Changing AI behavior is much easier and cheaper than many people thought. Cyber expert Katie Paxton-Fear put a hidden flaw into an open AI model. Amazingly, she finished this task in just about on…

A major leak has struck documents tied to the construction of India’s largest nuclear power plant. Alleged engineering-system blueprints, supplier details, inspection reports, and insurance …

Robot vacuums have long roamed our homes unattended. Yet on certain Shark models, the cleaning came bundled with an unnoticed doorway for strangers. A security researcher uncovered a critical vuln…

Operation ShadowRecruit targets Indian job seekers with SheetAgent RAT, abusing ControlR and Google Sheets for C2. Seqrite links it to APT36. #OperationShadowRecruit #APT36 #SheetAgent #Malware #I…

At a Glance Malware family LabubaRAT (previously undocumented) Threat actor Unattributed; no group named Targets Windows hosts; no victim count published Delivery vector Not documented in the repo…

A few weeks ago I set out to do something more useful than watching another course on OWASP Top 10 — I wanted to actually break things…

Introduction

“Sunset” created by the skilled author “Whitecr0wz,” is a beginner-level Capture The Flag machine. The main objective is to discover the…

The threat landscape has fundamentally shifted. What once took a skilled attacker days or weeks now takes minutes — and every organization…

Introduction

Most cyber attacks targeting employees do not arrive through technical exploits. They arrive through links. A phishing email. A malicious…

The agentic SOC is real. The architecture that makes it safe is bounding authority — not raising intelligence.

Conceptual Overview & Kill Chain

I spent my afternoon poking at PortSwigger’s Web Security Academy again, and this one’s a fun little logic puzzle. The lab is called “SQL…

At a glance Malware family HOLLOWGRAPH, linked with high confidence to the Cavern backdoor framework Threat actor Unattributed. Low-confidence possible link to Lyceum, an Iranian-nexus group and O…

At a Glance Field Detail Malware family CrashStealer (native C++ macOS infostealer) Threat actor Unattributed; part of a larger multi-platform operation Targets macOS users, especially cryptocurre…

During one of my recent penetration testing engagements, I discovered an IDOR vulnerability with a surprisingly simple test — replacing a…

While updating my profile as a normal user, the API response included a `role` field set to `”users”`. I copied that exact value into the…

Most WAF failures are not missed detections. They are requests the WAF never fully read, or parsed differently from your application — and…