I still remember the first time I heard the word “bug bounty.”

Akwaaba! gang, another part of my Static Android App Hacking series, today our focus is on exploiting Deep Links to achieve RCE. An easy…

On 29 June 2026, CISA added CVE-2026-48558 to its Known Exploited Vulnerabilities catalog. The flaw is a critical SimpleHelp authentication bypass in the OIDC login flow. Attackers now use it in t…

TL;DR Developers patched six high-severity wolfSSL security vulnerabilities in the embedded SSL library. These flaws include an X.509 trust-chain bypass and dangerous heap buffer overflows. Admini…

TL;DR Four critical security flaws currently impact all versions of the EVoke Systems Charging Station Management System. These EVoke Systems vulnerabilities allow attackers to hijack active sessi…

TL;DR Cacti fixed four critical flaws in version 1.2.31. Three allow pre-authentication SQL injection, and one allows unauthenticated local file inclusion. All four score between 9.3 and 9.8. Why …

When I first built the labs for Hackmetoo, the goal was simple: get working content in front of learners fast. PHP files, inline CSS, some…

I remember the first time I opened Burp Suite and thought it was enough on its own.

Where the news is always bad, but the analysis is always good.

A new ransomware strain leaves no instructions to pay, and AI just compressed the attack window from days to hours. Here is the one free…

2 domains: sevenkingdoms.local north.sevenkingdoms.local so kingslanding.sevenkingdoms.local(192.168.56.10) must be a DC in the first domain the north.sevenkingdoms.local has two subdomains one of …

Foothold

Introduction

A popular ad-blocking extension on YouTube proves far more perilous than its Chrome Web Store page suggests. Researchers from Island dismantled Adblock for YouTube recently. Consequently, they dis…

India’s Tata Group suffered a hacker attack earlier. Its subsidiary, Tata Electronics, assembles products for Apple, so it held various internal secrets from Apple and its component supplier…

To strengthen user privacy further, WhatsApp — Meta’s messaging app — has announced that it will formally introduce a “Usernames” feature later this year. In the future, when use…

TL;DR WSO2 patched seven vulnerabilities across its API platform, including WSO2 API Manager, in June 2026. The worst, CVE-2026-5430, scores a maximum 10 and bypasses JWT authentication. The rest …

TL;DR Synology fixed three vulnerabilities in Synology MailPlus Server, the email package for its NAS devices. The most severe, CVE-2026-13136, carries a maximum CVSS score of 10. Admins should up…