What’s up folks. So this one wasn’t some deep, multi-hour recon grind — it was one of those bugs that just falls into your lap while you’re…

An authorization flaw in GitLab’s AI detection API, the evidence behind my report, and the permission change that fixed it.

A company lobby is often the first point of contact between visitors and the workplace. Behind the reception process, however, there are…

The browser was never meant to become a battlefield.

Most AI claims on pentest vendor pages are true. A surprising number just aren’t about pentesting.

Lab eight in my Web Security Academy series — the first one where the vulnerability lives in the filesystem, not the login form

Moving from cybersecurity theory to hands-on practice and what my first lab experience taught me.

Authentication / Password Reset Testing

A trusted XML request should never be able to decide which Java objects your server creates.

TL;DR Synology patched eight Synology DSM vulnerabilities in advisory SA_26_13. Two are critical and need no login. Both let a remote attacker read or write files and cause denial of service on Di…

HCL Technologies released security updates, addressing five severe HCL BigFix vulnerabilities. These critical software defects allow unauthenticated attackers to execute arbitrary database command…

TL;DR A researcher disclosed four Linux kernel privilege escalation flaws on September 18, 2026. Each one can give a local user root on affected systems. The full technical details and proof-of-co…

At a glance Actor or group: PAPERMILL (suspected Silver Fox-adjacent cluster) Activity type: Tax-themed phishing, DLL sideloading, and remote access trojan deployment Targets or victims: Enterpris…

CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes CWE-269: Improper Privilege Management CVSS 3.1…

A mass credential-harvesting campaign was completed in under six hours. No human sat at the keyboard for most of it.

I used to spend hours grepping through code, chasing false positives, and manually testing endpoints until my eyes glazed over. Now I let…

Introduction

A practical journey through WPA-PSK architecture, the 4-way handshake, handshake capture, and password cracking using all kinds of probable…

The title says it all: 15 minutes to snag user.txt, and a painful 90 minutes wasted looking for something I had already seen. How did I end…

CWE-79: Improper Neutralization of Input During Web Page Generation CVSS 3.1: 6.1 (Medium) — AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N