TL;DR Apache patched nine Apache ActiveMQ vulnerabilities in version 6.2.7. Most cause denial of service, and several need no login. One flaw lets a connection hijack another connection’s te…

TL;DR Icinga patched three Icinga 2 vulnerabilities on 29 June 2026. Two let an unauthenticated attacker take over or crash the monitoring server. The third affects authenticated API users only. C…

TL;DR CISA published an advisory for five StoneFly Storage Concentrator vulnerabilities on 30 June 2026. Two rate a maximum CVSS score of 10.0. Both let an unauthenticated attacker run commands as…

TL;DR Researchers at HawkTrace published full technical details and proof-of-concept code for a Microsoft Exchange vulnerability tracked as CVE-2026-45504. The flaw lets a low-privileged user read…

TL;DR Attackers are exploiting a Citrix NetScaler vulnerability in the wild, tracked as CVE-2026-8451 (CVSS 8.8). The pre-auth memory overread affects appliances configured as a SAML identity prov…

We’re back, melting - we’ve tried shouting, screaming, and throwing things at the Sun, and it is just not working.

Before we begin our analysis, we want to be clear - given the number of vulnerabilities fixed (and some not mentioned..), we’ve struggled to…

Technical analysis of a logical lock screen bypass I discovered in Google Gemini and reported via Google VRP.

Em 2021, apenas 14% das empresas investiam em segurança há mais de cinco anos. Em 2026, esse número chegou a 67%. Cinco anos foram suficientes para que a maioria do mercado cruzasse a fronteira da maturidade operacional. 

Esses dados fazem parte do Brazilian…

In my previous disclosure, I detailed how Visma and Intigriti normalized critical data leaks. I promised I would continue to expose every…

What’s up everyone! Nitin here 👋

We often look at security bugs through the lens of broken code syntax or memory leaks. But some of the most expensive vulnerabilities in…

Table of Contents

Discover how client-side redirects can undermine SameSite=Strict and reintroduce CSRF risk.

INTRODUCTION

Passed on First. Came Back for More.

A stored XSS in tracking notifications, a €200 bounty, and the bug that almost made me miss my mother’s bhog offering

Password Reset Token Reuse → Account Takeover

From Code Writers to AI Orchestrators — the Industry’s Most Significant Shift Since the Cloud Era

A framework for turning “is our app secure?” into a defensible answer, how OWASP ASVS’s three levels turn security spend into a business…

A practical guide to configuring an iPhone for mobile application security assessments from a Windows environment.