At a Glance Malware family GodDamn ransomware (rebrand of Beast, formerly Monster) Threat actor Hyadina, a ransomware-as-a-service developer tracked by Symantec Target / victims Enterprise Windows…

TL;DR Notepad++ v8.9.7 fixes five security flaws in the popular Windows editor. Technical details and proof-of-concept exploit code for all five Notepad++ vulnerabilities are public in the project…

TL;DR Google has shipped a Chrome security update that raises the Stable channel to 150.0.7871.124/.125 on Windows and Mac, and 150.0.7871.124 on Linux. The release fixes 15 security flaws, includ…

At a Glance Actor O-UNC-066 (Okta); tracked as CL-CRI-1147 / “Pink” by Palo Alto Unit 42; linked to The Com Activity type Vishing plus passkey-enrollment phishing, leading to account t…

TL;DR CISA has confirmed active exploitation of three SharePoint vulnerabilities: CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164. Threat actors chain them to gain access to on-premises SharePo…

At a glance Malware family Node.js backdoor (tracked as “TonRAT” by some researchers) Threat actor Unattributed; no named group Target / victims Hospitality sector; hotel staff Deliver…

TL;DR SonicWall has released hotfixes for two actively exploited flaws in SMA1000 secure access appliances. The SonicWall SMA1000 SSRF vulnerability, tracked as CVE-2026-15409, carries a maximum C…

TL;DR A researcher known as Nightmare-Eclipse has published details and proof-of-concept code for LegacyHive, a Windows User Profile Service privilege escalation flaw. The LegacyHive exploit abuse…

“Every bug hunter dreams of finding that one small clue that leads to something much bigger.”

# Bina Erişim Güvenliğinde RFID: Teknoloji, Tehditler ve Azaltma

hwats hell machine

I’ve been meaning to build a dedicated environment for practicing AI red teaming techniques for a while now not because I enjoy fighting…

A team member started a penetration test against the Inlanefreight environment but was moved to another project, leaving a web shell in…

A beginner-friendly, step-by-step walkthrough of attacking, breaking, and detecting DHCP — safely, in an isolated lab.

Brr CTF es un challenge de tipo web, poco exigente pero te ayuda a determinar que tan pulida esta tu mentalidad para buscar información.

Hi everyone! Today I’m going to explain SSRF (Server-Side Request Forgery) in the simplest way possible so that everyone can understand it.

Authentication bypass is one of the most critical impacts of an SQL Injection (SQLi) vulnerability. In this walkthrough, we will break down…

The reconnaissance methods that help security professionals map attack surfaces before a single exploit is launched.

What I learned rolling out Application Security inside a large engineering organization

Web applications have become an essential part of modern businesses, powering everything from e-commerce platforms and banking systems to…