Archive

Intro Something different this time. This post is based on a speech I’m giving on June 24th at Ya!vaConf in Poland. So, we will analyze WebGoat application which is written in Java to discover some vulnerabilities in the source code and then write an exploit using Python.

Swarmer enables stealthy Windows registry persistence by exploiting mandatory user profiles and the Offline Registry API to bypass EDR detection. Learn how this technique leverages NTUSER.MAN files to modify the registry without triggering standard API monitoring.

Gareth Heyes - gareth.heyes@portswigger.net - @garethheyes It's quite common for webmail clients to render untrusted CSS in a trusted UI. They attempt to make this safe using CSS sanitization. In this

Kaspersky experts have discovered malicious TrueConf software installers. The Head Mare APT group uses them to deliver the PhantomCore and PhantomGraph backdoors to target systems by exploiting vulnerabilities in an unpatched TrueConf server.

How a small code mistake allowed hijacking the Microsoft accounts of everyone in a Teams meeting.

Guillaume Técher — Personal website

Autonomous multi-LLM vulnerability research: full root-cause analyses and reproducible PoCs for 0-day RCE chains across enterprise, ICS/SCADA, ERP, and NMS products.

A technical deep dive into how GitHub Copilot handles context, recent edits, model routing, local session memory, and network requests.

Rapid7 Analysis: Microsoft SharePoint JWT Token Authentication Bypass (CVE-2026-55040)

WebViews in mobile web3 wallets can quietly inherit the permissions granted to the wallet app itself. We found 20+ major wallets where a malicious dApp could access core permissions without authorization.

A Technical Walkthrough of How Vidar Defeats Application-Bound Encryption

We’re back, melting - we’ve tried shouting, screaming, and throwing things at the Sun, and it is just not working. Before we begin our analysis, we want to be clear - given the number of vulnerabilities fixed (and some not mentioned..), we’ve struggled to have confidence in our attribution of “vulnerability specific CVE ID”. We’ve performed some informed, uninformed, random guesses - but as usual, please resist the urge to send us emails explaining how awful/wrong we are. We know some of yo

Learn how Phantom Labs escaped the Microsoft Copilot Studio Code Interpreter sandbox, bypassed AI guardrails, and uncovered platform-wide security risks.

I gave an AI agent access to a cable modem, a serial console, Ghidra, and a custom GDB stub, then asked it to reverse the firmware and hunt for bugs. It re-discovered known vulnerabilities, found new ones, and wrote working exploits. This post covers the setup, what it managed to do on its own, and where I still had to step in. The real problem is that the same approach now works on millions of devices nobody plans to fix.

New Technique Bypass File Upload This write-up focuses on bypass file upload. Introduction During my security research on Outlook Web, I encountered an unusual behavior that led me to discover a …

tl;dr I built an agentic mobile security research system that runs the whole mobile bug bounty pipeline, from scoping a program to writing the report. Here is what happened when I pointed it at real programs.

先知社区是一个安全技术社区，旨在为安全技术研究人员提供一个自由、开放、平等的交流平台。

SafeBreach Labs uncovered 3 severe flaws in Telnet and Samba, two CVSS 10.0 RCEs and a root privilege escalation, hiding in legacy Linux services for decades.

Cybersecurity blog by Edra - Bug Bounty, Pentest, CTF

Drinor was awarded $150,000 for CVE-2026-20685 targeting Apple's Private Cloud Compute, the inference backbone of Apple Intelligence capabilities. This work is my contribution to Sentry's AI Security research initiative, run through SARC, the Sentry Applied Research Center. Our SARC focuses on evaluating systems that carry

SCTPhantom is a Linux kernel use-after-free in SCTP's dynamic address reconfiguration code.

A pre-authentication XSS to RCE chain in WordPress Core that allows unauthenticated attackers to achieve remote code execution on any default WordPress installation through the login page.

Read the research that led to the discovery of Active Directory privilege escalation vulnerabilities CVE-2026-25177 and CVE-2026-27912.

You can outsource the hacking, but not the understanding

Proven Step-by-Step Recon Techniques to Uncover Your First Vulnerabilities in Bug Bounty Programs

GhostLock (CVE-2026-43499) is a Linux kernel vulnerability found by Nebula Security that exists in every major distribution since 2011. After turning it into a stable privilege escalation and container escape, we took one step further and used GhostLock to develop the world’s first public Android 17 root. This writeup covers the additional exploit techniques used to migrate the exploit for Android.