1. The Discovery: Finding Secrets in the JS Bundle

What’s up everyone! Nitin here 👋

Introduction:

In this walkthrough, I will go through the steps I took to compromise the TryHackMe Skynet machine. The attack involves SMB enumeration…

Exploring the Future of AI Agents, Foundation Models, and Security Automation

The blind spot in current AI guardrails

How a default Drupal install, a leaked config file, and a misconfigured SUID bit added up to a full root compromise.

I Chained Four Privilege Escalation Bugs to Root a Box — Here’s the Full Breakdown If you’ve ever felt stuck at "I got a shell, now what?" — this one’s for you. I just published a …

Telegram's t.iss.one links stopped resolving after the .ME registry applied serverHold. The app still works, while the reason for the domain action remains unknown.

Corporate storage systems are rarely taken offline unless the risk is serious. Progress Software has asked customers to shut down their ShareFile Storage Zone Controller servers immediately. The r…

The Initial Compromise and Detection A stolen package registry key enabled a cybercriminal to execute a severe jscrambler supply chain attack. They successfully uploaded five infected versions of …

TL;DR Broadcom has patched seven vulnerabilities in VMware Avi Load Balancer under advisory VMSA-2026-0005. The most serious, CVE-2026-47865 (CVSS 9.8), is a critical authentication bypass. It let…

In the generative AI computing arms race, Meta shatters the investment ceiling for AI infrastructure. Meta recently announced a massive expansion of its Richland Parish, Louisiana data center. Con…

Every guide out there tells you need 16 gigs of RAM, a dedicated GPU, and preferably a laptop that costs more than your rent. I have an…

Day 1: Understanding the Art of Web Application Hacking

Medium — CVSS 6.8 Accepted > Resolved > Rewarded

Introduction