TL;DR Mitel published two advisories. The first covers a MiCollab command injection bug rated critical at CVSS 9.8, which an unauthenticated attacker can reach over the network. The second covers …

TL;DR CISA published ICS advisory ICSA-26-204-04 on July 23, 2026. It details five security bugs in Panduit IntraVUE, an industrial network monitoring platform built by Pronetiqs. The most severe …

TL;DR JetBrains patched a critical TeamCity RCE tracked as CVE-2026-63077. The flaw scores a CVSS of 9.8 and affects all TeamCity On-Premises versions. An unauthenticated attacker with HTTP(S) acc…

TL;DR: A public proof-of-concept now targets CVE-2026-42533, an NGINX heap overflow rated CVSS 9.2. The bug lets an unauthenticated attacker corrupt worker memory through crafted requests. Researc…

A researcher has published full technical details and working proof-of-concept code for a Linux kernel vulnerability named Fraggap. Tracked as CVE-2026-53362, the bug lives in the kernel’s U…

This post is the second part of a series on call stack manipulation. In the first part we covered the basic return address overwrite, where…

How threat actors abuse process tracing to rewrite executable instructions in volatile RAM, and how modern EDRs detect memory modification…

If You’re Still Pentesting Like It’s 2020, You’re Already Behind What AI actually does well in offensive security, what it still can’t do, what to buy, and the questions that expose a lazy …

Master the pattern-hunting tool that developers, system administrators, and security analysts use to find the signal buried inside the…

สรุปเคสช่องโหว่ลักไก่: แกะรอย Session Replay เจาะทะลุ 2FA จากคุกกี้ไร้เงา HttpOnly

On July 28, 2026, the CVE™ Program launched the “Frontier AI Researcher CVE Numbering Authorities (CNAs) Pilot,” an initial six-month…

Introduction

Inside the Open Source Platform That Turns Autonomous AI Teams Into Real Penetration Testers

The Room 404 is the Day 2 challenge of TryHackMe’s Hacker Holidays, where we were presented with a web application running on port 8080.

What happens when the attacker isn’t a stranger on the internet but a colleague who already knows where the sensitive files live?

Byte Lotus — Source Code Disclosure via Exposed Git Repository

One of the most overlooked web application misconfigurations is exposing the .git directory over HTTP.

You can play this room for free: “https://tryhackme.com/room/hh-room404-804573bf”

Hello, red teamers!

I expected to search for a username, find a few social media accounts, answer the questions, and move on.