The LYKNCTF was a whole whirlwind. Like any other CTFs, they too had many categories to choose from like Web, OSINT, Misc etc however I…

Solution:

Welcome back to another writeup! Today, we’re checking into The Byte Lotus Hotel for Day 2 of TryHackMe’s Hacker Holidays event.

Corporate systems designed to securely warehouse engineering blueprints and proprietary project documentation have morphed into a lucrative extortion vector for cybercriminals. Malicious actors ar…

GitHub and the Python Package Index (PyPI) have introduced strategic delays into dependency updates, discouraging developers from inadvertently deploying malicious packages upon initial release. D…

TL;DR A critical Gitea RCE flaw now has public details and a proof-of-concept exploit. Tracked as CVE-2026-60004, it scores a CVSS of 9.8. A user with repository write access can run shell command…

At a Glance Malware family Lampion, a Brazilian banking trojan from the ChePro lineage Threat actor No group named; operators tracked only as the Lampion crew Targets Portuguese speakers; 94.6% of…

At a glance Malware family msaRAT, a Rust remote access trojan Threat actor Chaos ransomware group (confirmed by Cisco Talos) Target or victims Windows hosts inside already-breached large organiza…

You have confirmed SQL injection against a Snowflake backend. The injected expression executes. The behavior is repeatable. The database is…

In this blog, I am going to share an account takeover vulnerability in a third-party provider widely used by many bug bounty programs.

How I Used XNLDorker to Discover Hidden Endpoints Across Multiple Search Engines

Part 4 of the Aii-Aii Hunter series: why “advise” vs “execute” is the whole point, and how the bridge actually works

OAuth Security Explained Without the Marketing OAuth 2.0 is often marketed as a “security protocol” that magically makes your application safe. In reality, OAuth is an authorization framework — …

A walkthrough of TryHackMe’s “Room 404” — Very Easy, 30 points, Web category — Day 2 of the Hacker Holidays event at the Byte Lotus Hotel.

The 25 Commands that Cover 90% of real Penetration tests from Recon to Root

Open-Source Intelligence (OSINT) isn’t just about scanning modern social media profiles, tracking geolocation through metadata, or…

What to Do in the First 60 Minutes After a Cyber Fraud ?

I used to believe, cybersecurity was reserved for hoodie-wearing geniuses staring at green code in a dark room, sipping energy drinks…