In my previous post, we successfully tracked a live variant of Qakbot down to its native NT API execution layer…

A bank-grade SaaS shipped its OAuth client secret to every browser that loaded the page — and named it like a sticky note on a monitor. A…

Task 1 — Introduction

Task 1 — Introduction

The IT industry is rapidly embracing automation, cloud computing, and continuous software delivery, making DevOps one of the most in-demand…

Most people think private blockchains are the serious, grown-up version. Often theyre a database with extra steps. Heres the real…

Which One Actually Protects Your Backend — And When You Need Both

API1: Broken Object Level Authorization (BOLA)

Static SQL is predictable. Dynamic SQL is adaptable. A skilled Oracle developer knows when to use each.

How a single OR 1=1-- payload logs you in as administrator, no password needed.

The team behind Coinspaid Solutions steps into the spotlight with a mission to become the engineering voice of blockchain infrastructure.

A new WhatsApp malware campaign uses a multi-stage VBScript infection chain to silently install RMM software on victim devices across multiple countries.

Researchers uncovered massive fake shop campaigns targeting Europe. Attackers sell counterfeit goods by impersonating major brands and exploiting World Cup.

A FOSSBilling template injection flaw (CVE-2026-28496, CVSS 9.4) is exploited in the wild. Patch to 0.8.0 now to stop server-side template injection.

So this is my first ever bug bounty writeup. And honestly, I didn’t expect my first real finding to be this interesting. It’s not an XSS…

Whenever we are in a pentest, there is things we have to take into consideration while infiltrating a machine or exploiting it’s services…

Covering major incidents across Europe, USA, and Canada — January through June 2026

A single API call handed every registered user a Read/Write/Delete/List SAS token for an entire healthcare document container. Here’s my…

Date:12/06/2026