Broadcom has released urgent patches for four critical (CVSS up to 9.3) VMware vulnerabilities affecting ESXi, Workstation, and Fusion, allowing host code execution.

Google released a critical Chrome update (138.0.7204.157/.158) patching six vulnerabilities, including CVE-2025-6558, a high-severity zero-day actively exploited in the wild. Update immediately!

Intro

Once an attacker gains a foothold within a domain-joined environment, one of the key ways they can escalate privileges and move laterally…

What is offensive Security?

Or: How I Learned to Stop Worrying and Love Our New AI Overlords

How to safeguard your microservices architecture with a robust API Gateway setup.

Recently, I started learning penetration testing, and one of the first things I’ve been working through is the PortSwigger Web Security…

A detailed digital Threat Intelligence walkthourgh

As of July 15, 2025, the CVE Program is expanding its partnership with CERT@VDE for managing the assignment of CVE Identifiers (CVE IDs)…

Walkthrough for “Dog” on Hack The Box

Reflections from Day 2 as a Course Assistant at NYU’s CS4CS Cybersecurity Program

The digital underworld is a constant battleground, with cybercriminals continually refining their weapons. Today, we pull back the curtain…

INTRODUCTION

1. Enumeration

AI is here to stay and Agentic AI is going to be one of the key drivers in this revolution. The potential & power of AI agents is largely…

BinPool is a Python-based dataset of 603 CVEs from vulnerable and patched Debian binaries, enabling advanced vulnerability discovery through ML and static analysis.

McAfee warns of a new Android malware campaign targeting Bangladeshi expats with fake remittance apps like TapTap Send, stealing personal and financial data, including photo IDs.

Cyfirma uncovers "Octalyn Forensic Toolkit," a GitHub-hosted "educational" tool that's actually a modular credential stealer exfiltrating data via Telegram.

GLOBAL GROUP, a rebranded RaaS operation, is aggressively targeting critical infrastructure worldwide, leveraging AI chatbots for automated, high-pressure ransom negotiations.

The Rainbow Hyena threat cluster is unleashing PhantomRemote, a new backdoor, in phishing attacks against Russia's healthcare and IT sectors, leveraging compromised emails.