I recently passed the Hack The Box Certified Penetration Testing Specialist (CPTS) exam with all 14/14 flags obtained. In this blog, I’ll…

Link to the room : TryHackMe | MS Sentinel: Just Looking

How I Passed the eCPPT on My First Attempt

When we open this room, only an image appears with nothing else in sight. However, running curl http://<IP-TARGET> reveals the following…

Honoring a promise made this March, Google has formally announced a more intensive update cadence for its Chrome browser. Beginning with Chrome 153, released today across the Windows, macOS, Andro…

A newly discovered cPanel SQL injection flaw exposes web hosting environments to total compromise. Threat actors can exploit this vulnerability to execute arbitrary code and take full control of t…

At a Glance Malware family XMRig cryptominer deployed via Redis abuse Threat actor Unnamed operator (suspected single actor, linked by wallet reuse) Target / victims 3,562 internet-facing Redis se…

Apache has disclosed three Apache Nutch vulnerabilities in the Nutch Server REST API. The most serious, CVE-2026-41870, allows unauthenticated remote code execution. All three carry no authenticat…

Siemens ProductCERT disclosed two critical Siemens vulnerabilities on September 8, 2026. One allows full account takeover in Industrial Edge Management. The other permits root-level access on Sive…

TL;DR A researcher published ShieldCrash, a Windows Defender 0day that bypasses Microsoft’s patch for the ShieldBreak vulnerability (CVE-2026-6941). Both the vulnerability details and proof-…

Red Hat issued a warning regarding a critical Hawtio Operator vulnerability in Kubernetes and OpenShift environments. This severe flaw allows users with basic edit access to obtain unauthorized ce…

TL;DR Google released Chrome 153 to fix 230 security flaws. One is a Chrome zero-day, CVE-2026-87491, already exploited in the wild. Users should update their browser right away. Why This Chrome Z…

At a Glance Threat clusters CL-CRI-1131 and CL-CRI-1163 Activity type Network intrusion and data exfiltration, AI-assisted Targets Transportation, government, water utilities, financial sector Jur…

Let’s get straight to it. Most bug bounty hunters are terrified of Regular Expressions (Regex). They look at a string of characters like…

Task 2

Machine details

One cannot help but marvel at Microsoft: a feature this simple, deferred for years on end, is at last poised for development. The Windows 11 preview build has lately revealed a wealth of strings p…

Four critical and important Apache Impala vulnerabilities expose analytical database clusters to remote code execution and data theft. These flaws affect multiple versions of the software. Current…

The Asahi Linux team recently announced that support for Apple’s M3-series chips has been progressing steadily, with the first M3 platform code now merged upstream. After prolonged reverse e…

Security researchers recently uncovered a critical Predis command injection flaw, tracked as CVE-2026-84372. This vulnerability earned a maximum severity CVSS score of 9.8. Crucially, the technica…

MapLibre GL JS handles nearly 2.7 million weekly downloads for web mapping applications. Specifically, a critical MapLibre XSS vulnerability allows attackers to execute zero-click attacks. This se…