Hello everyone! I’m here to share my Self-XSS escalation write-up, one that took me multiple failed attempts before I finally cracked it…

I’ve seen teams take large codebases, arbitrarily chunk them into context-sized inputs, and feed them into AI expecting it to uncover…

Introduction

The Silent Heist: How Cryptojackers Stole Millions Without Anyone Noticing

175,000 Ollama servers exposed globally. 31% answering without authentication. A health AI wide open. A cloud management AI fully…

Buffer overflow is one of the most well-known vulnerabilities in software security. Buffer overflow occurs when you try to write more data…

Overview

Learn to build targeted wordlists using OSINT and apply them in penetration testing.

On April 22nd, 2026, the Wordfence Intelligence Vulnerability Database publicly disclosed a critical arbitrary file upload vulnerability in…

Surveillance cameras are installed to keep places safe — but what happens when the cameras themselves become the vulnerability? Across 82…

Why blindly unzipping code into your IDE might be more dangerous than you think.

The CVE™ Program’s “Supplier CVE Numbering Authority (CNA) as Authorized Data Publisher Pilot (SADP Pilot),” announced on March 24, 2026…

Your login endpoint might be the most expensive API you run, and you probably don’t treat it that way.

From input validation to server hardening — what developers should be doing to prevent LFI from the ground up. Part 7 of the File Inclusion…

Using wordlists and fuzzing tools to automate LFI discovery and server file enumeration. Part 6 of the File Inclusion series.

If you’ve been pulling your hair out trying to connect Claude Code, Gemini CLI, or any AI coding assistant to Burp Suite’s MCP Server from…

I’m opening submissions for NextGenThreat.

There’s a moment every DevOps engineer fears.

Welcome to this new Medium post. Today we are going to use kernel read and write primitives to silence EDR network telemetry at the kernel…

Overview

This is a write-up and guide for the Benign room on TryHackMe.