Sí, suena exagerado… pero es exactamente lo que pasa cuando no dimensionas el verdadero impacto de las ciberamenazas en tu organización…

After analyzing the malware in my previous post, I decided to create a detection rule to flag it in my environment. Think of this rule as a…

An easy-to-follow guide on building multi-layered security to protect your digital assets in 2025

In 2025, SaaS is no longer a convenience — it’s the backbone of modern business. Whether you’re running marketing in HubSpot, sales in…

Why Ransomware is Healthcare’s Newest Emergency and How We Fight It

Olá!

If you’re reading this, chances are you’ve heard the term “penetration test” tossed around in meetings, compliance checklists, or maybe…

Industrial networks often harbor legacy applications and forgotten endpoints. In Task 10 (Web Brr v1) of TryHackMe’s Industrial Intrusion…

Learn how the OAuth protocol works and master techniques to exploit it.

I have spoken to machines as if I were speaking to myself. Not for entertainment, nor for casual curiosity, but as a deliberate act of ethical, philosophical, and linguistic scrutiny. I was not…

For many developers, “security” often feels like a roadblock, a failed pipeline or a last-minute ticket that sends you scrambling to fix…

dAWShund is a new tool suite to enumerate, evaluate, and visualize AWS IAM policies and resource access conditions, helping security teams manage and secure cloud permissions.

Critical CVSS 9.8 RCE in Netflix Conductor lets attackers gain remote shell via JavaScript injection. Exploit PoC available. Patch now!

DataEase has critical flaws in database connection handling, allowing remote RCE and JDBC parameter bypasses for H2, Redshift, and PostgreSQL. Update to v2.10.11 now!

A flaw (CVE-2025-53106) in Graylog allows authenticated users to escalate privileges via API token abuse. Update to 6.2.4 or 6.3.0-rc.2 immediately.

Three flaws in Frappe Framework allow account takeover via password reset token leaks, XSS via file upload, and SQL injection. Update self-hosted ERPNext immediately!

A report exposes Pakistani freelancers building websites distributing cracked software with stealer malware, leveraging a pay-per-install model and geopolitical loopholes.

CERT@VDE and Pilz disclose critical flaws in IndustrialPI 4: unauthenticated remote bypass (CVSS 9.6) and RCE (CVSS 10.0) via exposed Node-RED. Update or mitigate immediately.

Difficulte : meduim

(Washington, D.C.) — Just two days after two Iranian satellites were knocked offline in a coordinated cyberattack, a notorious hacker…

In late April 2025, Marks & Spencer (M&S), the iconic British retailer with a 141-year legacy, fell victim to a large-scale ransomware…