This write-up details the solution for the Intigriti Challenge 1125. Unlike standard technical reports, this post focuses on the…

The 11.10.25 Crystal Palace release added more new commands in one go than I think I've seen thus far. Many of them seemed really similar at first blush, and it took me a while to get an understanding of where each one is applicable (I failed in that

A Critical DLL Hijacking flaw (CVE-2025-13051) in ASUSTOR Backup Plan/EZSync allows local attackers to gain SYSTEM privileges by planting a malicious DLL in a user-writable path. Update immediately.

A Critical DoS flaw (CVE-2025-65015) in joserfc allows unauthenticated attackers to overwhelm log/SIEM systems by injecting massive JWT payloads into exception messages.

CISA, NSA, and FBI released a guide to dismantle Bulletproof Hosting (BPH) networks. It advises ISPs on precision filtering and stricter vetting to curb infrastructure used by ransomware and phishing campaigns.

A deep-dive on Lazarus’s ScoringMathTea RAT reveals a full reflective DLL injection system, TEA/XTEA C2 encryption, and a polyalphabetic cipher for API hashing—a highly evasive tool for espionage.

A 42-day Akira ransomware attack started with one ClickFix CAPTCHA that deployed SectopRAT. The attackers went undetected despite EDRs, stealing 1 TB and deleting cloud storage backups.

Cybereason exposed The Gentlemen, a new, technically advanced Go-based RaaS using XChaCha20/Curve25519 crypto. The group claimed 48 victims in 3 months, leveraging WMI and PowerShell for propagation.

Trend Research warns that ransomware is shifting to AWS S3, exploiting misconfigured IAM and SSE-C keys in five attack variants to cause irreversible data loss and cloud-native extortion.

Broadcom exposed a group deploying multiple RMM tools (ScreenConnect, LogMeIn, Naverisk) weeks apart to achieve redundant persistence. The likely Initial Access Broker (IAB) prepares systems for resale.

Apache patched a Critical RCE flaw (CVE-2025-64408) in Causeway allowing authenticated attackers to execute arbitrary code via Java deserialization in the ViewModel component. Update to v3.5.0.

Microsoft will introduce a feature for public display systems (digital signage) to hide crash screens (BSOD) after 15 seconds, making the system appear off rather than crashed.

For years, driver-related failures have appeared with relentless regularity. Whether produced by hardware manufacturers or software vendors, faulty drivers have long been capable of destabilizing …

NVIDIA's Q3 revenue hit a record $57B, up 62% YoY, as CEO Jensen Huang declares the AI boom is not a bubble but its "true ascent." Shares surge 5%.

OpenAI launches ChatGPT for Teachers: FREE until 2027 for US K-12 educators. It features enhanced security, FERPA compliance, and full access to AI tools.

Google's Accelerator Impact Report reveals over 1,700 alumni have raised a massive $31.2 billion and created over 109,000 jobs globally since 2016.

Thunderbird 145.0 now includes full, native support for Microsoft Exchange (EWS), eliminating plugins and making migration from Outlook/M365 accounts seamless!

The EU is investigating if Amazon AWS and Microsoft Azure must be named DMA gatekeepers, facing strict new rules to ensure fair cloud competition in Europe.