How I built an intelligent brute-force tool that automatically analyzes login forms using Large Language Models

How organizations can defend against one of the most common attack vectors in 2025.

Güvenlik Ayrıcalığına Son: Herkes İçin Kapsayıcı, Erişilebilir ve Akıllı Bir Mobil Güvenlik Mümkün mü? MerYunCyber, siber güvenliği bir ürün olmaktan çıkarıp, Cihaz-içi Yapay Zeka (On-Device AI) ve…

In the ever-changing world of cybersecurity, one truth remains constant: trust no one. But as threats evolve and networks grow more…

Hi my name is Samuel Parlindungan, CEH, EJPT. I would like to continue playing about session security especially csrf. Perhaps i will…

中文指令筆記

The Paris Prosecutor’s Office has opened a criminal investigation into Elon Musk’s X social network for “algorithmic manipulation aimed at…

الثغرة تم تصنيفها خطيرة (High)، مع إني بصراحة توقعتها متوسطة، بس الظاهر الموقع يهتم مرّة بأي شي له علاقة بالمستخدمين وخصوصيتهم، فعشان كذا…

Coercer is a python script to automatically coerce a Windows server to authenticate on an arbitrary machine through 9 methods.

Microsoft reveals a link between the defunct FMovies and a massive infostealer campaign that compromised over 1 million devices, stealing credentials and financial data.

Three malicious packages disguised as browser updates in the Arch User Repository (AUR) deployed the CHAOS RAT trojan, compromising Linux systems.

Japanese police have released a free decryption tool for Phobos and 8Base ransomware victims, offering hope for data recovery after a major international crackdown.

HPE warns of a critical vulnerability (CVE-2025-37103, CVSS 9.8) in Aruba Instant On APs with hardcoded credentials, allowing unauthenticated full administrative access. Update immediately!

A phishing campaign stole npm maintainer tokens, leading to trojanized versions of eslint-config-prettier, synckit, and other packages, enabling remote code execution on Windows systems.

Nokia's WaveSuite NOC platform has two severe command injection vulnerabilities (CVE-2025-24938, CVE-2025-24936) allowing remote code execution, even with low privileges.

Greedy Sponge, a financially motivated group, is back with an upgraded AllaKore RAT and SystemBC, targeting Mexican organizations for banking credentials and financial fraud.

Trustwave uncovers an Android malware cluster using fake Facebook & TikTok apps to lure victims via brand impersonation, abusing permissions for data collection and traffic monetization.

FortiGuard Labs unveils NailaoLocker, a new ransomware using Chinese SM2 encryption and a built-in, non-functional decryptor, suggesting a prototype or decoy.

wolfSSL 5.8.2 patches four vulnerabilities, including a critical Apple trust store bypass (CVE-2025-7395) and predictable randomness after fork(), impacting secure communications.

JPCERT/CC details a sophisticated, ongoing malware campaign exploiting Ivanti Connect Secure (CVE-2025-0282, -22457) using MDifyLoader, Cobalt Strike, vshell, and Fscan for stealthy persistent access.

AhnLab uncovers SVF Bot, a Python-based DDoS botnet abusing Discord as its C&C channel to target misconfigured Linux servers and launch HTTP/UDP floods.