Trellix has uncovered SquidLoader, a highly obfuscated malware targeting Hong Kong financial institutions to deploy Cobalt Strike beacons for persistent control.

Multiple critical vulnerabilities (CVSS up to 9.8) in Alcatel-Lucent OmniAccess Stellar WLAN APs enable unauthenticated remote code execution and full device takeover. Patch immediately!

Microsoft introduces RedirectionGuard for Windows 11, a new mitigation feature designed to block filesystem redirection attacks using junctions, preventing privilege escalation.

NVIDIA patched critical vulnerabilities in its Container Toolkit and GPU Operator, allowing privilege escalation, data tampering, and DoS in containerized environments.

Socket researchers uncovered widespread "protestware" in 28+ npm packages, silently disabling mouse interactions and playing the Ukrainian anthem for Russian-language users.

Google's Big Sleep AI agent successfully identified and neutralized a critical SQLite vulnerability (CVE-2025-6965) before it could be exploited in the wild, marking a new era in AI-powered proactive defense.

picoCTF Web Exploitation: More SQLi

Go + PostgreSQL security best practices using Bun ORM to avoid SQL injection.

When it comes to luring people to certain things, nothing works quite like a “honeypot.” For Winnie-the-Pooh, his honey pot was a literal…

TL;DR: I obtained the leaked LockBit 3 builder (the same toolkit spilled online by a disgruntled developer in Sept 2022), generated a…

Unlocking Digital Identity: A Look at the Ethereum Name Service (ENS) In the bustling world of Web3, where hexadecimal addresses and complex wallet identifiers are the norm, imagine trying to send crypto or interact with a decentralized application (dApp)…

As hybrid cloud adoption accelerates across industries, managing complex IT environments has become a critical challenge for enterprises…

Abstract

Abstract

While we’ve all been worrying about phishing emails and ransomware, a stealthier threat has been lurking right under our noses — one…

What is an IDOR?

Palo Alto Networks' Unit 42 reveals HazyBeacon, a new Windows backdoor targeting Southeast Asian governments, using AWS Lambda for covert command and control.

ESET reveals how AsyncRAT, an open-source C# RAT, has spawned dozens of sophisticated malware forks like DCRat and Venom RAT, fueling a dangerous cybercrime ecosystem.

Former US Army soldier Cameron John Wagenius (kiberphant0m) pleaded guilty to hacking telecom companies, extorting over $1M, and selling stolen data.

Cloudflare's Q2 2025 report shows a sharp drop in overall DDoS attacks, but a massive surge in hyper-volumetric incidents, including a 7.3 Tbps record-breaker.

Hackers are hiding malware binaries (like Joke Screenmate) and AI prompt injection commands directly within DNS TXT records, bypassing traditional security and leveraging encrypted DNS.