Skip to main content
PHP2shellXBOW now tests for it and proves what is exploitable. Patch today, then prove it.
Black Hat Europe 2026The future is zero days away. Meet us in London.
AWS re:Invent 2026The future is zero days away. Meet us in Vegas.
Nico Waisman

Nico Waisman

CISO @ XBOW

LinkedInXGitHub
BlogSecurity Research
React2Shell (CVE-2025-55182): A Wake-Up Call for Modern Web Security and How XBOW Helps You Respond

React2Shell (CVE-2025-55182): A Wake-Up Call for Modern Web Security and How XBOW Helps You Respond

Nico Waisman
ResourceWebinars
XBOW in Action: Move Faster, Attack Smarter

XBOW in Action: Move Faster, Attack Smarter

Nico Waisman
BlogCompany News
From HackerOne’s Leaderboard to the NYSE Floor: Our Journey to the Cyber60

From HackerOne’s Leaderboard to the NYSE Floor: Our Journey to the Cyber60

Nico Waisman
ResourcePodcasts
Finding Large Bounties with Large Language Models | Security Wekly

Finding Large Bounties with Large Language Models | Security Wekly

Nico Waisman
BlogSecurity Research
CVE-2025-27888: Server-Side Request Forgery via URL Parsing Confusion in Apache Druid Proxy Endpoint

CVE-2025-27888: Server-Side Request Forgery via URL Parsing Confusion in Apache Druid Proxy Endpoint

Nico Waisman
BlogCompany News
XBOW on HackerOne: What’s Next

XBOW on HackerOne: What’s Next

Nico Waisman
BlogCompany News
Black Hat & DEF CON: Running XBOW Live, Presentation Slides, and The Talk You Didn’t Miss

Black Hat & DEF CON: Running XBOW Live, Presentation Slides, and The Talk You Didn’t Miss

Nico Waisman
BlogSecurity Research
The Campaign Is Not Available in Your Country: XBOW Discovered an SQLi While Attempting to Bypass Geolocation Restrictions.

The Campaign Is Not Available in Your Country: XBOW Discovered an SQLi While Attempting to Bypass Geolocation Restrictions.

Nico Waisman
BlogSecurity Research
How XBOW Turned a JavaScript Hint Into a Working File Inclusion

How XBOW Turned a JavaScript Hint Into a Working File Inclusion

Nico Waisman