Penetration Testing
Adversarial testing across your external, internal, and application attack surfaces.
Break What Others Miss.
Penetration testing, adversary simulation and security research across applications, infrastructure and identity.
Serving organizations nationally, with deep experience in critical infrastructure, local government, and regulated industries.
What We Test
Every engagement is scoped to your environment, executed by senior operators, and delivered with findings your teams can use.
-
-
Red Team and Social Engineering
Objective-based operations, assumed breach, and phishing, vishing and physical testing that measure whether your people and your defenders detect and respond.
-
Cloud and Identity
Attack paths through AWS, Azure, GCP and hybrid identity, from the outside in and from a compromised account outward.
Evidence of the Work
One weakness, what it enabled, and what fixed it. Client work stays under NDA, so the evidence here comes from our published research.
Our analysis and checker
A PHP worker that carries one request into the next
- The weakness
- A long-lived PHP worker keeps per-request state in process globals and trusts every request to clean up on its way out. A fatal error, such as running out of memory, skips that cleanup.
- What it enabled
- The next request on the same worker reaches a pointer into freed memory. That is unauthenticated remote code execution on Apache mod_php before any application code runs, and on PHP-FPM through the session path: CVE-2026-109618 and CVE-2026-109619, both rated 9.2.
- What fixed it
- PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12 with every worker restarted, and an inventory that does not trust version strings, because vendor backports and end of life branches both report old numbers. We published a checker for that step.
The fix step. atarus-phpcheck Finds the runtimes that are really fixed, the ones on branches PHP no longer patches, and the interim settings. It never triggers the bugs.
Read the analysisSelected Research and Tools
What we publish: how current attacks work, what they exploit, and what stops them, plus the tools we release for any team to use.
Nextcloud servers were backdoored through Collabora's Built-in CODE Server for a month before it had a CVE.
CVE-2026-110447 is an unauthenticated OS command injection in the Collabora Online Built-in CODE Server app for Nextcloud, rated CVSS 9.2.
-
Arista VeloCloud Orchestrator is under attack for the third time since July. This time a read only login is enough.
-
LiteLLM 1.107.0 shipped a credential stealer through LiteLLM's own signed release pipeline. Every release control passed it.
atarus-phpcheck
Detection and inventory for PHP CVE-2026-109618 and CVE-2026-109619: versions, SAPIs, mitigating settings. Never triggers the bugs.
Also on GitHub: atarus-recon atarus-cloud atarus-webscan atarus-report-kit atarus-phishcheck See all tools
Use Something Now
These are free because we would like fewer avoidable breaches, and they are the checks we run on every engagement.
Free tools
-
Decode a token, read its expiry as a date, and catch alg none, algorithm confusion, missing exp and long lifetimes.
-
Parse a Content-Security-Policy and see which directives leave script injection open, with the fix for each.
-
Paste response headers from curl or devtools and get HSTS, CSP, framing, cookies and caching graded.
-
Read SPF, DMARC, DKIM, MX, CAA and A records the way a tester does, from a public DNS over HTTPS resolver.
From the reference
-
Web app recon: the first hour of a pentest
Map a web app before attacking it: proxy every request, read the headers, pull API routes from JavaScript bundles and list every input worth testing.
-
External recon and subdomain enumeration
Map everything a domain exposes on the internet: names from DNS and certificate logs, dangling records, open ports and edge devices, each with its fix.
-
How to write a pentest finding
Write a security finding an engineer can reproduce and fix without a call: impact title, severity reasoning, rerunnable steps, the fix, the retest.
Working with Atarus
We break things before an attacker does.
- Scope
- A scoping call sets the targets, the rules of engagement and the dates before anything is signed. Fixed-scope assessments skip the call: pick a package and submit the target.
- Deliverables
- A report your engineers can act on and your board can read. Every finding is verified, rated by its real impact, and comes with the fix and the order to make them.
- Follow-through
- Draft findings are reviewed with your team before delivery, leadership gets a debrief, and we retest once the fixes are in.
Ready to find out what your current defenses would miss?
All initial consultations are confidential and covered under mutual NDA. References and sample redacted deliverables are available upon request.