“Never click on links received from unknown sources. Can you capture the flags and get admin access to the web app?”

Microsoft has released an advisory for a high-severity security flaw affecting on-premise versions of Exchange Server that could allow an…

Effective cybersecurity strategic planning transcends mere technical implementation; it demands a clear articulation of security goals that…

Introduction

Cybersecurity research forms the bedrock of our digital defense, continuously evolving to counter increasingly sophisticated threats and…

In an increasingly interconnected world, cyber threats evolve rapidly, making robust security measures and expert professionals more…

Hackers have breached the Tea app, exposing around 72,000 images — including 13,000 government ID and verification selfies — originally…

Introduction

PicoCTF (Forensics)

The safety net I never knew I needed

Web #1:
The first web application is vulnerable to Cross-Site Scripting (XSS) via the loan comment field, where malicious input such as <img src=’’ onerror=document.cookie=”XSS=XSS”> can be injected…

Fala, galera! Kinho0woned de volta! Peço desculpas pela ausência, mas prometo que não vou desaparecer de novo.

> About Author Hi, I’m Sharon, a product manager at Chaitin Tech. We build SafeLine, an open-source Web Application Firewall built for…

Android Studio Narwhal is now stable, introducing AI Agent Mode for complex tasks, new XR development tools, the K2 Kotlin compiler by default, and compatibility checks for 16KB pages.

Socket uncovers a long-running supply chain attack on RubyGems. A threat actor published 60 malicious gems stealing credentials from grey-hat marketers.

GitLab researchers uncovered a crypto scam on PyPI. Typosquatted Bittensor packages hijacked staking functions to silently drain users' crypto wallets.

Unit 42 uncovers DarkCloud Stealer's new evasion tactics, including heavily obfuscated JavaScript/WSF loaders and a final VB6 payload that injects into RegAsm.exe to bypass detection.

A critical Ruby JWE vulnerability (CVE-2025-54887, CVSS 9.1) allows attackers to bypass authentication tag validation in AES-GCM, potentially leading to data decryption and integrity loss.

OpenAI has released GPT-5, touting major advances in reasoning, speed, and coding. The new model is now available to developers and enterprise customers.

Microsoft's new AI assistant, Copilot for Gaming, is now in beta for Xbox Insiders. It provides in-game hints, answers questions, and recommends games.

The UCIe 3.0 standard has arrived, doubling chiplet data speeds to 64 GT/s. This open standard is set to revolutionize AI and high-performance computing.