A long, long time ago, in a land free of binary exploit mitigations, when Unix still roamed the Earth, there lived a pre-authentication Telnetd vulnerability.

In fact, this vulnerability was born so long ago (way back in 1994) that it may even be older than…

Short story

SPKI pinning and TLS can prove that a mobile app reached the correct backend over a protected channel. They cannot prove that the client…

The pipeline from post one catches a lot. SAST finds insecure code patterns before they ship. Dependency scanning finds vulnerable…

Community Semgrep rulesets are a good starting point. The OWASP Top 10 pack, the secrets detection rules, the language-specific security…

A would-be credential stuffing thwarted

How The FBI Caught A Russian Hacker Sleeping On A Thai Beach

Hey everyone.

How to prevent brute-force attacks and server overload using scalable middleware.

Consistency and patience are not soft skills in bug bounty. They are the strategy.

Recently I have been involved heavily into researching PKI PIV secured Smart Cards, which has led to my discovery of a “new” TTP I will be…

Writeup of the "Voyage" machine of tryhackme

Welcome to this new Medium post. In this one, we will explore a powerful technique used in offensive security that allows us to bypass…

In the previous article, we explored the fundamental concepts of Active Directory, including domains, domain controllers, forests, trees…

Let me start with an honest confession: I was skeptical about AI in security for a long time.

What a real-world penetration test taught me about what businesses misunderstand about AI and why

Everything you need to know about decrypting HTTPS traffic: from theory to hands-on with real key log files and PCAP analysis

The offensive security ecosystem teaches us a golden rule: the weakest link is almost never a complex zero-day vulnerability, but rather…

The GIAC Worth Scale (Thanks Gemini)

OT security in 2026; why your physical world is running on cybersecurity assumptions from a decade ago, and why that matters right now.

Cuando la inteligencia artificial se convierte en el mejor socio del crimen digital.