Russian IT company among group’s latest targets. Attackers may have been attempting to target company’s customers in Russia with software supply chain attack.

Kaspersky researchers discovered previously unidentified commercial Dante spyware developed by Memento Labs (formerly Hacking Team) and linked it to the ForumTroll APT attacks.

Attackers are gaining access using a custom, Sandworm-linked webshell and are making heavy use of Living-off-the-Land tactics to maintain persistent access.

We bypassed human approval protections for system command execution in AI agents, achieving RCE in three agent platforms.

# Summary Prior to `langgraph-checkpoint` version `3.0` , LangGraph’s `JsonPlusSerializer` (used as the default serialization protocol for all checkpointing) contains a remote code execution (RC...

Learn how to assess Next.js apps for SSRF, XSS, CSTI, SSTI, CSRF, cache issues, and data leaks. Practical tips, checks, and tools for bug bounty and pentesting.

Arc Browser UXSS, Local File Read, Arbitrary File Creation and Path Traversal to RCE After announcing the bug bounty program I downloaded the browser and started looking for vulnerabilities, using my …

Retr0's Threat Research

Contribute to Metnew/write-ups development by creating an account on GitHub.

Minimal code to connect to a CEF debugger

Found a security vulnerability? Discover our forms for reporting security issues to Google: for the standard VRP, Google Play, and Play Data Abuse.

Technical breakdown of a Remote Code Execution vulnerability in Google Web Designer via a malicious Video Ad Template abusing the NinjaShell API.

We’re back - it’s a day, in a month, in a year - and once again, something has happened. In this week’s episode of “the Internet is made of string and there is literally no evidence to suggest otherwise”, we present even further evidence that as a species we made a fairly painful mistake when we discovered electricity - and it just got worse and worse. Today, inside this hellscape we call the Internet, a mean person has discovered a zero-day(s) in FreePBX (now lovingly called CVE-2025-57819).

Chrome V8 Type Confusion Zero-Day: CVE-2025-10585 - Detailed Code Analysis and Visual Examination

CVE-2025-54236 (SessionReaper): In-Depth Technical Analysis and Exploitation Mechanics

XSS to RCE in Google IDX Workstation: A Technical Deep Dive

I recently ran across an application that allowed access to a ClickHouse DB for my user. The access was allowed, so that isn’t an issue. However, when we as pentesters or bug bounty hunters get access to a DB legitimately or via SQLi, the first question that comes to mind is, “What can I do with this?”. Having not dealt with ClickHouse much, the first thing I did was search the internet for information related to pentesting a ClickHouse DB, and I did not find anything. So, I figured I’d write a bit about it.

CVE-2025–0133: Reflected XSS Vulnerability in Palo Alto GlobalProtect Gateway & Portal A reflected cross-site scripting (XSS) vulnerability (CVE-2025–0133) was recently discovered in Palo Alto …

How I hacked hundreds of companies through their helpdesk UPDATE: The Next Web wrote a story about my findings …

Fixed in version 16.3.0.0407 — $8,500 bug bounty. Another code execution bug following my November 2024 find.

Fixed in version 16.4.0.0711 — $3,500 bug bounty

Threat Research would like to acknowledge and thank the Paranoids, Spur, and Pim Trouerbach for their collaboration to identify, track, and disrupt this activity.  Key takeaways

Trends Description

A beginner's journey into secure code review, and how I accidentally rediscovered an 11-year-old vulnerability in libpng.

This report analyzes a historical class of security flaws known as “reflected vulnerabilities,”which were once potent zero-day attack vectors targeting early Windows versions and antivirussoftware. We examine classic exploitation techniques, such as parser attacks, packet fragmen-tation, and syscall abuse, which could lead to remote code execution (RCE) or privilege esca-lation. The objective is educational, demonstrating how modern defenses in Windows 11 andWindows Defender—such as Address Space Layout Randomization (ASLR), Data ExecutionPrevention (DEP), Control Flow Guard (CFG), and hardened parsers—have rendered this classof vulnerabilities obsolete. Proof-of-concept (PoC) code is provided solely to illustrate histor-ical concepts and is non-functional on modern systems, ensuring compliance with responsibledisclosure principles.

Mutation-Based XSS + V8 type confusion + V8 sandbox escape = RCE on Basecamp. Disclosed it on Hackerone: https://t.co/slsv3j4jXx go read the comments if you wanna see what a week of exploit dev pain looks like.

Learn how to use Mimkatz for hacking with this comprehensive guide to dumping credentials and performing lateral movement.

The Trellix Advanced Research Center has uncovered a sophisticated APT malware campaign, we’ve dubbed OneClik, specifically targeting the Energy, Oil and Gas sector through phishing attacks and the exploitation of Microsoft ClickOnce.

In this post I'll look at some use-after-free vulnerabilities in Chrome which were the result of object lifetime misassumptions based on objects being kept alive unexpectedly in audio callbacks.