Bounty Case Files #02 | How a Broken Function-Level Authorization vulnerability allowed a free-tier user to enumerate and execute internal…

Welcome to this new Medium post, in this one we will see how to enumerate and unlink thread creation callbacks registered through…

Attacking Google Cloud — Part 2 / 7

You type `smtp_server: 10.0.0.5` into a text field.

Executive Summary

Yoo, it’s been a while since I published a write-up.

At a glance Actor or group Mabna Institute (Iran-based), allegedly for the IRGC Activity type Spearphishing, credential theft, data exfiltration (hacking-for-hire) Targets Universities, private co…

TL;DR CISA added four vulnerabilities to its Known Exploited Vulnerabilities Catalog on August 18, 2026. Each entry rests on evidence of active exploitation. The flaws hit Microsoft, Broadcom, and…

TL;DR Security researchers discovered multiple severe vulnerabilities in IBM Documentation Offline. Most notably, a critical IBM remote code execution flaw allows attackers to run malicious comman…

TL;DR Google shipped a Chrome security update on August 26, 2026. It fixes 15 vulnerabilities, including two critical buffer overflows. Both critical bugs sit in the browser’s graphics stack…

At a glance Actor or group: Armored Likho (also known as Eagle Werewolf) Activity type: Cyber espionage and audio surveillance Targets or victims: Private individuals, government bodies, IT firms,…

In modern red teaming, setting up a secure and stealthy Command-and-Control (C2) infrastructure is essential for success. After acquiring…

In the world of modern red teaming, infrastructure is king. The ability to evade security controls, minimize detection, and deliver…

In July, we welcomed Alessandro Tocco as our new Chief Compliance and Risk Officer (CCRO), further strengthening our executive team. In…

Ask any security team how they decide what to patch first, and most will point to a CVSS score. That number comes from a CVE. And a CVE…

Attackers have begun exploiting a critical vulnerability in macOS’s built-in Screen Sharing feature to gain access to Mac computers without any valid credentials whatsoever. In several confi…

TL;DR BeyondTrust patched two high-severity flaws in Endpoint Privilege Management for Windows. This BeyondTrust vulnerability pair can lead to local privilege escalation. The company found both t…

Tech giants face intense scrutiny as the 2026 US Mid-term Elections approach. They must carefully balance algorithmic neutrality with mounting political pressure. Recently, Google quietly revealed…

TL;DR Oracle patched nine flaws in WebLogic Server in a special August 2026 update. Five carry critical scores. The top Oracle WebLogic vulnerability, CVE-2026-60702, scores a CVSS of 9.9. Success…

Nine drafts. No admin access. Just an oversized text field nobody thought to check.

Hello Hackers,