Archive

Workflow execution protections are now in public preview for GitHub Enterprise, organizations, and repositories. This new capability lets enterprise administrators define an allow list that controls who can trigger GitHub…

A research study into the Anti-Malware Scan Interface (AMSI) combining Ghidra decompilation of amsi.dll, Frida dynamic instrumentation, and live bypass testing with Windows Defender active. Six techniques are documented that achieve full Invoke-Expression bypass and were each confirmed end-to-end with a live reverse shell payload (Nishang Invoke-PowerShellTcp) against a patched Windows 11 host.

During an audit of recent Linux kernel patches, the JFrog Security Research team identified that despite fixes addressing the DirtyFrag vulnerability family, a residual issue remained unaddressed.

Striga uncovered a fail-open regression in Apache Tomcat's cluster encryption that turns a one-line code change into unauthenticated Remote Code Execution.

We could have pwned every Metabase Cloud tenant by chaining an H2 INIT sanitizer bypass into RCE, then cloud misconfigurations into a full multi-tenant cluster compromise.

Stay current: Get research alerts for newly disclosed vulnerabilities and exposures Times Are Changing These last few months have been super weird. We've ended up in a situation several times where we have learnt that an exploits life cycle has significantly been reduced due to the introduction of frontier models that are extremely capable at

Linux kernel page-cache poisoning via AES-256 chosen-plaintext on the RxGK RESPONSE path and why authenticated encryption did not stop it.

Learn how to identify and exploit web cache poisoning vulnerabilities using several different testing methods. Read the article now!

Arctic Wolf reverse-engineered a recovered CyberStrike Harvester binary and connected it to the broader FortiBleed operator workflow, showing how exposed perimeter credentials can quickly become full internal-network exposure.

Dollar-quoting to bypass a regex sanitizer, scalar subquery injection through an unquoted column name, and zero-knowledge blind extraction against PostgreSQL PL/pgSQL.

1. Overview A server-side request forgery (SSRF) vulnerability exists in Microsoft Exchange Server’s Exchange Web Services (EWS) InstallApp operation. When an authenticated user submits a ManifestUrl parameter via the InstallApp SOAP request, Exchange downloads the manifest from the supplied URL. The intranet address check that prevents SSRF is gated on the isBposUser flag, which is false for all on-premises Exchange deployments. This means the check is bypassed entirely in non-cloud environments, allowing an authenticated user to force the Exchange server to make HTTP requests to arbitrary internal or external URLs. Microsoft addressed this vulnerability in the June 2026 security update (KB5094139).

Onelogon: Taking over Active Directory Accounts via Netlogon, Authors: Alexander Neff, Tobias Holl, Kevin Borgolte

In this blog post, we describe multiple vulnerabilities we found in Linksys Wi-Fi routers, especially exploiting the “Intelligent Mesh™” functionality, which can be used to wirelessly link routers to act as a Wi-Fi mesh.

STAR Labs’ advisory on CVE-2026-41873 in Apache Pony Mail by Li Jiantao and Tevel Sho (disclosed 28 April 2026). Two independent bugs reach the same outcome — full admin takeover — without any authentication. In the modern Foal (Python) build, an attacker-supplied "oauth_token" URL drives a blind SSRF against the local Elasticsearch SQL endpoint, leaking the admin session cookie character-by-character (CVSS 9.1). In the legacy Lua build (now retired, no patch), a single unescaped query parameter in "email.lua" lets the attacker inject CRLF bytes into the Elasticsearch HTTP request and smuggle a second request that creates an admin account outright.

A static, single-page web mirror of THC's tips, tricks, and hacks cheat sheet for security research, Linux operations, SSH, networking, and practical command-line workflows.

Elastic Security Labs uncovers OXLOADER: a new Windows loader using .reloc section abuse and anti-VM checks to drop infostealer malware via Google Ads.

This is Part II. If you haven’t read Part I — HookChain, go do that first. Part I showed how to defeat userland NTDLL hooks with IAT manipulation, dynamic SSN resolution, and indirect syscalls. That was the state of the art in 2024.

The CCN project is co-financed by the European Regional Development Fund and the State Budget under the European Funds for Digital Development Programme 2021-2027. Fuzzing is an automated software testing technique that involves feeding random or deliberately malformed input data to detect bugs and security vulnerabilities. For years it has …

breakdown of the architecture behind Linear's speed: local-first sync, MobX observables, instant first loads, and a keyboard-first design.

Coming from V8 and landing in JavaScriptCore. Building the addrof/fakeobj/read64/write64 ladder from a single out-of-bounds write, and the JSC-specific walls (the gigacage, butterflies, NaN-boxing) that make the last step harder than it is in V8.

Slides from talks I have given at various IT conferences. - Print3M/MyTalks

Payload Fragmentation & Dynamic Assembly for AV Evasion Advanced Powershell Obfuscation for Offensive Security The Struggle Is Real Let me paint you a picture. It’s 2 AM. I’ve been fighting …

How I Discovered 23,000+ Leaked Records Through Google Dorking Hi, I’m mrx_w_ (Adem Ziane Berroudja), a bug bounty hunter on Bugcrowd. You can find me on Twitter and LinkedIn under mrx_w_ .In this …

A friend of mine once told me: If you ever spot an IIS blue screen, don’t stop there; there must be something.

Writeup of a collaborated bug on Bugcrowd where I was able to bypass Akamai WAF to exploit RCE on Spring Boot error page using SpEL