A comprehensive look at what it really takes to succeed in penetration testing

Apple’s ambitious 2026 roadmap features 15+ major products: iPhone 18, a foldable iPhone, M6 MacBooks with touchscreens, and a massive Apple Intelligence rollout.

SEQRITE exposed SkyCloak, an espionage campaign targeting Russian/Belarusian military personnel. It uses malicious LNK files to deploy OpenSSH over Tor obfs4 bridges for stealthy, persistent remote access.

Fortinet exposed TruffleNet, a massive BEC campaign using stolen AWS keys to exploit Amazon SES for email fraud. It abuses Portainer as a C2 and uses TruffleHog for reconnaissance.

Zimperium found 760+ Android apps exploiting NFC/HCE to steal payment data. The malware impersonates 20 banks across Russia, Poland, and Brazil, using Telegram for criminal coordination.

Researchers at Arctic Wolf Labs have uncovered an extensive cyber espionage campaign by UNC6384, a Chinese-affiliated threat actor, targeting European diplomatic entities across Hungary, Belgium, …

In a recent blog post, Google revealed that “in the last 12 months, fraudsters have used advanced AI tools to create more convincing schemes, resulting in over $400 billion in stolen funds globall…

Researchers at Gen Threat Labs have identified two new toolsets in active use by North Korean state-sponsored groups, underscoring the regime’s continued investment in advanced cyber-espionage and…

ASEC confirmed Kinsing is exploiting Apache ActiveMQ RCE (CVE-2023-46604) to deploy XMRig cryptominer. The group now integrates Sharpire, Cobalt Strike, and Meterpreter for advanced post-exploitation.

Silent Push found AdaptixC2, an open-source pen-testing framework, is now used by Russian cybercriminals and Akira RaaS. The developer's Russian-language activity suggests strong ties to the threat ecosystem.

Cyfirma exposed Android/BankBot-YNRK, a Trojan cloning Indonesia’s Digital ID app to steal credentials and crypto assets. It uses anti-emulation checks and JobScheduler for persistent device takeover.

Cybereason exposed Tangerine Turkey, a VBScript worm that spreads via USB drives. It uses LOLBins (printui.exe) and Windows Defender exclusions to deploy the XMRig cryptominer for profit.

Perplexity AI licenses Getty Images' visual archives to integrate visuals into search with proper attribution, marking a strategic shift in AI copyright battles.

Elastic patched a Critical EoP flaw (CVE-2025-37736) in ECE (v3.8.3/4.0.3) where the readonly user can create admin users and inject new API keys by bypassing authorization checks.

Here’s a little tip for testing XSS in chatbot instances; when you inject an XSS payload as a user message and it doesn’t execute, don’t…

A brutally honest look at why we’re all terrible at protecting our digital lives

Nothing wrong with adding a few more bodies to the pile.

When securing a website, many focus on the obvious security aspects such as HTTPS, regular updates, and reputable hosting providers. But…

I. SSRF with blacklist-based input filter

I. DOM XSS via client-side prototype pollution

Untuk kalian yang ngaku pengen jadi hacker, pernah dengar istilah BAC atau Broken Access Control?