Researchers say FortiBleed used stolen and tested credentials to access exposed Fortinet firewalls, putting major organizations and public agencies at risk now.

A critical Apache Shiro LDAP Injection vulnerability in DefaultLdapRealm, CVE-2026-49268, allows authentication bypass. Update your framework immediately.

We did it manually. Now let’s see what happens when you hand it to a tool. Last part of the SSTI series.

Target: gitlab.smce.nasa.gov Program: NASA VDP (Bugcrowd) Severity: P3 — Broken Access Control / IDOR Status: Resolved

The Ultimate Account Takeover One-Two Punch

Jinja2 was Python. Twig is PHP. The vulnerability is the same — the path looks completely different. Part 3 of the SSTI series.

The CVE™ Program’s “Supplier CVE Numbering Authority (CNA) as Authorized Data Publisher Pilot (SADP Pilot)” has been up and running in…

A beginner-friendly penetration testing walkthrough of the DC-1 boot2root machine

When people think about penetration testing, they often imagine sophisticated exploits and advanced malware. In reality, many compromises…

Author’s Note: Back in 2013, I wrote one of my earliest technical articles on CodeProject — a step-by-step guide to integrating Twitter API…

Bookstore Category: Web / RCE Difficulty: Hard

New Splunk AI Toolkit vulnerabilities, including severe OS command injection (CVE-2026-20266), expose systems to attacks. Patch your instances immediately.

Attackers are actively exploiting a critical Gravity SMTP vulnerability (CVE-2026-4020) causing sensitive information exposure. Update your plugin now.

Critical Cisco ISE vulnerabilities expose networks to Remote Code Execution (CVE-2026-20181) and data theft (CVE-2026-20190). Patch affected systems now.

For years the narrative was about augmentation: AI makes security engineers faster, more accurate, better at handling volume. The human…

If you work for an organization with highly valuable intellectual property and use the claude instance provided by your corporate…

As many analysts quickly learn, Business Email Compromise (BEC) and phishing emails rarely rely on malware anymore — they rely on trust…

SQL injection has been a named, well-understood vulnerability class since the late 1990s. It has its own OWASP category, its own automated…