Introduction In this guide, we’ll walk step-by-step through building a fully functional internal che...

Since the past months, a malware campaign run by unknown threat actors has been observed delivering an unknown loader leading to infostealer infections for Windows users, and the infamous Poseidon…

Learn how the FormBook payload operates on a compromised machine, including the complicated anti-analysis techniques employed by this variant. …

EvilWorker is a new AiTM attack framework designed to conduct credential phishing campaigns.

Analyze CVE-2025-32756, a Fortinet buffer overflow flaw under active attack, and see how NodeZero can validate exposure now.

In this post I’ll show you how I found a zeroday vulnerability in the Linux kernel using OpenAI’s o3 model. I found the vulnerability with nothing more complicated than the o3 API &#821…

Cascading Style Sheets (CSS) are ever present in modern day web browsing, however its far from their own use. This blog will detail the ways adversaries use CSS in email campaigns for evasion and tracking.

We have detected a new tactic involving fake CAPTCHA pages that trick users into executing harmful commands in Windows. This scheme uses disguised files sent via phishing and other malicious methods.

Cisco Talos built on Tenable’s discovery of a Google Cloud Platform vulnerability to uncover how attackers could exploit similar techniques across AWS and Azure.

Introduction Versa Concerto is a widely used network security and SD-WAN orchestration platform, designed to provide seamless policy management, analytics, and automation for enterprises. With a growing customer base that includes large enterprises, service providers, and government entities, the security of this platform is critical. Given its extensive adoption and potential exposure to external threats, we initiated research to assess its security posture and uncover possible vulnerabilities

In April 2024, I discovered a high-severity vulnerability in Visual Studio Code (VS Code = 1.89.1) that allows attackers to escalate a Cross-Site Scripting (XSS) bug into full Remote Code Execution (RCE)—even in Restricted Mode. The desktop version of Visual Studio Code runs on Electron. Renderer processes are sandboxed and communicate with the main process through Electron’s IPC mechanism. An XSS vulnerability in the newly-introduced minimal error rendering mode for Jupyter notebooks enables arbitrary JavaScript code to be executed within the vscode-app WebView for the notebook renderer.

ESET researchers uncover a Russia-aligned espionage operation that they named RoundPress and that targets webmail servers via XSS vulnerabilities.

Privacy is dead: For multiple months, any O2 customer has had their location exposed to call initiators without their knowledge.

CVE-2025-37752 is an Array-Out-Of-Bounds vulnerability in the Linux network packet scheduler, specifically in the SFQ queuing discipline. An invalid SFQ limit and a series of interactions between SFQ and the TBF Qdisc can lead to a 0x0000 being written approximately 256KB out-of-bounds at a misaligned offset. If properly exploited, this can enable privilege escalation.

How a simple file path bypass gave attackers shell access to GitLab servers

What could've been the largest data breach in the world - an attack chain on Google services to leak the email address of any YouTube channel

Subdomain enumeration is a fundamental and very important part of any offensive reconnaissance, discovering points of entry, exposed assets and/or information that will aid in further compromise of the target’s infrastructure.

In this post I will briefly describe the journey I went through while implementing defendnot. Even though this is most likely not what you expected to see here, but rather than going into full technical details on how everything works, I will describe what rabbitholes I went through and how painful everything was due to my ✨special✨ environment.

FreeDrain is a modern, scalable phishing operation exploiting weaknesses in free publishing platforms to steal cryptocurrency on a global scale.

In this excerpt of a Trend Vulnerability Research Service vulnerability report, Nikolai Skliarenko and Yazhi Wang of the Trend™ Research Team detail a recently patched code execution vulnerability in the Apple macOS operating system. This bug was originally discovered by Hossein Lotfi of the Trend™&

Despite shutting down, Inferno Drainer has returned with a sophisticated phishing campaign abusing Discord and targeting crypto users

In this post, we explore how to bypass AMSI’s scanning logic by hijacking the RPC layer it depends on — specifically the NdrClientCall3…

Gui Rambo writes about his coding and reverse engineering adventures.

Technical Explanation of NTLM Hash Leak via RAR/ZIP Extraction and .library-ms File

TL;DR — I built an automation that cloned and scanned tens of thousands of public GitHub repos for leaked secrets. For each repository I…

Phishers abused Google Sites and DKIM replay to send valid-signed emails, bypassing filters and stealing credentials.

Bug bounty hunting is full of surprises, and sometimes, the easiest vulnerabilities can pay the most. This is the story of how I stumbled…

Summary A vulnerability in PHP’s extract() function allows attackers to trigger a double-free in version 5.x or a user-after-free in versions 7.x, 8.x, which in turn allows arbitrary code execution (native code). Credit An independent security researcher, LCFR, working with SSD Secure Disclosure. Vendor Response The vendor (Zend) has addressed the issue: https://github.com/php/php-src/security/advisories/GHSA-4pwq-3fv3-gm94. Zend have … SSD Advisory – extract() double-free(5.X)/use-after-free(7.X/8.X) Read More »