Unfold's Tech Blog

Research and insights from the Unfold security team on emerging threats, detection engineering, and the future of application security.

Why Working Integrations Still Miss Data

An application can look like one system while exposing different information through its API, its screens, its reports, and its database. A connection to one interface can succeed and still leave out exactly what you needed - so the real work is mapping each field to the right interface and verifying the result is complete.

September 23, 2026

Read the blog →

August 31, 2026

We Tried to Automate Detection Engineering. The Data Wasn't There.

We are publishing a public portal showing which attacker techniques actually leave a trace in thirteen common server applications. Across 356 assessments: 26% logged, 41% partial, 33% not logged at all. Here is the journey that led us to build it.

Read the blog →

Searching for bulletproof detections in cPanel Land

Analysis of CVE-2026-41940, a critical cPanel authentication bypass vulnerability that allows unauthenticated root access. We developed bulletproof detection rules by analyzing the exploit's core mechanics and unavoidable behaviors.

Read the blog →

February 11, 2026

A Threat Hunter’s Perspective on MongoBleed

A threat hunter's analysis of MongoBleed (CVE-2025-14847), examining why common detections based on PoC behavior are insufficient and how sophisticated attackers can evade detection by mimicking normal connection patterns.

Read the blog →