There are days in bug bounty hunting when you stumble across something tiny — almost too simple — and yet it reminds you exactly why web…

Some bug bounty stories start with clever payloads, boundary-pushing exploits, or hours of reverse engineering.

Spatial awareness is a core OSINT skill most overlook.

Hello, and thank you if you’re one of the few tech savvy, interested in HackTheBox reading this. This is one of the series that I’ve…

That free coffee shop Wi-Fi isn’t just slow — it’s a hacker’s playground. Here is your survival guide to locking down your connection…

In 2026, blockchain is no longer a niche innovation quietly maturing in the background of digital finance. It has become both a global…

Think of it like a magic mailbox. Anyone can drop a letter in, but only you have the key to open it. The mailbox actually has two keys…

Complete Walkthrough & Learning Guide

The BlueShrimp exploit targets a Bluetooth UAF flaw (CVE-2025-48593, CVSS 8.0) that can crash the service on Android Automotive and Wear OS. Phones are safe, but PoC is public. Patch immediately.

A High-severity flaw (CVE-2025-13654) in the Duc disk usage tool risks DoS and information leaks. An integer underflow in buffer.c allows out-of-bounds memory read. Update to v1.4.6 immediately.

A dangerous new Android malware called SeedSnatcher targets crypto users with overlay phishing on MetaMask/Trust Wallet. It uses BIP 39 validation to steal seed phrases and supports remote command execution for total device control.

Volexity exposed Russian APT UTA0355 using fake security conference sites and WhatsApp support to trick victims. The attacks steal Microsoft 365 OAuth and Device Code tokens for persistent access.

A Rust supply chain attack used typosquatting (finch-rust) and an unpinned dependency to silently update the sha-rust payload over two weeks, stealing credentials and private keys from developers.

CISA/NSA exposed BRICKSTORM, a Chinese state-sponsored backdoor targeting VMware vCenter/ESXi and ADFS servers. The self-restarting malware used DoH and nested TLS for 18 months of persistent espionage.

A High-severity flaw (CVE-2025-66566) in lz4-java allows remote attackers to read uninitialized memory (passwords/keys) from recycled buffers during decompression. Update to v1.10.1 immediately.

A Critical (CVSS 9.9) Auth Bypass flaw (CVE-2025-66489) in Cal.com allows attackers to bypass password checks and hijack accounts by supplying any value in the TOTP field. Update to v5.9.8.

WatchGuard patched five flaws in Fireware OS. CVE-2025-11838 (CVSS 8.7) allows unauthenticated VPN DoS, while CLI Command Injection risks RCE in the management interface. Update immediately to v2025.1.3.

FortiGuard exposed UDPGangster, a custom UDP backdoor deployed by MuddyWater APT. The malware evades network defenses and analysis by using UDP for C2 and checking for single-core CPUs/low RAM.

Google exposed Intellexa (Predator spyware vendor) using 15 zero-days since 2021, including the iOS "smack" exploit chain (JSKit). Google is issuing mass warnings to targeted users globally.

A Critical DoS flaw (CVE-2025-66418) in urllib3 allows malicious servers to crash client apps via an unbounded decompression chain. A streaming flaw also risks memory exhaustion. Update to v2.6.0.

A new ValleyRAT campaign targets English job seekers. The malware uses DLL sideloading via a trojanized Foxit PDF Reader executable to run a Remote Access Trojan and exfiltrate data.