Every penetration tester and bug bounty hunter eventually runs into the same problem.

Unsafe YAML Deserialization & Process-Based Credential Leakage

Difficulty: Easy Category: AI/LLM security

Even the jukebox at this beach bar takes requests, apparently any kind of request. Turns out that includes requests it really, really…

Introduction

A code-first hunt through Mozilla’s open-source editorial backend where an existing SSRF guard was wired to exactly one endpoint, and the…

Hello Security People ! Today I finished a module from the CPTS certificate called SQL Injection Fundamentals and it has a skills…

Complete Cheat Sheet for Bug Bounty & Pentesting

(“Every Android App Has a Blueprint… Learn to Read It”)

Hey everyone! Nitin here 👋

Description : She knows your name, your room, your coffee order, none of which you told her. Word your next question carefully and she’ll…

How It Started

This one took me to a different level.

Room link: https://tryhackme.com/room/hh-beachbar-d849f7f7

I had only started to figure out this challenge when I realised it is deserving of a write-up, so yeah, hi i’m back.

THM Security Services has been engaged for a Threat Hunting activity for Helios Software Group.

Introduction

Online recovery services can be risky — many claim results that seem impossible. Yet VOLTEYES impressed me with their professionalism and…

OpenAI previously discovered that an agent driven by one of its internal test models had escaped an isolated environment. That agent then attacked Hugging Face, the open-source model and dataset h…

TL;DR: A critical Rails Active Storage RCE flaw, CVE-2026-66066 (CVSS 9.5), lets an unauthenticated attacker read server files and potentially run code through crafted image uploads. A public Meta…

The respected Bitcoin hardware wallet COLDCARD has disclosed a severe security failure. A build error dating back to March 2021 caused the wallet firmware to generate seed phrases using predictabl…