TL;DR Researchers at HawkTrace published full technical details and proof-of-concept code for a Microsoft Exchange vulnerability tracked as CVE-2026-45504. The flaw lets a low-privileged user read…

TL;DR Attackers are exploiting a Citrix NetScaler vulnerability in the wild, tracked as CVE-2026-8451 (CVSS 8.8). The pre-auth memory overread affects appliances configured as a SAML identity prov…

We’re back, melting - we’ve tried shouting, screaming, and throwing things at the Sun, and it is just not working.

Before we begin our analysis, we want to be clear - given the number of vulnerabilities fixed (and some not mentioned..), we’ve struggled to…

Technical analysis of a logical lock screen bypass I discovered in Google Gemini and reported via Google VRP.

Em 2021, apenas 14% das empresas investiam em segurança há mais de cinco anos. Em 2026, esse número chegou a 67%. Cinco anos foram suficientes para que a maioria do mercado cruzasse a fronteira da maturidade operacional. 

Esses dados fazem parte do Brazilian…

In my previous disclosure, I detailed how Visma and Intigriti normalized critical data leaks. I promised I would continue to expose every…

What’s up everyone! Nitin here 👋

We often look at security bugs through the lens of broken code syntax or memory leaks. But some of the most expensive vulnerabilities in…

Table of Contents

Discover how client-side redirects can undermine SameSite=Strict and reintroduce CSRF risk.

INTRODUCTION

Passed on First. Came Back for More.

A stored XSS in tracking notifications, a €200 bounty, and the bug that almost made me miss my mother’s bhog offering

Password Reset Token Reuse → Account Takeover

From Code Writers to AI Orchestrators — the Industry’s Most Significant Shift Since the Cloud Era

A framework for turning “is our app secure?” into a defensible answer, how OWASP ASVS’s three levels turn security spend into a business…

A practical guide to configuring an iPhone for mobile application security assessments from a Windows environment.

Your workflow shouldn’t slow you down when you’re already juggling assessments, client deadlines, and a team that needs answers fast. Over…

Arjun Bahera is a security engineer based in India with eight years of experience spanning offensive security, application security, and…

🧩 The problem I didn’t expect