Security R&D Lead
Tudor Lasuschevici
Tudor is Intrudify's Security R&D Lead, OSCP-certified, with 6+ years in offensive security across web, mobile and API testing.
Former senior penetration tester at Blackbox Information Security, after three years of independent bug bounty work. He now leads security R&D and sets the platform’s testing methodology and technical direction.
7 articles by Tudor
- PHP2Shell: Two Critical RCE Flaws in PHP Itself PHP2Shell is the name for two critical vulnerabilities in the PHP interpreter, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on CVSS v4.0. Either one gives an unauthenticated attacker code execution as the web server user, with no application bug required.
- arrayref: 86 Minutes of Compromise At 07:15 UTC on August 20, 2026, arrayref 0.3.10 appeared on crates.io, and within about 23 minutes, poisoned releases of internment 0.8.7 and append-only-vec 0.1.9 appeared. From the outside, everything looked like regular point releases of trusted packages.
- SaaS Penetration Testing: Why Multi-Tenancy Changes Everything For a SaaS product, the highest-severity finding is almost always the same shape: one customer reaching another customer's data. That is not a generic web app test.
- The Penetration Testing Process, Step by Step Most descriptions of the pentest process are written for testers. This one is written for the person who has to schedule it, approve it, and explain the report to an engineering team.
- Penetration Testing Methodology: PTES, OWASP and the Rest A pentest without a named methodology is a tester following their instincts. The instincts might be excellent, but you cannot audit them, compare them, or tell what was skipped.
- What Is Penetration Testing? A plain explanation of what a penetration test is, what separates it from a vulnerability scan, who needs one, and what the report should actually give you.
- Benchmarking Intrudify against two top-tier AI pentesters Two commercial AI pentesters had already been run over Fider and Photoview. We pointed Intrudify at the same targets, attacked them by hand, and compared what each engine actually catches.