Archive

For decades, many bug hunters and security pros have used manual testing, static analysis, and fuzzing to find vulnerabilities. Enter the age of AI. Many are skeptical, but when I look around I see more and more evidence that it's not "going to be" a...

One step closer to understanding the nature of the attacker: is ShadowSyndicate an Initial Access Broker, a ransomware affiliate or an underground hosting provider?

This research is an extension of Content-Type research from BlackFan. More specifically, the response Content-Type tricks. Unfortunately, the multiple Content-Type trick is not clearly explained by BlackFan. Therefore, I’ll explain and demonstrate how a single comma character can cause a parsing difference between the browser and different MIME type parser libraries.

Unmanned Aerial Vehicle communications are encountering increasingly severe multi-source interference challenges in dynamic adversarial environments, which impose higher demands on their...

AppLocker was introduced by Microsoft in Windows 7 to enable organizations to define which executables, scripts or installers are allowed to run in their environments. AppLocker can reduce the atta…

Securify provides reality checks to lower security risks and build up resilience against threats. Agile Security, Pentesting (scenario-based) and Red Teaming.

When Ivanti removed the embargoes from CVE-2026-1281 and CVE-2026-1340 - actively exploited pre-auth Remote Command Execution vulnerabilities in Ivanti’s Endpoint Manager Mobile (EPMM) solution - we sighed with relief. Clearly, the universe had decided to continue mocking Secure-By-Design signers right on schedule - every January. Welcome back to another

Discover how attackers can escalate privileges in Entra ID using Azure VMs, PRT theft, and device identity abuse. Learn how the “Evil VM” attack unfolds, and how you can defend against it.

🔍 Overview

Blackpoint's SOC uncovers a sophisticated Fake CAPTCHA campaign delivering Amatera Stealer through signed Microsoft scripts, steganography, and layered evasion.

Introduction Rate limiting is a crucial security feature to prevent abuse by controlling the number of requests a user or system can make…

🚨 A critical flaw in Post SMTP (≤3.2.0) let Subscriber users access email logs, intercept reset links, and take over admin accounts. ✅ Update to 3.3.0 now to stay protected!

Learn how SafeBreach developed malware integrated within Palo Alto Networks Cortex XDR, exploiting its ransomware protection feature.

How I could’ve broken into any Microsoft building, leaking guest/visitor and employee PII.

This writeup details multiple IP leak vulnerabilities I discovered affecting Brave's Tor window and Chrome VPN extensions that allowed a malicious actor to leak the real IP address of any visitor to a remote host. Also covers a connect-src CSP bypass for DNS-based data exfiltration and two new Popunder techniques that work on Chrome, Firefox & Safari.

CVE-2026-22200 impacts osTicket and lets anonymous attackers read arbitrary files and, in some cases, achieve RCE. Patched in osTicket 1.18.3 / 1.17.7.

Collection of LLMs finetuned for bughunting

LOLRMM site

Overview While actively hunting for phishing site, I came across multiple web pages impersonating PNB MetLife Insurance and presenting themselves as official policy premium payment gateways. This a…

A remote webpage can abuse an unauthenticated guest HTTP API to compromise the Windows guest container, then feed a malicious app entry leading to Linux host code execution on click.

Author(s): Vlad Pasca, Radu-Emanuel Chiscariu Sophisticated cybercriminal operation targets cryptocurrency users and Web3 employees Malwa...

The complete analysis of Vietnamese Stealer a Python-based info stealer using Telegram as a C2.

Exploiting Keyspace Reduction and Relay Attacks in 3DES and AES-protected NFC Technologies. Reducing 2TDEA keyspace from 2¹¹² to 2²⁸ through partial key overwrites and relay attacks.

While analyzing Windows Audio components, I discovered an interesting privilege escalation vector that exploits the Windows Audio architecture and can be used as a universal technique to exploit…

Highlights Introduction While the abuse of vulnerable drivers has been around for a while, those that can terminate arbitrary processes have drawn increasing attention in recent years. As Windows security continues to evolve, it has become more challenging for attackers to execute malicious code without being detected. As a result, the attackers often aim to […]

The Microsoft Autodiscover “Great Leak” explained – and how to prevent it