Insights

Security for MCP, AI agents and compliance

Practical guides instead of buzzwords. Every post comes from CyberSec42 Research and follows the same principle as our reviews: name the one property your product depends on, and back it with evidence rather than adjectives.

Security alerts

What a current vulnerability means for your systems and what to do now.

Security alert

PHP2Shell: What the critical PHP flaws mean for WordPress sites

Affected PHP versions, a self-check in a few minutes and the WordPress attack surfaces that stay open after the update.

Read article Guide

WordPress security: the practical guide for businesses

Updates, plugins, login, interfaces, server, backups and monitoring, with a checklist.

Read article Emergency

Website hacked? What to do first, a guide for small businesses

First steps after a hack: spot the signs, preserve evidence, clean up, get the Google warning removed and check reporting duties.

Read the post Self-check

Small business website security: a checklist you can run yourself

A 15-minute self-check for WordPress, Shopify, Wix or Jimdo sites, and when an outside test is worth it.

Read the post Shopify

Shopify store security: what merchants have to do themselves

What Shopify protects and what merchants must do: staff accounts, two-step login, apps, scripts and phishing, with a checklist.

Read the post

MCP and agent security

How MCP servers and AI agents become attack surface, and how to secure them structurally.

MCP and agent security

Securing MCP servers: the practical guide

An MCP server is not a plugin, it runs with full access. The most common vulnerability classes and the concrete countermeasures at a glance.

Read the post MCP and agent security

The OWASP MCP Top 10, explained in practice

The open reference for MCP security, class by class: where each one breaks and how to counter it concretely.

Read the post Our research

CVE-2026-15583: SSRF in the Grafana MCP Server Explained

Our finding in the Grafana MCP Server: how credentials reached foreign hosts, who was affected and what the 0.17.2 fix changes.

Read the post Our research

CVE-2026-114123: Missing Authentication in the D365 F&O MCP Server Explained

Our finding in the D365 F&O MCP Server: why Azure deployments served X++ source without authentication and what the 1.11.0 fix changes.

Read the post Our research

CVE-2026-104776: File Read via kubectl_patch in mcp-server-kubernetes Explained

Our finding in mcp-server-kubernetes: how kubectl_patch read server files because a check its sibling tools had was missing.

Read the post Our research

CVE-2026-110787: How the pREST MCP Endpoint Bypassed the expose Settings

Our finding in pREST: how the MCP endpoint bypassed the expose settings and what 2.4.1 fixes.

Read the post MCP and agent security

The OWASP Top 10 for Agentic Applications, explained in practice

The new OWASP reference for autonomous AI agents (ASI01 to ASI10), class by class: from goal hijack to rogue agents.

Read the post OWASP LLM Top 10

The OWASP Top 10 for LLM Applications 2026, Explained in Practice

All ten risks of the 2026 edition from LLM01 to LLM10 with an example, a test and mitigations.

Read the post AI pentest

LLM Pentesting Checklist: Testing an AI Application Before Launch

Scope, seven test areas from prompt injection to cost abuse, OWASP 2026 mapping and how to prepare before launch.

Read the post MCP and agent security

MCP and OAuth: securing the trust anchor

MCP uses OAuth 2.1 as its trust anchor. How to pin the authorization server and PRM origin, cut the scope, and verify the token audience.

Read the post MCP and agent security

Prompt injection and tool poisoning in MCP servers

The most dangerous MCP class: injected content triggers the server's writing tools. How to prevent it structurally.

Read the post Prompt injection

Prompt Injection Testing: Test Plan, Test Cases and Scoring

Map the attack surface, build test cases for direct and indirect injection, score hits by impact, with a checklist.

Read the post MCP and agent security

AI agent security: the overview

AI agents act with real permissions in real systems. The broad entry point to their attack surfaces, from tool access to MCP.

Read the post Microsoft 365 Copilot

Rolling out Microsoft 365 Copilot securely: risks and configuration

Oversharing, sensitivity labels, prompt injection, agents and audit: what to configure before the rollout.

Read the post n8n

n8n security: risks, known vulnerabilities and hardening

Known vulnerabilities and BSI advisories, common misconfigurations, webhooks, community nodes and a hardening checklist.

Read the post

Penetration testing and security testing

What a defensible security proof costs, how it runs, and when which test fits.

Penetration testing

Penetration testing: process, duration and what it costs

How a penetration test runs, how long it takes, and what drives the cost. An honest overview of scope and proof.

Read the post Fundamentals

Vulnerability assessment: what it is and when you need one

What a vulnerability assessment delivers, how it differs from a penetration test, and when each one is the right call.

Read the post Pentest provider

Choosing a pentest provider: how to recognise a good one

How to recognise a good penetration testing provider: criteria, red flags, ten questions for the first call and what a proposal needs.

Read the post API pentest

API pentesting checklist for SaaS and software teams

API pentesting based on the OWASP API Security Top 10: scope, test accounts per tenant, test steps with examples and scanner limits.

Read the post Supabase

Supabase Row Level Security Best Practices

Getting row level security right: common mistakes in AI-built apps, policy examples and a self-test with a second account.

Read the post Vibe coding

Vibe Coding Security Checklist: Seven Risks and How to Test Them

Seven common mistakes in apps built with Lovable, Bolt or Cursor, and a self-test for each that you can run without a security team.

Read the post Website

Content Security Policy and Security Headers Done Right

CSP without unsafe-inline, HSTS and frame-ancestors, with configs for Vercel, Netlify, Apache and nginx and a testing guide.

Read the post OWASP

OWASP Top 10 2025: Categories and Changes Explained

All ten categories A01 to A10 with an example and how to test, what changed since 2021, and why it is not a testing standard.

Read the post AI agents

Claude Code Security: Hardening Coding Agents

Permissions, approval modes, sandbox, prompt injection, MCP and secrets: how teams use Claude Code and Cursor safely.

Read the post AI security

AI Red Teaming: What It Is and How It Works

How it differs from pentests and LLM scans, the engagement process, attack goals and the MITRE ATLAS, OWASP and NIST frameworks.

Read the post Website

Website Security Check: 8 Steps for Small Firms

Eight checks with free tools, how to read the results, and what no automated scan can find.

Read the post Lovable

Lovable Security Issues: What Is Documented and How to Fix Them

What is documented about security issues in Lovable apps, what the scan covers and a checklist before launch.

Read the post Firebase

Firebase Security Rules Best Practices

Why the API key may be public, common mistakes, Firestore and Storage rule examples and testing with the emulator.

Read the post

Compliance and regulation

NIS2, ISO 27001 and the path to an audit-ready proof, without certification theater.

NIS2

NIS2: who is affected and what to do now

NIS2 covers far more organizations than the old directive. Who is affected, which deadlines apply, and the concrete steps due now.

Read the post NIS2

NIS2 registration in Germany: who, by when and how it works with the BSI

Who must register, the Section 33 BSIG deadline, the ELSTER certificate process and what happens if you miss it.

Read the post NIS2 supply chain

NIS2 supply chain requirements: what your customers will now ask of you as a supplier

What customers ask of suppliers under NIS2: legal basis, typical clauses and evidence, preparation and a checklist.

Read the post ISO 27001 for software teams

ISO 27001 for SaaS and startups: what really counts

How a lean ISMS takes shape and how to collect evidence that holds up in enterprise procurement. ISO 27001 placed against SOC 2.

Read the post EU AI Act

The AI Act and AI governance: what companies need to do now

Which obligations the EU AI Act brings for your company, which deadlines are running and how to set up AI governance in practice.

Read the post AI policy

AI acceptable use policy: is it required, what goes in it, and a template outline

Is an AI policy required, what goes in it, and a template outline to adapt, with the most common mistakes.

Read the post Cyber Resilience Act

Cyber Resilience Act reporting obligations for software and SaaS manufacturers

Since 11 September 2026 the 24-hour early warning applies to exploited vulnerabilities. Deadlines, reporting route, SaaS scope and a checklist.

Read the post ISO 42001

ISO 42001: the AI management system for SMEs and SaaS companies

Structure of the standard, Annex A, how it fits ISO 27001 and the EU AI Act, and the path to certification by an accredited body.

Read the post