Research | Terra Security Blog

PatchSlop: How Security Patches Became Maps for AttackersTerra Security's PatchSlop report reveals an eightfold rise in reported broken open-source security fixes—and how patches become roadmaps for attackers.

CVE-2026-72898: Metabase SQLi Under Active Exploitation, and How Terra Customers Closed It in One ClickTerra shares details behind addressing CVE-2026-72898

From “100% on Juice Shop” to Production Reality: What We Learned Comparing AI Pentesting ApproachesLearn why headline scores on toy apps do not predict enterprise value and what a controlled benchmark says about platforms vs. CLI tools.

We Asked OpenClaw How to Hack It. It Gave Us the Blueprint.Read Terra Security's latest research involving a vulnerability with OpenClaw.

How To Evaluate AI-Assisted And AI-Driven Testing Systems And ToolsUnderstand benchmark bias, realistic testing methods, and what signals indicate real vulnerability discovery.

When AI Becomes the Attack Surface: CVE-2026-25724How Terra's agents discovered CVE-2026-25724 and what it reveals about securing AI systems as a new and fast-growing attack surface. Read the breakdown.

What's new at Terra

Critical Security Advisory: Unauthenticated RCE in React & Next.js EcosystemThis research post examines CVE-2025-55182 and CVE-2025-66478, two patched vulnerabilities in the React Server Components Flight protocol.

Another Open-Source PoC Generator? Cute. Now Let’s Talk About The Hard Part.Generating PoCs is the appetizer. The real value is discovery, validation, and proving whether a CVE is material to your system - safely and audibly.

Shai-Hulud-WormShai-Hulud is a reminder that modern supply chain attacks aren’t just about vulnerable code. They exploit how software is built, tested, and shipped.

How Terra’s AI Agents Uncovered a Critical SQL Injection Missed by Traditional Tools and Manual TestersRead this article to learn how Terra's AI agents uncovered a critical SQL Injection missed by traditional scanners and manual testers.

Stored XSS Full Account TakeoverThis article explains how Stored XSS works, how it can be abused to take over an account, and how to prevent it.

LabelContinuous is the new pentesting standard.Book a demo to see how you can operationalize
it for your organization with Terra.

Smooth sand dunes with gentle curves under soft light against a pale sky background.

Insights

PRODUCT

TECHNOLOGIES

PLATFORM CAPABILITIES

SOLUTIONS

RESOURCES

COMPANY

Insights

Product

Technologies

Platform Capabilities

Solutions by Outcome

Resources