Highlights Introduction While the abuse of vulnerable drivers has been around for a while, those that can terminate arbitrary processes have drawn increasing attention in recent years. As Windows security continues to evolve, it has become more challenging for attackers to execute malicious code without being detected. As a result, the attackers often aim to […]

Table of Contents Preface TLDR Live Hacking Event 101 Getting invited Picking the target Why Google SecOps SOAR? Reading the docs Methodology SOAR Integrations Python execution environment aka RCE-as-a-Service IDE custom code validation bypass We are in, what next? Fetching the OAuth Access Token Access token introspection What is gke-init-python used for? Service Account impersonation Prior art What can gke-init-python do? Malachite enters the scene Revised architecture diagram Auth flow is complex Examining SOAR_SIGNED_JWT Connecting the dots Let’s sign our own JWTs! Vertical Privilege Escalation Full SSRF via the HTTPv2 integration Code Execution via SSTI in TemplateEngine PowerUp Full attack scenario The aftermath Remediation Closing Remarks Preface Link to heading This is a behind-the-scenes story of how I found a Service Account impersonation chain leading to vertical privilege escalation within Google SecOps SOAR.

Recently I ran an experiment where I built agents on top of Opus 4.5 and GPT-5.2 and then challenged them to write exploits for a zeroday vulnerability in the QuickJS Javascript interpreter. I adde…

Windows has supported computer telephony integration for decades, providing applications with the ability to manage phone devices, lines, and calls. While modern deployments increasingly rely on cloud-based telephony solutions, classic telephony services remain available out of the box in Windows and continue to be used in specialized environments. As a result, legacy telephony components still […]

Unauthenticated privilege escalation vulnerability discovered in the Modular DS plugin. 🚨 Learn how attackers gain wp-admin access, active exploitation details, and how to stay protected.

A pre-authentication vulnerability exists within DotNetNuke versions 6.0 to 10.0.1, assigned CVE-2025-52488, that allows attackers to steal NTLM hashes.

Vulnerabilities in AEM Forms The Searchlight Cyber Research Team discovered and disclosed three critical vulnerabilities in Adobe Experience Manager Forms to Adobe in late April 2025. As of writing this research post, 90 days have passed since our disclosure to Adobe. During this time, Adobe has only released a patch for one of the three

Synthient continues to track the Kimwolf DDoS and proxy botnet with this report, delivering significant findings on the inner workings, infection chain, and reliance on the residential proxy ecosystem. Kimwolf has been highly active since early August of 2025, with substantial growth over the past four months. The Synthient’s research team assesses with high confidence that the total number of infected devices has surpassed 2 million, primarily targeting Android devices running an exposed Android Debug Bridge (ADB) service via residential proxies. These findings further reveal an expansive network of compromised TV streaming devices used by providers to obtain large pools of IP addresses.Given Kimwolf's reliance on residential proxies for infections, we advise all proxy providers to block high-risk ports and restrict access to the local network. Users should check whether they are affected by visiting synthient.com/check. Infected TV boxes should be wiped or destroyed. Organizations should block connections to the referenced C2 servers and domains, and monitor network traffic for suspicious activity.Synthient expects to observe a growing interest among threat actors in gaining unrestricted access to proxy networks to infect devices, obtain network access, or access sensitive information. Kimwolf highlights the risks posed by unsecured proxy networks and their viability as an attack vector.

On September 25, 2025, Cisco published advisories for two new vulnerabilities, CVE-2025-20362, and CVE-2025-20333, which are known to be exploited in-the-wild …

IntroductionIn October 2024, InfoSect participated in Pwn2Own – a bug bounty competition against embedded devices such as cameras, NAS’, and smart speakers. In this blog, I’ll dis…

A Journey of Limited Path Traversal To RCE With $40,000 Bounty! #Introduce Myself: My Name is Abdullah Nawaf, Full Time Bug Bounty Hunter, Working actively in BugCrowd with a Top 50 Rank, Rank 11 for …

Security research blog

Note: In correspondence with Hexagon while disclosing the bugs below, they informed us that any sharing of source code would be considered a violation of their terms and license. The Java code has been replaced with similar code that illustrates the flow of the application and names have been changed. It seems that vulnerability research

The spyware attack targeting WhatsApp, disclosed in August as an in-the-wild exploit, garnered significant attention. By simply knowing a...

Introduction Hello, I’m RyotaK (@ryotkak ), a security engineer at GMO Flatt Security Inc. In May 2025, I participated in the Meta Bug Bounty Researcher Conference 2025. During this event, I discovered a vulnerability (CVE-2025-59489) in the Unity Runtime that affects games and applications built on Unity 2017.1 and later. In this article, I will explain the technical aspects of this vulnerability and its impact. This vulnerability was disclosed to Unity following responsible disclosure practices. Unity has since released patches for Unity 2019.1 and later, as well as a Unity Binary Patch tool to address the issue, and I strongly encourage developers to download the updated versions of Unity, recompile affected games or applications, and republish as soon as possible.

In June, 2025, Shubs Shah and I discovered a vulnerability in the online poker website ClubWPT Gold which would have allowed an attacker to fully access the core back office application that is used for all administrative site functionality.

Team82 is publishing some details on two serious vulnerabilities in two Red Lion Sixnet remote terminal unit (RTU) products, and in the Sixnet Universal protocol. Both of the vulnerabilities were assessed a CVSS v3 score of 10.0, and users are urged to apply patches provided by Red Lion.

Learn about CVE-2025-50154 and its risk of NTLM attacks and RCE even after Microsoft’s fix for CVE-2025-24054.

Huntress uncovered an attack utilizing a ClickFix lure to initiate a multi-stage malware execution chain. This analysis reveals how threat actors use steganography to conceal infostealers like LummaC2 and Rhadamanthys within seemingly harmless PNGs.

Looking to learn AWS penetration testing? Here are essential AWS pentesting techniques and tools to help you get started!

A case for question-mark smuggle: using Unicode surrogates to bypass input validation with replacement character fallback.

Pentesting Firebase Rəqəmsal oğrulara salam olsun. Pentest üçün mobile app göndərirlər, atırsan JADX ilə statik olaraq analiz etməyə. Şesi nəsə tapmaq üçün “secret_key” …

⚠ Важно: Все материалы предоставлены исключительно в образовательных целях.

Common OAuth Vulnerabilities

!exploitable Episode Two - Enter the Matrix