Archive

Stay current: Get research alerts for newly disclosed vulnerabilities and exposures If you're running WordPress and want to check if your instance is vulnerable, you can use our tool we've hosted here: https://wp2shell.com/. We held off on publishing this issue to give defenders a chance to upgrade their WordPress instances over the weekend, but during

this is how I pulled a critical file read on a bb target by changing my avatar

eSentire's TRU breaks down a TAG-150 attack chain using ClickFix lures to deploy Deno-based malware DinDoor and DenoRAT, ultimately loading the NightshadeC2 RAT/infostealer.

We put Claude Code through two blind Bug Bounty labs – DOM XSS and HTTP request smuggling – to see if it can find and prove real vulnerabilities.

A crafted manus:// Deep Link could replace the token used by Manus My Computer, reconnect the desktop app, and lead to remote code execution through its sidecar.

See how the "There and Back Again" NTLM relay attack coerces outbound auth to compromise Active Directory, plus the defenses that stop it.

Stay current: Get research alerts for newly disclosed vulnerabilities and exposures Smashing the ServiceNow Sandbox: Pre Authentication RCE This blog post is our second exploring pre-auth script execution security vulnerabilities in ServiceNow. If you haven't seen the first, which includes some background context, you can read it here. After finding our first pre-auth critical bug

It’s 2025, and at this point, we’re convinced there’s a secret industry-wide pledge: every network appliance must include at least one trivially avoidable HTTP header parsing bug - preferably pre-auth. Bonus points if it involves sscanf. If that’s the case, well done! SonicWall’s SMA100

What is the main purpose of a Content Management System (CMS)? We have to accept that when we ask such existential and philosophical questions, we’re also admitting that we have no idea and that there probably isn’t an easy answer (this is our excuse, and we’re sticking

A Kali365 device-code phishing campaign targeted financial and insurance firms via voicemail lures, Google Sites, and Tencent-hosted panel infrastructure.

Learn how CVE-2026-20230 enables Cisco Unified CM pre-auth RCE through WebDialer SSRF, exploit analysis, and mitigation steps

A ClickFix DLL side-load traced through a Polygon smart contract (EtherHiding) to 18 C2 domains and 153 confirmed hacked sites across three operators.

Note: This blog post describes the simulated malicious use of unrestricted local AI large language models and is written for information…

### Summary The FastCGI transport's `splitPos()` in [`modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go`](https://github.com/caddyserver/caddy/blob/master/modules/caddyhttp/reverseproxy/fastcgi/...

A hands-on guide to using a local open-source LLM to write fuzzing harnesses, then finding a real memory-corruption bug with AddressSanitizer, complete with runnable code and a downloadable lab.

Hi guys, I would like to file a vulnerability I found in the default Gitea docker image, which allows impersonation of users with a single header # Summary The Gitea Docker images ship an `ap...

A Redis 8.6 stream PEL ownership bug, a malformed RESTORE payload, and a jemalloc size class collision that turns a shared NACK into code execution.

Analyst note: Proofpoint uses the UNK_ designator to define clusters of activity that are still developing and have not been observed for long enough to receive a numerical TA designation. Key

A ZeroBEC research blog on a reusable DEBULL PhaaS framework, Microsoft Authentication Broker phishing, Turkish code-lineage markers, and GraphSpy-driven post-authentication behavior.

CVE-2026-20253 turns Splunk Enterprise, the platform built to catch intruders, into an unauthenticated way in. Here's how the exploit chain works, and how Miggo blinds it before Splunk's patch ships.

Hacker House provides leading cybersecurity services, expert consulting, and security training for organizations worldwide.

GhostLock (CVE-2026-43499) is a Linux kernel vulnerability found by VEGA that exists in every major distribution since 2011. Triggering the bug does not require any special kernel config or privilege. By turning it into a 97% stable privilege escalation and container escape, Google has rewarded us $92,337 in kernelCTF. This writeup covers the technical details of the exploit.

Sansec found a Magecart family that runs its skimmer straight out of Stripe. The attacker stores the card stealer in a Stripe customer's metadata and runs it...

Learn how you can easily determine the Screen refresh rate with the help of a little trick in the browser with JavaScript

This post cover how PowerShell becomes a main tool in offensive operations starting with the weaponization, delivery, attak-chain and post-exploitation.

Aikido's AI pentester found this file-access flaw in Rocket.Chat. A closer look at MongoDB's ObjectId() showed the weak randomness that makes it exploitable.

ZAP, or zero-hour auto purge, is an Exchange Online Protection (EOP) feature that's getting some extra features to deal better with spam and phish malware. New policy controls are available to control the feature.

Zero-hour auto purge (ZAP) in all organizations with cloud mailboxes handles messages in mailboxes retroactively identified as spam, phishing, or malware.