Zero Trust, the security model promising to solve all our problems by assuming everyone is a potential threat, may not be as effective as…

From Blueprint to Detection: Building My Own Blue/Purple Team Lab  By Ziad Okka (0xZetss)

The open-source ecosystem was hit with another wake-up call — and this time, the target was one of the most widely used libraries in the…

In an era where the risk of sensitive data breaches is ever-present, using a VPN (Virtual Private Network) has become a common practice to…

Pivoting careers. Panther + Scanner is the optimal stack. Day-to-day as a Detection Engineer. And more…

A simple scenario to this is when you have somehow gained access to the server, and you wan’t to pivot in the network further but no more…

Basic Static Analysis | Part 3

BUG INFO :

MSFTRecon is a powerful tool for red teamers to map Microsoft 365 and Azure infrastructure without authentication, identifying misconfigurations.

Yet Another Testing & Auditing Solution is a simple and easy to use tool to audit your infrastructure for misconfiguration or potential security issues.

Grafana rushed an emergency patch for CVE-2025-4123, a high-severity XSS flaw that was made public. Upgrade now to prevent unauthorized access.

GitLab released urgent updates (18.0.1+) fixing high-severity flaws, including a DoS vulnerability (CVE-2025-0993) and a 2FA bypass (CVE-2024-12093).

A new self-replicating Dero cryptominer is infecting exposed Docker containers, spreading as a worm without needing a C2 server.

NIST introduces the Likely Exploited Vulnerability (LEV) metric, a new way to estimate which CVEs have likely been exploited in the wild.

Critical vulnerabilities (CVSS 9.8) in the Langroid Python framework allow remote code execution in LLM applications. Update to version 0.53.15 now!

Threat actors are using the PyBitmessage protocol as a stealthy C2 channel to hide a Monero coinminer and backdoor, evading detection.

Learn about critical vulnerabilities in LLM-powered Browse agents like Browser Use, allowing domain bypass and prompt injection for data theft.

AutomationDirect's MB-Gateway has a critical (CVSS 10) flaw allowing unauthenticated remote access and RCE. Hardware limits prevent a software fix; replacement is recommended.

Attackers exploit JSONP flaws in Google APIs to inject malicious scripts into e-commerce sites, silently redirecting users to fake payment pages.

Now that we had a product I was finally proud of, the new mission was clear: find a co-packer willing to work with a completely unknown…

No Hacking Course Could Teach Me (My Front Door Did)