Apple officially ceases all payment services in Russia as of April 1, 2026. Subscriptions, App Store buys, and iCloud+ renewals are now indefinitely frozen.

Progress ShareFile hit by critical 9.8 CVSS RCE flaws (CVE-2026-2699). Unauthenticated attackers can hijack configuration and execute code. Update to v5.12.4!

Iran's IRGC claims a strike on Oracle's Dubai data center, targeting U.S. tech infrastructure. Dubai officials deny damage as regional tensions escalate.

The Axios npm hijack exposed millions to a RAT. Discover how North Korean-nexus actor UNC1069 used a masterful phishing ruse to bypass 2FA and steal credentials.

A massive fire at an AWS facility in Bahrain highlights a dangerous shift toward kinetic strikes on cloud infrastructure. Is your multi-region strategy ready?

TP-Link warns of high-severity flaws (CVSS 8.7) in Tapo C520WS cameras. Attackers can bypass auth or blind your security. Update to firmware 1.2.4 now!

If you squint and look at the CISA KEV list, you might think it's made up exclusively of vulnerabilities in file transfer solutions.

While this would be wrong (and you shouldn’t squint, it’s bad for your eyes), file transfer solutions do play a decent role…

Today, we woke up with a nagging feeling: what if Citrix had, in fact, patched multiple Memory Overread vulnerabilities as part of CVE-2026-3055?

While we've been using our analysis from Part 1 (please read it first, as this post will be brief) to accurately…

Sequels? Pain? We're obviously talking about Citrix NetScalers, yet again.

Welcome back to another watchTowr Labs blog post - pull up a chair, we always welcome new members to our group therapy sessions.

If you asked a C programmer what they most dislike…

This overview of the basics of Cloud Security includes some tips and resources for getting started in defending the cloud.

Real-world account of how insecure databases and an AI chatbot left customer data exposed and how it could have been prevented.

While hunting for broken link takeover opportunities, I came across an old Google Cloud Storage bucket that was previously used for Helm…

Free Link 🎈

How I earned $12,500 finding GraphQL introspection and batch query vulnerabilities in a fintech startup’s API infrastructure

Based on “Reverse Engineering a WhatsApp 0-Click Vulnerability” by Billy Ellis

How context engineering and AI agents unlock real exploitation — not just recon — in penetration testing, red teaming, and bug bounty…

I was staring at a clean search page on a private bug bounty program. No errors. No leaked data. Just “No results” or a normal page load

Based on “Live bug bounty hunting on Hackerone | Live Recon | part 2" by The Cyberboy

By Shah kaif | “Every leaked API key started as a commit someone thought was private.” | LinkedIn

In March 2026, we ran BugQuest, a 31-day campaign covering everything you need to know about finding and exploiting broken access control vulnerabilities. From understanding the basics of authenticati...

Hello hackers, Welcome to the latest edition of Bug Bytes! In this month’s issue, we’ll be featuring:   Earning $180K via SSRFs Free Burp Suite Pro licenses for top hackers  Bypassing tricky file uplo...