A Massive Dark Web Data Sale Threat actors recently listed 3.64 million corporate records for sale on the dark web. A seller known as “TheHatman” claims these databases originate from …

In Part 1, we covered the recon phase, BOLA, Broken Authentication (including a JWT deep-dive), and Broken Object Property Level…

APIs are everywhere now. Every mobile app, every SPA, every ‘modern’ web product you use today is really just a thin UI sitting on top of…

Hello friends! Toryy here! I’m excited to share with you an Authentication Bypass that I discovered on LinkedIn. I’m particularly proud of it because of its unexpected and sneaky nature. Let’s …

Part 9 of our Android security series. Part 8 covered Credential Manager — getting the user signed in. This post covers what happens for…

Part 8 of our Android security series. Part 7 covered BiometricPrompt — this post covers what happens before that: how the user actually…

Hello everyone. I have written this walkthrough to help you to complete this room.

Can you bypass the engine?

An analysis of the 2026 Tata Electronics cyber incident, the data exposure, and the cybersecurity lessons for modern supply chains.

TL;DR Citrix patched a critical NetScaler authentication bypass tracked as CVE-2026-19490. It scores 9.3 on CVSS v4. A second flaw, CVE-2026-19489, can cause denial of service. Why it matters NetS…

WarnAt a glance Actor / group Unattributed threat actors (no group named in this advisory) Activity type Reconnaissance and capability development with AI-generated exploit scripts Targets Interne…

HashiCorp disclosed a Vault Secrets Operator vulnerability this week. Then, the bug, tracked as CVE-2026-8715, scores a 9.6 on the CVSS scale. It can lead to privilege escalation inside a Kubernet…

TL;DR Red Hat disclosed three critical flaws in its multicluster Kubernetes products. The most severe, CVE-2026-66792, scores a CVSS 9.9. It lets a privileged user on a managed cluster escalate to…

TL;DR Google patched CVE-2026-0075, an Android elevation of privilege flaw in ContactsProvider2. The bug can expose the contacts database through SQL injection, with no user interaction required. …

IBM patched 18 flaws in Db2 Mirror for i this week. The worst bug lets a remote attacker run system commands without logging in. IBM Db2 Mirror RCE risk reaches a CVSS score of 9.9. Also, several …

New York, New York, 19th August 2026, CyberNewswire

TL;DR Commvault recently disclosed three serious vulnerabilities impacting its enterprise data protection software. These Commvault command execution flaws allow remote attackers to bypass authori…

30-second version: I read through HackerOne’s top 201 disclosed “Business Logic” reports. Roughly 40% weren’t business logic at all — they…

In web application security testing, simply enumerating the application’s content — finding all its pages and links — is only a small part…

target:NexusAI’s polished assistant interface promises adaptive learning and seamless interaction. But beneath its reactive front end…