Public reports are a free masterclass. Most people read them wrong.

Introduction

I was testing an e-commerce application last year. Nikto found nothing. Burp’s active scan came back clean. On paper, the app looked locked…

The simple logic behind CORS Misconfiguration, how I test for it, and why it is one of the easiest bugs to find

Part 3 of my SQL injection series. First I stole hidden data. Then I logged in as admin with no password. This time, I make the database…

The code was never random, and the seed was on your screen

Understanding Content Security Policy for XSS Testing

SOC Analyst | Offensive\Deffensive | Sysmon | ProcMon | Malware | MITRE ATT&CK

A meticulous guide to neutralizing bloatware, silencing telemetry, and configuring a hyper-efficient environment without breaking system…

  TL;DR A serious libssh2 vulnerability now puts SSH clients at risk. Researchers track it as CVE-2026-55200, with a CVSS 4.0 score of 9.2. A remote attacker can corrupt memory and run code o…

Three critical MariaDB server vulnerabilities, including a CVSS 10 flaw, allow attackers to execute shell commands. Patch your database servers immediately.

Mitel patched 12 critical MiCollab vulnerabilities, several at CVSS 10.0. Unauthenticated command injection and SQL injection flaws need urgent updates.

ESET found vendor-signed UEFI applications vulnerable to a Secure Boot bypass. Attackers can run pre-boot code. Update firmware and the UEFI DBX now.

Two critical HAProxy vulnerabilities threaten reverse-proxy security. These flaws allow denial of service and smuggling attacks. Patch servers immediately.

What are CSRFs ?

Introduction

At a Glance Field Detail Malware family Prinz Eugen (Go-based ransomware, .prinzeugen extension) Threat actor Prinz Eugen group; linked to the operator handle ROOTBOY (suspected) Victims At least …

Malware Family: AryStinger Threat Actor: Unknown (Suspected) Victims: Over 4,000 legacy D-Link routers and NAS systems Delivery Vector: Exploitation of older CVEs Key Capabilities: Traffic proxyin…

India’s Tata Group has confirmed to Reuters that it recently suffered a cyberattack. Hackers claim they stole confidential Apple and Tesla documents from the company. Tata Electronics provid…

Apple confirms the AirPort Utility app is going away soon. Discover how the AirPort Utility deprecated status affects legacy Wi-Fi router management.

iOS 27 Developer Beta 2 brings Write with Siri on the keyboard, RCS inline replies, Wallet Insights, and an iPhone Mirroring fix.