When we open the page, we see a navigation bar on the left with a Login tab.

Machine info : As is common in real life pentests, you will start the Puppy box with credentials for the following account: levi.james /…

Hello everyone! Have you heard about Marsant’s X? This innovative foldable electric bike is designed for convenience and efficiency. It’s…

Streaming Netflix abroad often comes with frustration: your favorite shows are suddenly unavailable due to geo-restrictions. The good news…

TL;DR: The AI gold rush created a fresh attack surface. Now the security giants are hoovering up AI-native startups to cover the full model…

The Secret to a Winning Cybersecurity Portfolio

So many wacky things going on with this email. It makes you just think…are little kids writing these scripts?

Use Cyber Threat Intelligence knowledge and skills to identify a threat based on a report.

Goal & Overview of the Lab

The rise of the PM who balances budgets, timelines — and breaches.

🛡️ October 2025 Cybersecurity News Recap

In a major upgrade for cloud security, Google is rolling out AI-powered protection to stop ransomware in its tracks — and it’s a…

Lado 1

Unit 42 disclosed a Critical unauthenticated RCE flaw (CVE-2025-52906) in TOTOLINK X6000R routers, allowing remote attackers to execute arbitrary commands. Update immediately.

Splunk issued patches for six flaws, including a High-severity blind SSRF (CVE-2025-20371) and XSS issues that could allow attackers to access sensitive data and crash the platform.

The Django team released urgent updates (v5.2.7, 5.1.13, 4.2.25) to fix a High-severity SQL Injection flaw (CVE-2025-59681) affecting QuerySet methods in MySQL/MariaDB.

Rhadamanthys stealer's v0.9.2 update adds new anti-analysis checks, a custom executable format, and uses noisy PNG files for payload delivery to bypass security tools.

Argo CD patches multiple High-severity DoS flaws. A single unauthenticated webhook request can crash the entire argocd-server process via improper JSON handling.

The Detour Dog campaign is using DNS TXT records for stealthy C2, infecting thousands of websites and quickly shifting infrastructure to evade sinkholing efforts.

Russian-speaking Lunar Spider group is using the sophisticated Latrodectus V2 loader and a FakeCaptcha lure to gain initial access for ransomware operations.

CISA warns of a Critical RCE flaw (CVSS 9.8) in Megasys Telenium Online Web Application. The vulnerability allows unauthenticated attackers to execute arbitrary OS commands.