Bendings Releases The Seam Report 2026 on Cyber, Physical and AI Security

Study of 78 documented intrusions examines testing gaps across suppliers, people, physical systems and AI, with new PHP2Shell analysis.

NEW YORK, NY, UNITED STATES, October 26, 2026 /EINPresswire.com/ — Bendings has released the October edition of The Seam Report 2026, a public-evidence study of how intrusions cross between digital systems, people, physical infrastructure and the organizations that own them. The report brings together Bendings’ original analysis of 78 publicly documented intrusion paths with research on exploited vulnerabilities, corporate incident disclosures and security testing requirements in the United States and the Gulf.

The study examines whether testing individual systems is enough to follow a complete intrusion. Under the report’s scope definitions, a typical red team scope could follow 33 of the 78 paths from beginning to end. Of the 45 outside that scope, 38 passed through systems or people outside the victim’s ownership. In 70 of the 78 paths, the individual steps on the victim’s own systems matched existing testing domains when considered separately.

Bendings’ method records the domain and owner of each step while preserving the order of the intrusion. It then compares the complete path against defined testing scopes. The analysis identifies where a test would require additional authority or cooperation from another organization, even when the individual technical steps fall within established testing disciplines.

The wider report examines CISA’s catalog of known exploited vulnerabilities, 135 cybersecurity incidents disclosed by US public companies and 50 testing regimes. Its chapters address supplier access, help-desk identity decisions, physical infrastructure, cloud recovery and data residency in the Gulf, AI-assisted testing and incident reporting duties. Each evidence set has its own method, timeframe and denominator.

The report proposes practical changes to how organizations plan and govern security testing. These include a register of crossings with an owner on each side, evidence of the expected control, a record of the last complete test and the authority needed for another. It also proposes ten controls for AI-driven testing, including scope enforced outside the model, approval points set by people, a stop mechanism held by the client and action logs the agent cannot alter. These are Bendings’ proposals, not adopted regulatory standards or product benchmark results.

The October edition includes new analysis of PHP2Shell and the operational work that follows vulnerability discovery. The PHP project patched two critical vulnerabilities on October 21, 2026. According to the PHP Foundation, signs of one problem appeared in 2024, while later reports from Calif, OpenAI and Wiz clarified its impact. Bendings examines the subsequent engineering, supplier coordination and service-availability decisions required to get fixes deployed.

On October 22, a UK minister reported 32 government services unavailable and four partially unavailable, largely because of precautionary measures, with no confirmed compromise of central government systems resulting from the vulnerabilities. The case is discussed alongside the broader October security disclosures that Bendings describes as Black October in its Gauge presentation. Original researchers and primary sources receive credit for the underlying disclosures.

The report and supporting case files, derived data and analysis code are available at https://bendings.com/research. The 78-case dataset retains its September 28 research cutoff; the October cases are subsequent analysis. The cases were selected for the available public evidence and are not a representative sample of all intrusions. The scope comparisons classify documented paths rather than measure the results of commissioned penetration tests. No client engagement data is included.

About Bendings
Bendings is a cybersecurity firm founded in 2013, serving governments and financial institutions in the United States and the Gulf Cooperation Council states. Its work includes reconnaissance, red teaming, penetration testing and defensive support. The firm sells security testing discussed in the report and discloses that commercial interest. More information is available at https://bendings.com.

Astrid Varenhold
Bendings
press@bendings.com

Media gallery