Cybersecurity Knowledge Base
Welcome to the Lean Security Knowledge Base. This is our home for expert, actionable insights drawn from over 17 years of hands-on, real-world penetration testing.
We go beyond generic advice to give you the practical, in-the-field guidance you need to secure your platform, build trust with your clients, and meet your compliance goals (like ISO 27001, PCI DSS, and tender requirements).
Latest Threat Briefings & Analysis
Our feed of the latest Australian threat intelligence, new adversary TTPs, and compliance updates.
Browse by Topic
Find the expert content most relevant to your technology and compliance goals.
Vulnerability Deep Dives
Technical breakdowns of the flaws we find in the wild. We explain the risk, the exploit, and the code-level fix.
Industry & Market Security
Tailored security strategies for your specific sector's compliance and threat landscape.
Healthcare Applications Security
Lean Security helps medical and healthcare device providers by simply ensuring that the mobile applications that payers, patients and doctors are using are completely protected from attacks and that the environment in which mobile applications are running has not be compromised.
weekly threat reports
Our feed of the latest Australian threat intelligence, new adversary TTPs, and compliance updates.
Ready to Secure Your Platform?
Our insights are based on our real-world testing. If you're ready to go beyond theory and get a practical, expert-led assessment for your platform, we're here to help.









A critical vulnerability in Adobe Commerce and Magento (CVE-2025-54236), dubbed "SessionReaper," is being ruthlessly exploited by threat actors using AI-driven tools to automate attacks at machine speed. With the Australian holiday trading season in full swing, this unauthenticated remote code execution (RCE) flaw poses an immediate existential threat to retail and B2B organizations. This alert outlines the mechanics of the attack, the role of AI in its weaponization, and the urgent defensive actions required to prevent a catastrophic data breach.