CAPE's agent exposes unauthenticated localhost routes to the sample under analysis, enough to fingerprint the sandbox, plant bogus network IOCs on VirusTotal, and shut the whole analysis down with a single request.

A use-after-free in OpenVPN's tls-crypt-v2. The safety check meant to stop the server sending a client freed memory has a blind spot, so during a routine key renegotiation OpenVPN frees a buffer it's about to send — and hands whatever now sits in that memory to the client.

Analyzing and writing a PoC for CVE-2025-38352.

Overview Since February 2026, the XLAB large-scale network threat perception system has detected a new malware family active in cyberspace that adopts a Loader + Core (two-stage loading) architecture. Currently, the family has spawned multiple variants, with the main core functionality being the execution of large-scale Distributed Denial-of-Service (DDoS) attacks. It also possesses strong cross-platform adaptability and continuous evolution capabilities. Although the family's current activi

A novel and powerful twist on an old classic.

Say you handed me your phone, what’s the worst I could do in 10 seconds?

How to detect malware that runs on Linux systems without writing on disk

Tenebris-Gate is used to encrypt shellcode and bypass detection through layered evasion techniques.

Vulnerability discovery is an orchestration problem, not a frontier-model problem.

How Reddit accidentally leaked its spamurai system.

Technical analysis of a combination of two legitimate CivetWeb features producing arbitrary remote code execution.

Trying to coerce useful work out of LLMs without the harness is like supervising a room full of drunk toddlers, each convinced they're helping, none of them checking with each other and falling over the next.

Move past basic credential harvesting. Discover how modern attackers use ClickFix, BitB, and OAuth consent phishing—and how to train your users with Huntress SAT.

A single response-content-type query parameter on a public bucket object turns a forced image/png into text/html, which is stored XSS on the target's own origin. MinIO hands it to you for free. S3 takes one extra step.

Essential Kubernetes security best practices — pod security, RBAC, network policies, and runtime protection for containerized workloads.

SpecterOps reverse engineered Cortex XDR with LLMs to extract YARA rules, ML models, and behavioral detections.

Deep dive into Beacons: what they are, how they run in memory, the evolution of loaders (including prepended/Kayn styles), and the security implications defenders need to know.

Part 2: How the Red Agent bypassed backend resolvers to expose an entire airline booking database in fifteen minutes

At WWDC 2025, Apple announced macOS 26 Tahoe. One of the new features in macOS Tahoe is a new disk image format: ASIF. Designed for use with virtual machines (its documentation lives under the Virtualization framework), ASIF takes a lot of inspiration from existing virtual disk formats. Practically, that means it’s another sparse virtual disk format, and functions very similar to sparse VMDK, VHDX or QCOW2 files (for the uninitiated, it allow you to store a large disk, or file, in a smaller, “sparse” manner).

Xiaomi's MJA1 is a proprietary secure chip used in their recent cameras to protect sensitive data and device communications. With no public documentation available, we conducted a black-box security analysis covering hardware identification, I2C sniffing, flash dumping, and firmware reverse engineering. This post walks through how we mapped the chip's command protocol, brute-forced undocumented commands, and assessed its security properties.

A malicious Chrome extension observed in an Italian malspam campaign used Native Messaging to escape the browser sandbox, steal session data and execute remote PowerShell commands on Windows. This analysis explains the infection chain, its command-and-control channel and the main detection opportu

Microsoft, Google, Red Hat, Grafana and LlamaIndex all shipped verified live credentials to public GitHub. I built the pipeline that found them: Gemini 2.5 distilled into regex, then TruffleHog with active verification. 3,830+ verified secrets, 1,443 unique repos, 95% rotation rate.

A modular engine that runs real vendor detection logic from reverse-engineered EDR components against live or replayed Windows telemetry.

HackedAlert - Secure Today, Protect Tomorrow.

The structure of Windows binaries scrutinized.

Computer Architecture basics for Red Teamers

Contribute to Metnew/write-ups development by creating an account on GitHub.