“Social media is full of spy cam paranoia. Here is the actual hacker science to detect hidden lenses using devices you already own.”

Description : Want to become part of Anonymous? They have a challenge for you. Can you get the flags and become an operative?

GitLab just patched a remote code execution vulnerability that never got a CVE, never got a security advisory, and was triggered by…

Phishing remains one of the primary initial access vectors in real world cyberattacks. While modern security appliances catch a vast…

A begginer level CTF to practice the enumeration skills and perform multi-step privilege escalation

Dalam dunia cybersecurity, khususnya Network Penetration Testing, lingkungan kerja yang aman sangat penting. Oleh karena itu, penggunaan…

Introduction Welcome to another VulnHub walkthrough! In this article, we’ll be solving Wintermute:1, a Linux-based Boot2Root machine that…

A beginner-friendly guide explaining how the smb_delivery module can be used to deliver a payload to a Windows target via SMB.

A fun, low-impact post-exploitation exercise showing how to change a victim’s desktop wallpaper once a Meterpreter session is established.

Not every impactful security issue starts with a sophisticated exploit. Sometimes it starts with a design pattern that looks harmless until…

We use dozens of APIs every day without even realizing it. Whether we are ordering food, checking our bank accounts, or booking a hotel…

Compromised hotel Wi-Fi gateways redirect business travelers to fake Microsoft 365 login pages allowing attackers to steal credentials and authorization tokens.

Unmasking the Concealed Remote Code Execution Flaw A critical remote code execution (RCE) flaw in self-hosted GitLab installations lay concealed for nearly six weeks. Although GitLab patched the u…

Covert Sabotage of Critical Infrastructure Iranian threat actors have developed sophisticated techniques to covertly manipulate programmable logic controllers (PLCs), ensuring that human operators…

TL;DR: Arista confirmed that CVE-2026-16812, a VeloCloud command injection flaw, is under active attack. The bug scores a maximum CVSS 10.0 and needs no credentials. Arista also patched two relate…

At a glance Actor or group Unnamed Russian-speaking crew tracked as Operation STANDOFF; self-branded “GG Influence” and “ggstandoff” Activity type Pay-per-install malware, …

At a glance Actor or group Kimsuky, a North Korea-linked group also tracked as Springtail, Thallium and APT43 Activity type Espionage, supply-chain pivoting, credential theft, Linux backdoor deplo…

A simple directory fuzzing session uncovered a hidden GraphQL endpoint. A harmless-looking search bar eventually turned into a confirmed…

Introduction