Archive

It’s 2025, and at this point, we’re convinced there’s a secret industry-wide pledge: every network appliance must include at least one trivially avoidable HTTP header parsing bug - preferably pre-auth. Bonus points if it involves sscanf. If that’s the case, well done! SonicWall’s SMA100

What is the main purpose of a Content Management System (CMS)? We have to accept that when we ask such existential and philosophical questions, we’re also admitting that we have no idea and that there probably isn’t an easy answer (this is our excuse, and we’re sticking

A Kali365 device-code phishing campaign targeted financial and insurance firms via voicemail lures, Google Sites, and Tencent-hosted panel infrastructure.

Learn how CVE-2026-20230 enables Cisco Unified CM pre-auth RCE through WebDialer SSRF, exploit analysis, and mitigation steps

A ClickFix DLL side-load traced through a Polygon smart contract (EtherHiding) to 18 C2 domains and 153 confirmed hacked sites across three operators.

Note: This blog post describes the simulated malicious use of unrestricted local AI large language models and is written for information…

### Summary The FastCGI transport's `splitPos()` in [`modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go`](https://github.com/caddyserver/caddy/blob/master/modules/caddyhttp/reverseproxy/fastcgi/...

A hands-on guide to using a local open-source LLM to write fuzzing harnesses, then finding a real memory-corruption bug with AddressSanitizer, complete with runnable code and a downloadable lab.

Hi guys, I would like to file a vulnerability I found in the default Gitea docker image, which allows impersonation of users with a single header # Summary The Gitea Docker images ship an `ap...

A Redis 8.6 stream PEL ownership bug, a malformed RESTORE payload, and a jemalloc size class collision that turns a shared NACK into code execution.

Analyst note: Proofpoint uses the UNK_ designator to define clusters of activity that are still developing and have not been observed for long enough to receive a numerical TA designation. Key

A ZeroBEC research blog on a reusable DEBULL PhaaS framework, Microsoft Authentication Broker phishing, Turkish code-lineage markers, and GraphSpy-driven post-authentication behavior.

CVE-2026-20253 turns Splunk Enterprise, the platform built to catch intruders, into an unauthenticated way in. Here's how the exploit chain works, and how Miggo blinds it before Splunk's patch ships.

Hacker House provides leading cybersecurity services, expert consulting, and security training for organizations worldwide.

GhostLock (CVE-2026-43499) is a Linux kernel vulnerability found by VEGA that exists in every major distribution since 2011. Triggering the bug does not require any special kernel config or privilege. By turning it into a 97% stable privilege escalation and container escape, Google has rewarded us $92,337 in kernelCTF. This writeup covers the technical details of the exploit.

Sansec found a Magecart family that runs its skimmer straight out of Stripe. The attacker stores the card stealer in a Stripe customer's metadata and runs it...

Learn how you can easily determine the Screen refresh rate with the help of a little trick in the browser with JavaScript

This post cover how PowerShell becomes a main tool in offensive operations starting with the weaponization, delivery, attak-chain and post-exploitation.

Aikido's AI pentester found this file-access flaw in Rocket.Chat. A closer look at MongoDB's ObjectId() showed the weak randomness that makes it exploitable.

ZAP, or zero-hour auto purge, is an Exchange Online Protection (EOP) feature that's getting some extra features to deal better with spam and phish malware. New policy controls are available to control the feature.

Zero-hour auto purge (ZAP) in all organizations with cloud mailboxes handles messages in mailboxes retroactively identified as spam, phishing, or malware.

Red Teamer & Low-Level Developer. Deep dives into Windows Internals, Kernel Exploitation, Driver Analysis, and Red Team techniques.

Technical deep dive into ClickFix tradecraft, a sophisticated social engineering driven initial access technique. Covers delivery methods, execution specializations, payload analysis, and detection strategies based on OrangeCon 2026 research.

Map how Claude built two FreeBSD kernel exploit chains, escaping a jail past KASLR and SMEP/SMAP, with a human still in the loop.

Contribute to SmtimesIWndr/gdid-reversal development by creating an account on GitHub.

Ransomware affiliates have long since abused Cloudflared tunnels to maintain persistent access to compromised environments. These tunnels can be utilized as a strong indicator of compromise when examined at-scale.

Static analysis of Browser Guard 3.1.5 (15M+ installs): Zstd-encoded on-disk databases, the heuristic rule engine that scans the live DOM, the Hubble false-positive service, the package update protocol, and a debug URL interface left in production. With reimplementations in C# and Python.