Overview

We’ve all heard, or maybe even said it ourselves, that I don’t worry too much about security, I’m boring, and I have nothing to hide…

Ever heard of a virus that silently stole millions and then disappeared?
That’s the Zeus Virus. Also known as Zbot, it was one of the most…

I explored the OWASP ZAP tool through TryHackMe to strengthen my web app testing skills. This room gave me hands-on experience with…

Have you ever downloaded what you thought was a legitimate application, only to find your system behaving strangely afterward? In the…

Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

Bolthole is a new proof-of-concept ClickOnce payload for Red Teams, providing stealthy initial access with reverse SSH, CMD shell, and SOCKS proxy capabilities.

Four critical flaws, including unauthenticated telnet access and RCE, discovered in Nexxt Solutions NCM-X1800 mesh routers allow full network compromise. Update or disable immediately.

Trellix has uncovered SquidLoader, a highly obfuscated malware targeting Hong Kong financial institutions to deploy Cobalt Strike beacons for persistent control.

Multiple critical vulnerabilities (CVSS up to 9.8) in Alcatel-Lucent OmniAccess Stellar WLAN APs enable unauthenticated remote code execution and full device takeover. Patch immediately!

Microsoft introduces RedirectionGuard for Windows 11, a new mitigation feature designed to block filesystem redirection attacks using junctions, preventing privilege escalation.

NVIDIA patched critical vulnerabilities in its Container Toolkit and GPU Operator, allowing privilege escalation, data tampering, and DoS in containerized environments.

Socket researchers uncovered widespread "protestware" in 28+ npm packages, silently disabling mouse interactions and playing the Ukrainian anthem for Russian-language users.

Google's Big Sleep AI agent successfully identified and neutralized a critical SQLite vulnerability (CVE-2025-6965) before it could be exploited in the wild, marking a new era in AI-powered proactive defense.

picoCTF Web Exploitation: More SQLi

Go + PostgreSQL security best practices using Bun ORM to avoid SQL injection.

When it comes to luring people to certain things, nothing works quite like a “honeypot.” For Winnie-the-Pooh, his honey pot was a literal…

TL;DR: I obtained the leaked LockBit 3 builder (the same toolkit spilled online by a disgruntled developer in Sept 2022), generated a…

Unlocking Digital Identity: A Look at the Ethereum Name Service (ENS) In the bustling world of Web3, where hexadecimal addresses and complex wallet identifiers are the norm, imagine trying to send crypto or interact with a decentralized application (dApp)…

As hybrid cloud adoption accelerates across industries, managing complex IT environments has become a critical challenge for enterprises…

Abstract