Wazuh is one of the most popular open-source Security Information and Event Management (SIEM) and Extended Detection and Response (XDR)…

Natas 0 → Natas 1

A rewards system let you claim 50 points every 24 hours. We claimed it three times in the same millisecond. Welcome to race conditions.

Query five record types for a domain, decode an SOA field by field, and attempt a zone transfer, so you know what a domain publishes to…

How a missing authorization check turned a profile API into a data exposure risk.

Why boards must treat AI dependency, agentic authority and model concentration as operational-resilience risks..

Offsec’s Proving Grounds Practice box Authby is rated intermediate, however the community disagrees and has given the box a rating of hard…

How a misconfigured BIND server exposed credentials and led to complete system compromise.

A practical approach to identifying object-level authorization weaknesses in modern APIs

Beyond the generic “run a scanner” lists — the toolkit built around finding access control and business logic bugs, the kind automated…

This is a long one but it is very important to understand the process of platforms like Hackerone.

Scan a legal practice host for eight specific services, tell a closed port apart from a filtered one, and pull an exact software version…

“With great power comes great vulnerability scanning.”  — Uncle Ben

How a Medium Severity Bug Turned Into a Critical Vulnerability

TL;DR A critical flaw in Forminator Forms puts more than 600,000 WordPress sites at risk. Tracked as CVE-2026-15748, it scores a CVSS 9.8. The bug lets unauthenticated attackers upload executable …

TL;DR GitLab shipped an out-of-band critical patch on August 17, 2026. It fixes CVE-2026-19478, a GraphQL code injection flaw rated CVSS 9.4. Under certain conditions, an unauthenticated attacker …

At a Glance Malware family DCRat (DarkCrystal RAT) Threat actor Not attributed by Trellix; DCRat is a malware-as-a-service tool Target Users lured with a Colombian judicial theme Delivery vector P…

TL;DR BigBlueButton contains a critical path traversal vulnerability within the Etherpad integration. Attackers can perform an unauthenticated arbitrary file read to extract sensitive system files…

Where the news is always bad, but the analysis is always good.