In the early stages of search, ranking algorithms were easily manipulated through tactics such as hidden text, link farms, and keyword…

A few months ago, a friend told me about something strange that happened while she was checking her bank account on her phone. The page…

Introduction
APIs (Application Programming Interfaces) power almost every app you use today, from social media and banking to fitness…

Google Labs unveils Disco, an experimental AI browser powered by Gemini 3. It features GenTab, which can generate interactive Progressive Web Apps (PWAs) from web content.

New flaws found in React Server Components risk a Server-Crashing DoS (CVSS 7.5) via infinite loop and Source Code Disclosure (CVE-2025-55183). Update to v19.0.3/19.1.4/19.2.3 immediately.

A flaw in Apache Fineract risks Authorization Bypass via IDOR (CVE-2025-58137) in its self-service API, potentially exposing customer data. Also fixed: Weak Password Policy and Unmasked Server Keys. Update to v1.13.0.

New 01flip ransomware (written in Rust) targets APAC critical infra across Windows/Linux. The attackers use Sliver for C2 and older exploits for access. A curious "lockbit" ignore list was found in the code.

CISA added a critical XXE flaw (CVE-2025-58360) in OSGeo GeoServer to the KEV Catalog. The actively exploited bug allows attackers to read arbitrary files and perform SSRF on internal networks. Patch immediately.

A sophisticated cyber weapon previously linked to targeted espionage has gone rogue, flooding the threat landscape after its creation tools were leaked to the public. A new report from Check Point…

A sophisticated phishing campaign uses salary review lures to target M365/Okta SSO. Attackers proxy the login page to preserve customization and hijack critical session tokens via dynamic redirection.

A Critical (CVSS 9.8) flaw in Soledad WordPress Theme allows Subscribers to escalate privileges and gain full site takeover by exploiting an exposed AJAX action. Update to v8.6.9.1 immediately.

A movie torrent scam uses a DiCaprio film lure to infect PCs with Agent Tesla RAT. The attack chain uses LNK files and malicious code hidden in a subtitle file to achieve fileless execution via LotL tools.

GOLD BLADE (RedCurl) targets Canadian firms (80% of attacks) with espionage and QWCrypt ransomware. The group uses fake resumes and a BYOVD EDR killer (Zemana driver) to disable security controls.

Learn about types of XSS vulnerabilities and how to prevent them.

สวัสดีค่ะ วันนี้เราจะมาแชร์วิธีการหา root flag ในกล่อง Explosion ซึ่งเป็นกล่องใน Starting Point - Tier 0 ของ HackTheBox ค่ะ ถ้าพร้อมแล้ว…

SpearSpray is an advanced AD password spraying tool using Kerberos and LDAP, featuring jitter and domain policy awareness to bypass account lockouts for stealthy attacks.

Google has released an unscheduled Chrome update to patch a zero-day vulnerability already being exploited in active attacks.

Microsoft has released its December security updates: Patch Tuesday brings fixes for 57 vulnerabilities, including three zero-days (one

The investigation in Japan has detained two Chinese nationals suspected of orchestrating the largest known market-manipulation scheme involving

Experts at Doctor Web have identified a new click-fraud trojan, Trojan.ChimeraWire, which disguises itself as the activity of