Black Kite Blog
Primary research, Focus Friday vulnerability roundups, and third-party cyber risk analysis from the Black Kite Research Group, updated weekly.
Latest from the Blog
- Focus FridayFOCUS FRIDAY: TPRM Insights on Critical Vulnerabilities in Progress WS_FTP, WordPress Core, MySQL, pgAdmin, and MLflow
- BlogTPRM Community Summit 2026 Recap: What Third-Party Cyber Risk Leaders Are Prioritizing Now
- BlogBuilding Vendor Risk Assessment In-House With AI: What Works and What Doesn’t
- Focus FridayFOCUS FRIDAY: TPRM Insights on Critical Vulnerabilities in php2shell, Plex2Shell, PAN-OS, Drupal Core, GitLab, Oracle WebLogic, BeyondTrust Remote Support, Fortinet, and Apache Tomcat
Focus Friday: TPRM Insights on Critical Vulnerabilities in Progress Ws_ftp, WordPress Core, Mysql, Pgadmin, and Mlflow
Black Kite's Focus Friday covers critical flaws in Progress WS_FTP, WordPress Core, MySQL, pgAdmin, and MLflow for TPRM teams.
Nov 6, 2026TPRM Community Summit 2026 Recap: What Third-party Cyber Risk Leaders Are Prioritizing Now
Five takeaways from the 2026 TPRM Community Summit in Charlotte, from continuous visibility to third-party AI risk, and where TPCRM leaders should start now.
Nov 4, 2026Building Vendor Risk Assessment In-house with AI: What Works and What Doesn’t
AI can parse SOC 2 reports and map controls. It can’t collect a decade of scanning. What building vendor risk assessment in-house gets you, and what it misses.
Oct 27, 2026Focus Friday: TPRM Insights on Critical Vulnerabilities in Php2shell, Plex2shell, Pan-os, Drupal Core, Gitlab, Oracle Weblogic, Beyondtrust Remote Support, Fortinet, and Apache Tomcat
Black Kite's Focus Friday covers critical flaws in php2shell, Plex2Shell, PAN-OS, Drupal, GitLab, WebLogic, BeyondTrust, Fortinet, and Tomcat for TPRM teams.
Oct 23, 2026Php2shell: Two Critical Remote Code Execution Vulnerabilities in the Php Core
Black Kite's Focus Friday unpacks php2shell (CVE-2026-109618 & CVE-2026-109619) — critical unauthenticated PHP RCE, highest risk on mod_php — and how TPRM teams...
Oct 21, 2026Focus Friday: TPRM Insights on Critical Vulnerabilities in Citrix Netscaler, Onlyoffice Docs, Mssql, Exchange Server, Sharepoint, Nginx Ui, Mariadb, and Proftpd
Black Kite's Focus Friday covers critical flaws in Citrix NetScaler, ONLYOFFICE, MSSQL, Exchange, SharePoint, NGINX UI, MariaDB, and ProFTPD for TPRM teams.
Oct 16, 2026Another Critical Netscaler Flaw, and Why You Can’t Patch Your Way Out of the Vulnerability Deluge
CVE-2026-107406 is the fifth NetScaler flaw since August. Here’s what that means for your supply chain and why prioritization, not patch volume, is the answer.
Oct 9, 2026Focus Friday: TPRM Insights on Critical Vulnerabilities in Citrix Netscaler, Sonicwall Sma1000, Exchange Server, Cisco Nx-os, Atlassian, Langflow, and Elastic
Black Kite's Focus Friday covers critical flaws in Citrix NetScaler, SonicWall, Exchange, Cisco NX-OS, Atlassian, Langflow, and Elastic for TPRM teams.
Oct 9, 2026Focus Friday: TPRM Insights on Critical Vulnerabilities in Kiteworks, Citrix Netscaler, Mikrotik Routeros, Openssl, and WordPress Core
Black Kite's Focus Friday covers critical flaws in Kiteworks, Citrix NetScaler, MikroTik, OpenSSL, and WordPress, and what TPRM teams should do now.
Oct 2, 20262,300 Mythos Vulnerabilities Disclosed. 421 Patched. That Gap Is in Your Supply Chain.
Mythos has disclosed 2,300 vulnerabilities to open-source maintainers. Only 421 are patched. That backlog is third-party cyber risk you don't control.
Sep 25, 2026Focus Friday: TPRM Insights on Critical Vulnerabilities in Screenconnect, Exim, Citrix Netscaler, Apache Tomcat, and Langflow
TPRM analysis of critical ScreenConnect, Exim, Citrix NetScaler, Apache Tomcat, and Langflow vulnerabilities and how to prioritize vendor remediation.
Sep 25, 2026Supply Chain Incident Response Starts Before the Incident
Supply chain incident response starts too late. Jeffrey Wheatman on making the decisions, automation, and vendor paths ready before a supplier gets hit.
Sep 15, 2026