Since late April 2026, compromised websites have been distributing a new modular malware with the curious name “TELEPUZ” through the ClickFix scheme. According to Elastic, the attacker…

Detecting Exposed API Keys Before Attackers Do

Category: AWS Security | DevSecOps | Cloud Security | Secrets Management

A real, hands-on audit — methodology, sources, and the actual code, broken down line by line.

Every secure application begins with a user registration page. Although it appears to be a simple form for creating an account, it is one…

Introduction

Exploring AI Data Retrieval Security Through a Practical TryHackMe Challenge.

When I was completing my graduation, I decided to test my college’s web infrastructure to put my theoretical knowledge into practice. What…

welcome to my first write-up. I started bug hunting about 3 months ago, and this was one of my first findings, so I would love to share it.

Fortinet says TTF Trap phishing emails hide Lua loaders in fake font files, deploying Remcos, XWorm, Agent Tesla and Snake Keylogger on company Windows systems.

A mundane password prompt can swiftly transform your macOS desktop into a perilous snare. Specifically, a novel malicious program named ClickLock completely paralyzes the operating system. It pers…

Two leaders of the notorious Scattered Spider hacking syndicate recently received severe prison sentences. Specifically, a judge sentenced the hackers to five years and six months for their digita…

At a glance Malware family RokRAT variant (x64) Threat actor Assessed highly likely APT37 (suspected, not confirmed) Target / victims People in research, policy, and academic fields Delivery vecto…

TL;DR A critical Kyverno vulnerability, CVE-2026-54523 (CVSS 9.6), has been publicly disclosed with full technical details and proof-of-concept exploit code. The flaw lets a namespace tenant escal…

TL;DR Cloud Software Group published bulletin CTX696734 for two flaws in Citrix Windows clients. CVE-2026-53565, a Citrix Secure Access vulnerability, lets a standard user escalate to SYSTEM privi…

The Claude Code Bug Bounty Run · Part 2 of 2 — Speed pays. Unsupervised write access bites back.

If you’ve ever done bug bounty hunting, you know the drill: before you get to the actually interesting part — finding a real vulnerability…

How weak authorization checks turn ordinary users into administrators — and why this remains one of the most critical vulnerabilities in…