling arbitrary code execution, information disclosure, or denial of service. It carries a CVSS v4.0 base score of 9.2 and is rated Critical. Google has released patched versions 1.2.1, 1.1.1, and 1.0.10 of the library. Node.js incorporated the fix in its updates, while Microsoft issued an out-of-band patch for .NET on October 25, 2026, to address the issue. The vulnerability affects any environment relying on the Brotli C implementation for data decompression.

BoletimSec•Vulnerabilities & Exploits

Critical Code Injection Flaw in Okta Access Gateway Allows Authenticated Command Execution

Okta disclosed CVE-2026-115547, a critical code injection vulnerability in the administrative console of Okta Access Gateway. An authenticated administrator can execute arbitrary commands on the underlying system using the privileges of the gateway service account. The flaw received a CVSS 3.1 score of 9.1 and stems from insufficient input validation when processing configuration values in a specific format. Affected appliances running versions prior to 2026.10.2 must be updated, as no workaround is provided. The same disclosure day also included CVE-2026-115546 for authentication source verification and two PHP execution issues (CVE-2026-109618, CVE-2026-109619) previously seen in Palo Alto PAN-OS. Exploitation requires administrative console access and no in-the-wild attacks have been reported.

安全客•Vulnerabilities & Exploits

GitLab Discloses 12-Year-Old CVSS 10.0 Vulnerability Enabling Unauthenticated Remote Code Execution

GitLab has published a critical security advisory for CVE-2026-110264, a CVSS 10.0 flaw that permits unauthenticated remote code execution on both Community and Enterprise self-hosted instances. The vulnerability has existed in the codebase since 2014 and affects every version up to the latest release prior to the October 2026 patch. Exploitation requires no credentials or special conditions, allowing attackers to run arbitrary commands, exfiltrate source code, deploy backdoors, or move laterally. The issue remained undetected through multiple code iterations, security audits, and version updates due to its hidden trigger conditions within the large, complex application. Organizations are urged to immediately verify their version, review access logs for anomalies, and apply the official fix, while temporary mitigations include network restrictions and enhanced monitoring.

安全客•Vulnerabilities & Exploits

Google Brotli Decoder Vulnerability CVE-2026-111497 Enables Remote Code Execution in Node.js, Python, Bun and Envoy

A critical out-of-bounds write flaw in Google's Brotli decoder (CVE-2026-111497) affects multiple widely used platforms including Node.js, Python, Bun and Envoy. Imperva researchers demonstrated reliable remote code execution on official Node.js 24.22.0 builds for Linux arm64, naming the exploit Node2Shell. The vulnerability allows crafted Brotli-compressed data to corrupt memory, leading to crashes, information leaks or arbitrary code execution. Affected versions include Node.js releases below 22.23.4, 24.22.1 and 26.12.1, plus all versions of the Python brotli and brotlicffi packages. Patches have been issued for Node.js, while other projects await updates; no in-the-wild exploitation has been observed yet. The incident highlights recurring supply-chain risks where a single foundational library impacts thousands of downstream applications.