The best Penetration Testing newsletters

A security vendor blog covering newly disclosed and actively exploited vulnerabilities, with affected versions, severity context and remediation steps. It also publishes practical guidance on buying and scoping security services such as penetration tests.

The PRIDE Security Blog publishes offensive security research, including write-ups of a Microsoft Defender Automatic Attack Disruption bypass, a CVE-2024-29417 local privilege escalation in an E-TRUST identity system, and a multi-part series on attacking physical turnstiles. Readers get technical details, affected components, prerequisites and mitigation context for each finding.

SilentGrid is an offensive security consultancy whose blog publishes technical write-ups of penetration tests, including AI phone assistant testing, mobile WebView bridge exploits, and LLM agent failure modes. Readers get concrete, hands-on accounts of attack techniques and their root causes.

Step-by-step penetration testing writeups for Hack The Box machines, covering reconnaissance, initial access, foothold and privilege escalation with the commands used. Each issue walks through one machine, with difficulty ratings and notes on pitfalls encountered along the way.

A personal blog by r3pek covering open source software and infosec, including write-ups of HackTheBox machines and reflections on earning the OSCP certification. The posts are hands-on walkthroughs with command output and a practical, first-person voice.

A hands-on technical blog covering IoT and embedded security, including fuzzing ARM and MIPS firmware binaries with AFL++ in QEMU mode and attacking devices via bootloader access and TFTP. Readers get step-by-step walkthroughs of tools and attack setups aimed at security practitioners.

CYBR.SEC.Media is a cybersecurity news and media digest covering AI agent incident guidance, critical software vulnerabilities such as PHP2Shell, and developments in competitive hacking. Each issue pairs short news write-ups with links to podcasts, conference talks and related articles from the hub.

This is a corporate blog from penetration testing firm Vonahi Security, with posts promoting pentesting services and its vPenTest product. Readers get general explanations of network pentesting, grey box testing and compliance links, with a sales-oriented slant.

A weekly roundup of infosec news, bug bounty write-ups, tools, videos and job alerts, curated from around the web with short blurbs and links. The sample shows a mostly aggregated format, with occasional breaks in publication.

A daily roundup of cybersecurity news from a penetration testing firm, summarising vendor announcements and alerts from other outlets with promotional calls to hire the firm. Readers get a quick list of recent vulnerabilities, advisories and product launches, with little original analysis.

Short platform notices from Hacking-Lab, an online security training lab, covering how students submit challenge solutions, where to find the knowledge base, and how to connect to the lab over VPN. Readers get practical usage instructions for the platform rather than in-depth security content.

This is a blog-style feed of links to conference talks and keynote videos by security researcher Leigh-Anne Galloway, covering ATM and point-of-sale hacking and security research approach. Readers get pointers to recorded presentations rather than written analysis in the sampled issues.