We discovered an arbitrary file read vulnerability in Discourse's image pipeline by chaining a JPEG race condition with ImageMagick and Ghostscript.

See how Horizon3 reverse engineered CVE-2026-102489 in Zammad, reproduced the session leak, hijacked an admin session, and achieved remote code execution.

CVE-2026-63277: LibreOffice Calc RCE via calcext:data-mappings, sql provider and jdbc connector —... high severity. Runnable script, captured output,...

Part 1 of this week's saga can be found here. This research is a glimpse into the capabilities that power our Preemptive Exposure Management solution, enabling organizations to rapidly react to emerging threats: the watchTowr Platform. What Is A Citrix NetScaler? NetScaler, from Citrix (now under Cloud Software Group)

macOS creates a fully read/write CDC-ACM serial device node with no TCC gate. Chained with a HID keyboard interface on the same USB composite device, this exfiltrates SSH keys, cloud credentials, and secrets in 24 seconds through a channel that shows no consent prompts. Apple was notified on 2026-04-26, declined the report on 2026-05-20, and I am publishing this today after 4 months of silence following my final response.

During a recent assessment, I came upon a VPN management portal I had never seen before that I found to be a FatPipe MPVPN appliance. After a little research I discovered this was a monolithic native application, ideal for pointing Claude/GPT 5.6 sol at to hopefully find some vulnerabilities and land an old-fashioned native

CVE-2026-20093 is a CVSS 9.8 pre-auth password change on Cisco IMC via configConfMo/aaaUser. Lab notes unpack HUU 4.3.2.250063 vs 4.3.2.260007: nginx /nuova, FastCGI, xapireqproc manageUsers. Patch or isolate the BMC.

CTF/pwn writeups and V8 exploitation notes.

TantoSec turned an unauthenticated AES-CBC padding oracle in Telerik UI for ASP.NET AJAX into remote code execution, chaining a decrypt-versus-parse oracle, a predictable HMAC key, and a type-name deserialisation gadget.

Sansec discovered StyleSmuggler, an unpatched Magento and Adobe Commerce zero-day that gives unauthenticated attackers remote code execution. All current ver...

How a missing @PreAuthorize line in GeoNetwork led to unauthenticated Remote Code Execution across government geospatial infrastructure in 39 countries.

Introduction What if I told you six thousand of your employees were two steps removed from gaining full control over your IT infrastructure. If we told you this was related...

Prove or reject unauthenticated remote OS command execution as the PaperCut service account on stock PaperCut NG/MF 25.0.11 via a pre-auth Release Station / MFD card-ID flow reaching the external card-lookup runtime, then replay identically on stock 25.0.12 to confirm the fix blocks the chain. This maps to the PaperCut NG/MF URGENT Security Bulletin of 27 Aug 2026 active exploitation, all versions affected . Whether a stock remote mechanism exists is an open question; card-ID SQL injection and JDBC URL injection are unproven hypotheses only.

AmberWolf Security Research Blog

Multiple critical vulnerabilities at Plausible Analytics: pre-auth Storybook RCE, registration bypass with cross-tenant IDORs and stored XSS, and SSO verification SSRF to PostgreSQL RCE.

Vulnerability intelligence that predicts avenues of attack with speed and accuracy.

I remember watching Simon Scannell's REcon 2023 talk, You Have Become the Very Thing You Swore to Destroy, and being deeply impressed by how he turned ClamAV's own detection logic into an oracle for exploiting a service with no direct output channel. I remember hoping that, someday, I might have the

Hunting Exchange Server 0day like a detective It has been a while since my last blog post, not because I didn’t do anything (or I?), I just don’t have any time/ any motivation to start new blog …

HiveMQ Platform 4.54.0 Data Hub custom module upload extracts ZIP entries with path.resolve() and no containment checks. Using the shipped default…

Intro Something different this time. This post is based on a speech I’m giving on June 24th at Ya!vaConf in Poland. So, we will analyze WebGoat application which is written in Java to discover some vulnerabilities in the source code and then write an exploit using Python.

How a small code mistake allowed hijacking the Microsoft accounts of everyone in a Teams meeting.

Autonomous multi-LLM vulnerability research: full root-cause analyses and reproducible PoCs for 0-day RCE chains across enterprise, ICS/SCADA, ERP, and NMS products.

Rapid7 Analysis: Microsoft SharePoint JWT Token Authentication Bypass (CVE-2026-55040)

We’re back, melting - we’ve tried shouting, screaming, and throwing things at the Sun, and it is just not working. Before we begin our analysis, we want to be clear - given the number of vulnerabilities fixed (and some not mentioned..), we’ve struggled to have confidence in our attribution of “vulnerability specific CVE ID”. We’ve performed some informed, uninformed, random guesses - but as usual, please resist the urge to send us emails explaining how awful/wrong we are. We know some of yo

SafeBreach Labs uncovered 3 severe flaws in Telnet and Samba, two CVSS 10.0 RCEs and a root privilege escalation, hiding in legacy Linux services for decades.

Cybersecurity blog by Edra - Bug Bounty, Pentest, CTF

Drinor was awarded $150,000 for CVE-2026-20685 targeting Apple's Private Cloud Compute, the inference backbone of Apple Intelligence capabilities. This work is my contribution to Sentry's AI Security research initiative, run through SARC, the Sentry Applied Research Center. Our SARC focuses on evaluating systems that carry