Introduction
You have probably heard the term “API” before, maybe when using apps like Spotify, Instagram or online banking among others…

Hi, I’m Mohamed Kamal, Offensive Security Engineer and bug bounty hunter

Stop learning 50 tools — master the one that actually finds real money bugs.

Descubre cómo la falla API9 (Improper Inventory Management) expone APIs Zombie y Shadow para un Bypass de seguridad crítico.

⚡Quick Overview

เมื่อไม่นานมานี้ ผมมีโอกาสได้เข้าฟังกิจกรรมที่บริษัทด้านไอทีแห่งหนึ่งเข้ามาแนะนำตัวเอง ว่าทำอะไร รับคนแบบไหน มีโปรเจกต์อะไรน่าสนใจบ้าง…

20+AI Tools for Effective Pentesting and OSINT Research

Link: https://tryhackme.com/room/techsupp0rt1

In the early stages of search, ranking algorithms were easily manipulated through tactics such as hidden text, link farms, and keyword…

A few months ago, a friend told me about something strange that happened while she was checking her bank account on her phone. The page…

Introduction
APIs (Application Programming Interfaces) power almost every app you use today, from social media and banking to fitness…

Google Labs unveils Disco, an experimental AI browser powered by Gemini 3. It features GenTab, which can generate interactive Progressive Web Apps (PWAs) from web content.

New flaws found in React Server Components risk a Server-Crashing DoS (CVSS 7.5) via infinite loop and Source Code Disclosure (CVE-2025-55183). Update to v19.0.3/19.1.4/19.2.3 immediately.

A flaw in Apache Fineract risks Authorization Bypass via IDOR (CVE-2025-58137) in its self-service API, potentially exposing customer data. Also fixed: Weak Password Policy and Unmasked Server Keys. Update to v1.13.0.

New 01flip ransomware (written in Rust) targets APAC critical infra across Windows/Linux. The attackers use Sliver for C2 and older exploits for access. A curious "lockbit" ignore list was found in the code.

CISA added a critical XXE flaw (CVE-2025-58360) in OSGeo GeoServer to the KEV Catalog. The actively exploited bug allows attackers to read arbitrary files and perform SSRF on internal networks. Patch immediately.

A sophisticated cyber weapon previously linked to targeted espionage has gone rogue, flooding the threat landscape after its creation tools were leaked to the public. A new report from Check Point…

A sophisticated phishing campaign uses salary review lures to target M365/Okta SSO. Attackers proxy the login page to preserve customization and hijack critical session tokens via dynamic redirection.

A Critical (CVSS 9.8) flaw in Soledad WordPress Theme allows Subscribers to escalate privileges and gain full site takeover by exploiting an exposed AJAX action. Update to v8.6.9.1 immediately.

A movie torrent scam uses a DiCaprio film lure to infect PCs with Agent Tesla RAT. The attack chain uses LNK files and malicious code hidden in a subtitle file to achieve fileless execution via LotL tools.

GOLD BLADE (RedCurl) targets Canadian firms (80% of attacks) with espionage and QWCrypt ransomware. The group uses fake resumes and a BYOVD EDR killer (Zemana driver) to disable security controls.