Founder and CEO of Flawfence
An offensive security consultant for over ten years, Thibaud founded Flawfence to make continuous pentesting accessible to SMEs and mid-sized companies: an algorithmic engine that maps the exposed perimeter and detects flaws, then an AI pentest agent that attempts exploitation and keeps the proof.
He writes the blog’s analyses: the WordPress exploitation chains (wp2shell, xss2shell, CVE-2026-87902), the GitLab and Proxmox flaws, the attack on Danfoss refrigeration controllers, and the long-form articles on AI pentesting, external attack surface and NIS2 and ISO 27001 compliance. Every vulnerability article ships with a non-destructive detection test the reader can replay.
The Flawfence engine and agent run on YesWeHack bug bounty programmes, where a flaw only counts if the targeted company validates it. The results are public on the trackflaw hunter profile.
Newest first. News articles carry an update date when the facts have moved since publication.
Night of October 11 to 12, 2026: Internet-exposed Danfoss AK-SM and AK-SC refrigeration controllers were hijacked in about 700 French supermarkets, then Dixell controllers the next night. Updated timeline, affected products and CVEs, CERT-FR guidance.
AI pentest, agentic pentest, pentest agent: definition, how an AI-driven penetration test works, what it finds, what it misses, and how to judge an offer.
AI pentest agent: the observe-hypothesize-test-prove loop, the tools, the guardrails, and what separates a real agent from a scanner an AI merely comments on.
An AI pentest sends your production responses through a language model. Where does it run, in which country, with what retention? Why a sovereign AI pentest is more than marketing.
Two critical flaws (CVSS 9.9) in GitLab CE/EE's regular expression engine: a crafted CI/CD regex corrupts server memory and can lead to code execution. Affected versions, version-based detection, the 19.2.7 / 19.3.3 / 19.4.1 fix.
CVE-2026-87902 affects WordPress 4.7.0 to 7.1.1: an unauthenticated path traversal lets an attacker include a local PHP file. Affected versions, the 7.1.2 fix, a detection test and remediation.
Automated pentest, continuous pentest, PTaaS, scanning: the real differences, what automation finds and misses, compliance, and seven questions to evaluate a vendor.
CVE-2026-85706: a CVSS 10 flaw in GitLab's repository API lets an anonymous attacker read any file on the server. Mechanism, affected versions, detection and the fix.
Pre-auth authentication bypass in Proxmox VE 7 (CVE-2023-54391): root@pam access with no password via tfa-challenge. Detection and remediation.
DGFiP data breach: three intrusions in June, July and August 2026, 678,000 tax records stolen. Are you affected, and what to do against fraud?
xss2shell (CVE-2026-64638) affects every version of WordPress before 7.0.3 and can lead to a full site takeover. What the flaw means for your organization, how to check your exposure and how to protect yourself.
Where the French NIS2 transposition stands, who is in scope, what the law defers to ANSSI decrees, and the three projects you can start right now.
A step-by-step method to list what you expose on the internet: forgotten subdomains, Shadow IT, open ports, mail posture. With the commands and the free tools.
What a pentest, a vulnerability scan and a full audit actually cost in 2026: market ranges, what moves a quote, and how to read one without getting burned.
wp2shell is a pre-auth RCE in WordPress Core (CVE-2026-63030 + CVE-2026-60137). How it works, affected versions, PoC, detection and remediation.
Control A.8.8, scan frequency, audit evidence: the practical guide to setting up automated vulnerability scanning that satisfies ISO 27001:2022.
A CVSS score alone does not tell you what to fix first. A method to prioritize vulnerabilities by crossing exposure, KEV and EPSS, with the commands and a worked example.
Report structure, Article 21 measures, technical evidence auditors expect: the complete guide to writing a clear, actionable NIS2 compliance report.
Mapping the IT infrastructure is a pillar of cybersecurity. Discover why and how to map your company's information system.
A guide to choosing the right vulnerability scanning tool in 2026
