بسم الله الرحمن الرحيم

A detailed guide to hacking the Dogcat machine on TryHackMe — Exploit a PHP application via LFI and break out of a docker container.

During a difficult and uncertain time, I contacted Hackshift360 and it was one of the most impactful choices I’ve made. They provided…

As a cybersecurity student specializing in offensive side of security, I quickly realized that theory alone isn’t enough. Red teaming and…

Sí, suena exagerado… pero es exactamente lo que pasa cuando no dimensionas el verdadero impacto de las ciberamenazas en tu organización…

After analyzing the malware in my previous post, I decided to create a detection rule to flag it in my environment. Think of this rule as a…

An easy-to-follow guide on building multi-layered security to protect your digital assets in 2025

In 2025, SaaS is no longer a convenience — it’s the backbone of modern business. Whether you’re running marketing in HubSpot, sales in…

Why Ransomware is Healthcare’s Newest Emergency and How We Fight It

Olá!

If you’re reading this, chances are you’ve heard the term “penetration test” tossed around in meetings, compliance checklists, or maybe…

Industrial networks often harbor legacy applications and forgotten endpoints. In Task 10 (Web Brr v1) of TryHackMe’s Industrial Intrusion…

Learn how the OAuth protocol works and master techniques to exploit it.

I have spoken to machines as if I were speaking to myself. Not for entertainment, nor for casual curiosity, but as a deliberate act of ethical, philosophical, and linguistic scrutiny. I was not…

For many developers, “security” often feels like a roadblock, a failed pipeline or a last-minute ticket that sends you scrambling to fix…

dAWShund is a new tool suite to enumerate, evaluate, and visualize AWS IAM policies and resource access conditions, helping security teams manage and secure cloud permissions.

Critical CVSS 9.8 RCE in Netflix Conductor lets attackers gain remote shell via JavaScript injection. Exploit PoC available. Patch now!

DataEase has critical flaws in database connection handling, allowing remote RCE and JDBC parameter bypasses for H2, Redshift, and PostgreSQL. Update to v2.10.11 now!

A flaw (CVE-2025-53106) in Graylog allows authenticated users to escalate privileges via API token abuse. Update to 6.2.4 or 6.3.0-rc.2 immediately.

Three flaws in Frappe Framework allow account takeover via password reset token leaks, XSS via file upload, and SQL injection. Update self-hosted ERPNext immediately!

A report exposes Pakistani freelancers building websites distributing cracked software with stealer malware, leveraging a pay-per-install model and geopolitical loopholes.