Introduction

Introduction

Most payment flows look secure from the outside.

GraphQL is quickly becoming the standard for modern APIs, but as the saying goes, “with great power comes great responsibility” — or in our…

A security engineer’s honest, slightly unhinged, deeply practical guide to actually using AI in your daily workflow

GOAD (Game of Active Directory) is a fantastic lab for practicing AD pentest techniques. In this post, I’ll walk through how I fully…

Posted on May 10, 2026 by Bryan Alexander

At Least, Not How Most Are Implemented Today

Everyone talks about AI. I break it.

“You set up a containment unit designed to trap and contain even the most nefarious viruses, but you accidentally got trapped in it while…

Weakness: Information Exposure Through an Error Message
Severity:Medium (6.1)
Status: Triaged (Open) — Fix Pending

Weakness:Sensitive Information Disclosure / Improper Access Control
Severity: High
Status: Resolved
Program: Responsible Disclosure…

Welcome to this new Medium post, today I will show you an interesting way used by security software to detect the remote thread creation in…

This is part of my daily labs in preparation for OSCP. I am documenting everything I am learning, tools that I am using and reflections as…

Machines from HTB

How indirect prompt injection, vector database poisoning, and agentic trust exploits are reshaping enterprise AI security.

Abstract

Protect your AI apps. Spring AI issues urgent patches for three critical vulnerabilities causing data destruction, memory poisoning, and user data leaks.

Burp Suite Enterprise resource exhaustion via huge request body The /api-internal/login endpoint had no request body size limits at all. Zero checks in Jetty, no proxy limits, nothing. I sent one …

Detecting Kerberoasting Activity: Correlating Kerberos Events, PowerShell Logs, and Prefetch Artifacts

Most people learning cybersecurity spend time reading about vulnerabilities.