Cisco warned on September 16, 2026, about active attacks targeting a critical Cisco ISE vulnerability. The security flaw allows unauthenticated remote attackers to bypass web authentication and se…

One unexpected incident. One small exception. And a lesson I will never forget.

TL;DR A flaw in pgAdmin 4 allows remote actors to bypass authentication when Webserver mode is active. Specifically, attackers can forge identity headers to log in as administrators without passwo…

Authentication / Password Reset Testing

Reverse proxies, mutual TLS, and source allowlists put a real front door on infrastructure software that ships with no authentication.

While the industry argues about AI safety, one of the key layers, handing out access, can already be closed. The access-first…

Hello Hackers,

TL;DR CERT/CC released an advisory warning of an Authlib signature bypass vulnerability tracked as CVE-2026-96760. This flaw allows attackers to forge JSON Web Signatures (JWS) and inject maliciou…

How a manipulated verification response allowed an invalid OTP to advance a real registration flow

To exploit OAuth 2.0, you must first understand how its core components interact. When flaws appear in these trust relationships…