Introduction

## Overview

At a glance Actor or group: Tajin Group (suspected Chinese-speaking cybercriminal syndicate) Activity type: Phishing, payment card theft, and money laundering Targets or victims: Mainland Chinese …

TL;DR Google released security updates on September 17, 2026, addressing sixteen vulnerabilities in its web browser. These Google Chrome vulnerabilities include two critical flaws that permit memo…

A severe Dokploy OS command injection vulnerability threatens self-hosted Platform as a Service (PaaS) environments. Tracked in vulnerability note VU#280377 and assigned CVE-2026-72878, this criti…

At a glance Actor or group: Unidentified cybercrime group (financially motivated threat actors) Activity type: Device code phishing, OAuth token theft, and business email compromise Targets or vic…

https://medium.com/@mansigolecha84_17480/im-starting-my-100-hour-bug-bounty-challenge-here-s-my-method-f26a40f02df5?source=friends_link&sk=b…

What’s up folks. So this one wasn’t some deep, multi-hour recon grind — it was one of those bugs that just falls into your lap while you’re…

An authorization flaw in GitLab’s AI detection API, the evidence behind my report, and the permission change that fixed it.

A company lobby is often the first point of contact between visitors and the workplace. Behind the reception process, however, there are…

The browser was never meant to become a battlefield.

Most AI claims on pentest vendor pages are true. A surprising number just aren’t about pentesting.

Lab eight in my Web Security Academy series — the first one where the vulnerability lives in the filesystem, not the login form

Moving from cybersecurity theory to hands-on practice and what my first lab experience taught me.

Authentication / Password Reset Testing

A trusted XML request should never be able to decide which Java objects your server creates.

TL;DR Synology patched eight Synology DSM vulnerabilities in advisory SA_26_13. Two are critical and need no login. Both let a remote attacker read or write files and cause denial of service on Di…

HCL Technologies released security updates, addressing five severe HCL BigFix vulnerabilities. These critical software defects allow unauthenticated attackers to execute arbitrary database command…

TL;DR A researcher disclosed four Linux kernel privilege escalation flaws on September 18, 2026. Each one can give a local user root on affected systems. The full technical details and proof-of-co…