Challenge: Canonically Yours
Platform: Intigriti Monthly CTF — July 2026
Category: Web Security / Broken Access Control
Vulnerability: JSON…

A crafted image can turn a standard avatar upload form into a covert conduit for stealing web application secrets. A vulnerable Ruby on Rails server may expose encryption keys, database passwords,…

The operators behind a massive, globally coordinated hacking campaign committed a fatal operational security error. They inadvertently left directories entirely open on the centralized server util…

TL;DR Gitea 1.27.1 patches a critical Gitea vulnerability, CVE-2026-59774, rated CVSS 9.8. An unauthenticated attacker can read arbitrary server files through a public repository, then escalate to…

At a glance Actor STAC4749 (unattributed threat cluster) Activity Teams vishing, remote access, ransomware Targets Dozens of North American organizations (Canada, U.S.) Scale At least three Chaos …

At a glance Malware family Dysphoria (jackskid/fbot-derived IoT botnet) Threat actor Unattributed; run as a commercial DDoS-for-hire service Target About 200,000 IoT and embedded Linux devices wor…

Ever catch yourself wondering if that phishing email was crafted by a person — or something smarter? Here’s a number to chew on: in 2023…

Understanding threat modelling, the STRIDE framework, and how a simple Data Flow Diagram can prevent security disasters before they happen.

Everyone’s hardening LLM agents against prompt injection. The bug that actually leaks your data is broken object-level authorization…

Initial nmap scan discovery shows port 22,80 and 8082 are open.

By Edris Hassani and Hadi Tavana

CISA confirmed KNX vulnerability CVE-2023–4346 has no patch and is still exploited. What it means for building automation security.

Every security researcher has a different way of finding bugs.

Modern applications rely heavily on APIs to exchange data between clients, servers, and third-party services. While users interact with the…

Web application penetration testing isn’t always about finding a vulnerability.

Room link: https://tryhackme.com/room/hh-towelonthesunbed-61271709

I recently completed my Nmap room in Jr Pt module. So there are many nmap scans other than basic port and hosts scan, Nmap is a lot bigger…

This room picks up where the earlier Splunk challenges left off. Instead of focusing on searching or visualizing data that is already…

At the Beach Bar, even shell access is complimentary. The jukebox takes requests. Any kind.

Two strangers. One conversation. One profile they never meant to reveal.