Introduction

Hack your first website (legally in a safe environment) and experience an ethical hacker’s job.

A new malvertising campaign is using a fake Claude AI website to plant a new and undocumented backdoor named Beagle on user devices.

A responsible disclosure timeline that ended with a fix — but no bounty.

Introduction

Filtros parecem apenas query params, mas envolvem validação, segurança, autorização, performance, paginação, cache e consistência de…

ShinyHunters hackers defaced the official Canvas LMS portal after breaching Instructure systems, disrupting university access worldwide.

Hi, I’m mrx_w_ (Adem Ziane Berroudja), a bug bounty hunter on Bugcrowd. You can find me on Twitter and LinkedIn under mrx_w_. In this…

How CrowdStrike Outran SentinelOne While Running the Same Race CrowdStrike now generates roughly five times the revenue of SentinelOne, trades at five times the EV-to-revenue multiple, and commands a …

Pentesting is as much about the process as it is about the tools we use. What a successful engagement really comes down to is how thorough…

After spending some time on Modules I decided to take a chip at a challenge and this caught my eye :)

Disclaimer: This walkthrough was performed in a controlled lab environment for educational and authorized security testing purposes only.

Dirty Frag PoC released! Researcher v4bel discloses a universal Linux root exploit targeting the page cache. No patches yet—apply module mitigations now!

Rancher Fleet fixes a 9.9 CVSS flaw (CVE-2026-41050) allowing tenants to bypass ServiceAccount isolation and steal secrets. Upgrade your GitOps engine now!

Zabbix, the ubiquitous open-source monitoring solution used by enterprises to track the health of vast IT infrastructures, has released a series of security patches to address three significant vu…

{وَآتَاكُم م كُلِّ مَا سَأَلْتُمُوهُ ۚ وَإِن تَعُدُّوا نِعْمَتَ اللَّهِ لا تُحْصُوهُ ۗ }

An educational deep dive into mobile application security assessment, reverse engineering, and the illusion of security through obscurity.

Authentication mechanisms are often heavily protected against brute-force attacks on the main login page. However, developers sometimes…

⚠️ Disclaimer ⚠️ This write-up is for educational purposes only. It is meant to explain the thought process and steps taken to solve the…

Theory

“Saat pentest web, masalah terbesar bukan langsung cari celah.
Tapi… kita bahkan tidak tahu semua endpoint yang ada di aplikasi itu.”