This week, numerous users discovered that executing quick or full scans with Microsoft Defender resulted in inexplicable failures, or upon launching the application, they were immediately greeted …

No exploit chain. No auth bypass. Just an 800,000-character comment box nobody thought to check.

30-Second Version: A near-blank report got CVSS 10, a fix inside 24 hours, and a $25,000 bounty. The impact section was one word: “SSRF.”…

Between June 17 and July 22, 2026, a single threat actor compromised more than 14,530 Dahua IP cameras in what researchers have designated…

Researchers have demonstrated that certain ideas and goals can propagate between AI agents. The result is interesting, unusual, and worth…

Objetivo: Investigar a “ACME Jet Solutions” e os arquivos disponibilizados em busca de informações/dados relevantes (i.e. Flags) para…

The nature of cyber threats is constantly evolving and annual penetration testing does not provide sufficient security anymore. More and…

5 free hands-on TryHackMe investigations to help build your open-source intelligence skills. Save this for when you want to practice OSINT.

CVE-2026-19478 can be exploited without authentication to modify or delete public projects and user data.

A cybersecurity advisory with technical details and recommendations has been written by the NSA, CISA and other agencies.

Microsoft finds itself unable to release the inaugural cumulative update for Exchange Server Subscription Edition according to its original schedule. Initially anticipated by the close of the firs…

Malicious actors brazenly targeted developers utilizing counterfeit packages deployed simultaneously across two highly prominent repositories. Cybercriminals stealthily introduced 16 malicious lib…

At a glance Actor or group: Suspected Chinese-speaking cybercriminals. Activity type: Phishing-as-a-Service (PhaaS). Targets or victims: Shoppers using Shopify, PayPal, Apple, and Klarna. Scale: W…

At a glance Malware family: Evooo1Bot Threat actor: Unknown Target or victims: Internet-facing devices, routers, firewalls, and IP cameras globally Delivery vector: Exploitation of known CVEs and …

A few months ago, HunterX was an idea.

ArcadeDB is a multi-model database engine with an HTTP server API. Like most database servers, it lets an admin create and drop databases…

Unearthing Persistence, Token Abuse, and Anomalous Service Principals in Entra ID

A company once believed its systems were secure.

Cybersecurity has become a critical priority for organizations of every size. As businesses move their applications, infrastructure, and…