A must-have reference guide for Code4rena wardens, Immunefi hunters, and Solidity auditors

Hey there, and welcome back!
Today, we’re diving into VulnLawyers, a web application penetration testing challenge on the HackingHub…

I opened Frank’s Collectibles & Games in 2004.

It all started with an email. It looked legitimate like it came from my bank. Same logos, same tone, same formatting. But within 24 hours, I realized I had fallen victim to a sophisticated phishing…

Introduction: The Blueprint Is Yours Now

This week, I expanded my knowledge on the history of the Windows file system and explored it with forensics tools. Most Windows systems…

How Computers Communicate Over the Internet

An Enthusiasts Speculation of VPN Blockchains vs Quantum Cryptography Threats

As part of my first assignment in the PROM04 module

Dynamic Analysis | Part 1

SubCat: The powerful, passive subdomain discovery tool for penetration testers, bug bounty hunters, and security researchers. Uncover hidden subdomains efficiently and ethically.

The StackRox Kubernetes Security Platform performs a risk analysis of the container environment, delivers visibility and runtime alerts

New CrossPUSH & CrossSXG attacks exploit HTTP/2 and SXG to bypass Same-Origin Policy, enabling XSS and cookie manipulation.

New research reveals a high-severity mesh Wi-Fi vulnerability (CVSS 9.1) enabling frame injection even without credentials. PoC available.

GIMP versions before 2.99.16 & 3.0.0 are vulnerable to RCE from crafted image files. Patch now to protect your system.

AppleProcessHub, a new macOS infostealer, uses an Objective-C dropper and AES-decrypted C2 to steal sensitive files like SSH keys and Keychain.

A high-severity Siemens SiPass flaw allows unauthenticated remote attackers to cause a denial-of-service condition. Update to V2.95.3.18.

A fake Google Meet page on compromised WordPress sites tricks users into manually running PowerShell commands, delivering remote access malware.

GhostSpy, a sophisticated Android RAT, uses Accessibility Services for full surveillance, data theft (including 2FA), and device control.

The Real-Life Catch Me If You Can