How a seemingly harmless test endpoint exposed backend integration details and why test routes should never be treated as harmless.

Picture two identical tweets. Same text, same account, posted at the same time on different days. One has 3 retweets. The other has 340…

A collection of local Linux vulnerabilities has acquired a second life as weaponized code engineered for total root compromise. NebuSec disclosed a series of critical kernel vulnerabilities and pu…

The Debian Linux project recently released version 13.7, the seventh security-maintenance update in the Debian 13.x series. This release chiefly remedies security vulnerabilities and known defects…

In July 2025, Microsoft began testing a PC-to-PC migration feature within the Windows 11 Insider Preview builds. This tool used the Windows Backup app to help users transfer hard drive data to a n…

TL;DR Acronis fixed a high-severity Acronis cPanel plugin vulnerability in its Backup plugin for cPanel and WHM. Attackers are already exploiting it in the wild. All users should update to a fixed…

At a Glance Russian-speaking cybercriminals targeted over 30,000 IP addresses to deploy the PivotC2 FortiGate RAT onto vulnerable network appliances. The SOCRadar Threat Research Unit identified t…

At a Glance Unit 42 researchers identified over 10,000 distinct samples of OfferLoader malware distributing dangerous payloads across enterprise systems. This cybercrime operation has remained act…

Privilege Escalation Through Client-Controlled Session State

Description : How low are your morals?

Last time, we covered symmetric and asymmetric encryption — two different kinds of locks, both designed to do the same job: let you get…

A Beginner’s Guide to AWS CTFs

A module-by-module HTB COAE review, where to slow down, where the maths gets heavy, and what to expect from the path.

How a seemingly simple upload validation flaw led to interactive access on an internal Linux host

The British fintech company Revolut recently issued a series of messages confirming a data security incident. Attackers impersonated a government body and, through an email address belonging to a …

Google recently released the Android automation project named Google Artemis. However, an open-source team accuses Google of violating license requirements. They failed to attribute the open-sourc…

Check Point Research published a technical analysis, revealing a stealthy prompt injection method. The newly documented Puzzlemask AI attack bypasses automated language model security checks witho…

If you’re planning to start your journey into Ethical Hacking, Penetration Testing, Bug Bounty, or Cybersecurity, one of the first things…

Greg Brockman’s Warning: The Window to Get Ahead of AI-Powered Hackers Is Closing

Full beginner-friendly walkthrough of HackTheBox's Archetype machine, from SMB enum to SYSTEM.