Archive

Introduction

Here you can read all about my research and techniques I’ve gathered over time!

Have you ever come across an endpoint that you instinctively knew was vulnerable, but you couldn’t quite understand what was happening on…

Hey, I’m Mahmoud Mosbah, a cyber security specialist at Isec.

Did you know that Gmail allows the use of the form HTML tag? This feature presents a potential security risk, especially when attempting…

“The real game isn’t always in what you learn — it’s in what others forget to mention.” 😎

اللَّهُمَّ انْفَعْنِي بِمَا عَلَّمْتَنِي، وَعَلِّمْنِي مَا يَنْفَعُنِي، وَزِدْنِي عِلْمًا

Details of our SuperNote Nomad research which led to the disclosure of a 0-click RCE vulnerability

Discover how critical vulnerabilities in browser-based crypto wallets allowed attackers to drain funds without user interaction.

The SVG file format can harbor malicious HTML, scripts, and malware

CVE-2025-3248 is a critical code injection vulnerability affecting Langflow, a popular tool used for building out agentic AI workflows. This vulnerability is easily exploitable and enables unauthenticated remote attackers to fully compromise Langflow servers. The issue is patched in Langflow 1.3.0.

Introduction During a garage cleaning, we found a DVB receiver and thought it would be a great target for vulnerability research.

Principal Security Engineer Tao Sauvage discovered two SAP flaws on a client project, resulting in a CVE and a custom tool.

A vulnerability in the WinRAR file archiver solution could be exploited to bypass the Mark of the Web (MotW) security warning and execute arbitrary code on a Windows machine.

What's that Skippy? Another Ivanti Connect Secure vulnerability? At this point, regular readers will know all about Ivanti (and a handful of other vendors of the same class of devices), from our regular analysis. Do you know the fun things about these posts? We can copy text from previous posts

Weeks after Trustwave SpiderLabs reported on the Greatness phishing-as-a-service (PaaS) framework, the team uncovered another PaaS dubbed Tycoon Group.

Security experts

Sekoia.io provides cyber teams with a SOC platform that can respond to security incidents, regardless of the attack surface.

Sygnia investigates Weaver Ant, a stealthy China-nexus threat actor targeting telecom providers. Learn how web shells enable persistence and espionage.

Defensive tools like AVs and EDRs rely on command-line arguments for detecting malicious activity. This post demonstrates how command-line obfuscation, a shell-independent technique that exploits executables’ parsing “flaws”, can bypass such detections. It also introduces ArgFuscator, a new tool that identifies obfuscation opportunities and generates obfuscated command lines.

Hackers exploit CSS in emails to bypass spam filters and track user actions, raising privacy concerns.

Unique 0-click deanonymization attack targeting Signal, Discord and hundreds of platform - research.md

Zimbra, a widely used email and collaboration platform, recently released a critical security update addressing a severe vulnerability in its postjournal service. This vulnerability, identified as CVE-2024-45519, allows unauthenticated attackers to execute arbitrary commands on affected Zimbra installations. In this blog post, we delve into the nature of this vulnerability, our journey in analyzing the patch, and the steps we took to exploit it manually. We also discuss the potential impact and

I previously blogged about spoofing Microsoft 365 using the direct send feature enabled by default when creating a business 365 Exchange Online instance (https://www.blackhillsinfosec.com/spoofing-microsoft-365-like-its-1995/). Using the direct send feature, it […]

Steve Borosh // Why Phishing? Those of us on the offensive side of security often find ourselves in the position to test our clients’ resilience to phishing attacks. According to […]