Black Lantern Security (BLSOPS)

IIS Shortname Enumeration in the Big ‘26

Microsoft’s gift that keeps on giving

Oct 15 • Kyle Griffin

4

CVE-2026-79957 Insecure Direct Object Reference in ServiceNext

Overview

Oct 14 • Mark Gaddy

July 2026

CVE-2026-12118 - IBM webMethods Integration Server: Pre-Auth RCE via WmServiceMock

Bring Your Own Bytecode

Jul 21 • Micheal Reski, Jacob Holvick, Daniel Mansur, and Chris Grigsby

2

BBOT 3.0

New Features and Improvements in the Latest BBOT Release

Jul 8 • Paul Mueller

5

2

June 2026

April 2026

Artificial Foolishness: The Hidden Dangers of External-Facing LLMs

The rise of AI opens more doors to attackers

Apr 6 • Kyle Griffin

6

2

March 2026

red-run 2.0: Agent Teams

A Claude Code Agent Dashboard

Mar 30 • Kevin O'Riley

4

4

1

Amelia Booking Pro ≤ 9.1.2: Authenticated Customer-to-Admin Password Reset via IDOR

CVE-2026-2931

Mar 26 • Hunter Jensen

red-run

All work and no tokens makes Claude a dull boy...

Mar 10 • Kevin O'Riley

8

4

February 2026

CVE-2026-2103 - Infor Syteline ERP

Infor Syteline ERP

Feb 6 • Micheal Reski, Jacob Holvick, and Daniel Mansur

1

1

January 2026

Introducing CloudCheck: Comprehensive Cloud Provider Detection

An overhaul of BBOT's cloud detection

Jan 27 • TheTechromancer

6

November 2025

CVE-2025-12463— 9.8 Unauthenticated SQL Injection in Guetebruck G-Cam Series Cameras

Smile, you’re on camera.

Nov 3, 2025 • Jack Pas

3