Archive

On February 6, 2026, BeyondTrust published an advisory for a new critical command injection vulnerability, CVE-2026-1731, affecting their products Remote Suppo…

Post SMTP Plugin (= 3.2.0) Privilege Escalation Vulnerability Walkthrough Vulnerability Report CVE ID: CVE-2025-24000 Plugin: Post SMTP Type: Privilege Escalation via Broken Authentication Vulnerable Version: = 3.2.0 Fixed Version: 3.3.0 Patch Priority: High CVSS Score: 8.8 (High) OWASP Classification: A7: Identification and Authentication Failures Discovered by: Denver Jackson Published: July 21, 2025 Overview The WordPress plugin "Post SMTP"

Sonar researchers discovered a critical stored cross-site scripting vulnerability in RainLoop Webmail that allows attackers to hijack user sessions and steal emails simply by sending a malicious email. The article explains the root cause, exploitation, and security implications.

As the reader, I’m sure you’re thinking — “oh great, another EDR internals or bypass post”. I can fully understand that sentiment, as…

In this excerpt of a TrendAI Research Services vulnerability report, Richard Chen and Lucas Miller of the TrendAI Research team detail a recently patched double free vulnerability in the Windows Internet Key Exchange (IKE) service. This bug was originally discovered by WARP & MORSE team at

Our investigation uncovers two sophisticated telecom surveillance campaigns and, for the first time, links real-world attack traffic to mobile operator signalling infrastructure. The findings expose how suspected commercial surveillance vendors (CSVs) exploit the global telecom interconnect ecosystem, leverage private operator networks, and conduct covert location tracking operations that can persist undetected for years.

A critical unauthenticated RCE vulnerability in HuggingFace's LeRobot project (21.5k stars). The gRPC PolicyServer deserializes attacker-controlled data with pickle.loads() in two RPC handlers, allowing instant code execution without authentication.

Vulnerability intelligence that predicts avenues of attack with speed and accuracy.

A deep dive into Google's NTLMv1 rainbow tables. Learn how rainbow tables are structured and can be used to recover NT hashes from NTLMv1 responses.

Background

Learn how attackers exploit tokenization, embeddings and LLM attention mechanisms to bypass LLM security filters and hijack model behavior.

Launch Linux processes from a Windows application using the WslLaunch API. Pavel walks through the call, the missing import library, and what the returned process handle actually points to.

Alt title: Bullying LLMs into submission to find 0days at scale

Malware Analysis Crash Course Jae Young Kim and Nick Harbour FLARE Learning Hub Contents Contents Introduction Prerequisite Knowledge Setting Up Ackknowledgements About the Authors Chapter 1: x86 Basics Assembly and Disassembly Data Types x86 Registers Instruction Basics MOV NOP Hacking Assembly...

Table of Contents Introduction What is WinGet? WinGet as a PowerShell Execution Proxy The Limitations of Using winget.exe Directly Building YAML Payloads Removing winget.exe from the Equation How the COM API Technique Works The Interop Layer What the Process Tree Looks Like Bypassing EDR Solutions CrowdStrike Falcon Microsoft Defender for...

TL;DR

This is the technical write up of a severe vulnerability I reported to Telegram’s Bug Bounty program on March 9th, 2024.  Telegram fixed…

Learn how a classic SSRF vulnerability on ideas.starbucks.com was turned into full internal network enumeration using a curated list of non-resolvable hostnames - and why that hostname intelligence is the real edge.

Rust for Malware Developmentis a comprehensive, open-source reference repository maintained by Whitecat18 (Smukx) that implements over 60 distinct offensive security techniques entirely in Rust. Targe...

How pwn.ai turned a routine client pentest into multiple ImageMagick zero-days. By autonomously researching the product’s internals for days, it found a path from a single image upload to file leaks, security policy bypasses, and remote code execution across a wide range of default and real-world configurations.

I had $100 in unused Google Cloud credits from my Google One Ultra plan and figured I’d put them toward something interesting. Over the long weekend I ended up building an automated pipeline that scans thousands of Windows kernel drivers for exploitable vulnerabilities, specifically looking for ones that can be used in BYOVD (Bring Your Own Vulnerable Driver) attacks. On its first real run on a massive driver pack, it successfully flagged a zero-day in an ASUS driver.

Contribute to Zierax/My-Recon-Methology development by creating an account on GitHub.

This blog provides an in-depth analysis of the malicious “msimg32.dll” used in Qilin ransomware attacks, which is a multi-stage infection chain targeting EDR systems.

Once you gain a foothold on a Windows host, the next objective is often to compromise additional machines. The fastest way to achieve this is by harvesting credentials and other secrets for reuse. However, nowadays, most known techniques for collecting Windows secrets and credentials are detected and blocked by EDR

How to systematically extract struct field offsets from Apple's stripped XNU kernelcache using static analysis alone.

Author: Dr. Xiang Fu Roadmap: You need to first follow Tutorials 1 to 4 to set up the lab configuration. Then each tutorial addresses an ...

Executive Summary The EXPMON system detected a highly-sophisticated PDF exploit targeting Adobe Reader users. Based on our analysis, the sam...

I’ve had a number of people ask me what approaches I have taken to secure that initial foothold on a machine/network during a pentest engagement. Well, the blunt and honest answer to that question is…it depends 😸 Initial access comes in many forms and depending on the type of pentest engagement, you will be afforded or NOT afforded various types of “lures” you can use to acquire that first foothold. Most clients are open to the pentest team exhausting all their resources and offensive tooling to truly assess the client’s security controls. If not they should be. Because in a real world attack, you better believe the threat actor will not hold back! In today’s post, I’ll be going over a very traditional approach to achieving initial access using email as our attack vector of choice. I’ll go over various ways to send the email (gui and non-gui) and using attachments versus links. I’ll also explain how to contend with MOTW (Mark of the Web) and SmartScreen security restrictions on your downloaded payloads for the modern Windows 11 environment.