Discover how attackers can escalate privileges in Entra ID using Azure VMs, PRT theft, and device identity abuse. Learn how the “Evil VM” attack unfolds, and how you can defend against it.

🔍 Overview

Blackpoint's SOC uncovers a sophisticated Fake CAPTCHA campaign delivering Amatera Stealer through signed Microsoft scripts, steganography, and layered evasion.

Introduction Rate limiting is a crucial security feature to prevent abuse by controlling the number of requests a user or system can make…

🚨 A critical flaw in Post SMTP (≤3.2.0) let Subscriber users access email logs, intercept reset links, and take over admin accounts. ✅ Update to 3.3.0 now to stay protected!

Learn how SafeBreach developed malware integrated within Palo Alto Networks Cortex XDR, exploiting its ransomware protection feature.

How I could’ve broken into any Microsoft building, leaking guest/visitor and employee PII.

This writeup details multiple IP leak vulnerabilities I discovered affecting Brave's Tor window and Chrome VPN extensions that allowed a malicious actor to leak the real IP address of any visitor to a remote host. Also covers a connect-src CSP bypass for DNS-based data exfiltration and two new Popunder techniques that work on Chrome, Firefox & Safari.

CVE-2026-22200 impacts osTicket and lets anonymous attackers read arbitrary files and, in some cases, achieve RCE. Patched in osTicket 1.18.3 / 1.17.7.

Collection of LLMs finetuned for bughunting

LOLRMM site

Overview While actively hunting for phishing site, I came across multiple web pages impersonating PNB MetLife Insurance and presenting themselves as official policy premium payment gateways. This a…

A remote webpage can abuse an unauthenticated guest HTTP API to compromise the Windows guest container, then feed a malicious app entry leading to Linux host code execution on click.

Author(s): Vlad Pasca, Radu-Emanuel Chiscariu Sophisticated cybercriminal operation targets cryptocurrency users and Web3 employees Malwa...

The complete analysis of Vietnamese Stealer a Python-based info stealer using Telegram as a C2.

Exploiting Keyspace Reduction and Relay Attacks in 3DES and AES-protected NFC Technologies. Reducing 2TDEA keyspace from 2¹¹² to 2²⁸ through partial key overwrites and relay attacks.

While analyzing Windows Audio components, I discovered an interesting privilege escalation vector that exploits the Windows Audio architecture and can be used as a universal technique to exploit…

Highlights Introduction While the abuse of vulnerable drivers has been around for a while, those that can terminate arbitrary processes have drawn increasing attention in recent years. As Windows security continues to evolve, it has become more challenging for attackers to execute malicious code without being detected. As a result, the attackers often aim to […]

The Microsoft Autodiscover “Great Leak” explained – and how to prevent it

Table of Contents Preface TLDR Live Hacking Event 101 Getting invited Picking the target Why Google SecOps SOAR? Reading the docs Methodology SOAR Integrations Python execution environment aka RCE-as-a-Service IDE custom code validation bypass We are in, what next? Fetching the OAuth Access Token Access token introspection What is gke-init-python used for? Service Account impersonation Prior art What can gke-init-python do? Malachite enters the scene Revised architecture diagram Auth flow is complex Examining SOAR_SIGNED_JWT Connecting the dots Let’s sign our own JWTs! Vertical Privilege Escalation Full SSRF via the HTTPv2 integration Code Execution via SSTI in TemplateEngine PowerUp Full attack scenario The aftermath Remediation Closing Remarks Preface Link to heading This is a behind-the-scenes story of how I found a Service Account impersonation chain leading to vertical privilege escalation within Google SecOps SOAR.

In bug bounty, we love talking about complex vulnerabilities, remote code execution, race conditions, deserialization chains, and zero-days…

Anthropic is an AI safety and research company that's working to build reliable, interpretable, and steerable AI systems.

Recently I ran an experiment where I built agents on top of Opus 4.5 and GPT-5.2 and then challenged them to write exploits for a zeroday vulnerability in the QuickJS Javascript interpreter. I adde…

Detailed Analysis of DragonForce Ransomware Author: S2W TALON (Byeongyeol An) First Published: Jan 14, 2026 Executive Summary (Introduction) The DragonForce Ransomware Group, first detected in …

Windows has supported computer telephony integration for decades, providing applications with the ability to manage phone devices, lines, and calls. While modern deployments increasingly rely on cloud-based telephony solutions, classic telephony services remain available out of the box in Windows and continue to be used in specialized environments. As a result, legacy telephony components still […]

Desoldering a drone's flash chip and reconstructing the firmware from broken data.

Leaked Knownsec documents reveal China’s cyberespionage ecosystem. Analyze TargetDB, GhostX, and 404 Lab’s role in global reconnaissance and critical infrastructure targeting.