CloudSEK exposes a massive network of Amazon clones and 200k fake .shop domains targeting Black Friday shoppers. Learn how to spot these holiday scams.

Critical GitLab updates (18.6.1/18.5.3) fix severe CI/CD credential theft (CVE-2024-9183) & unauthenticated DoS flaws. Upgrade immediately.

By ghostyjoe

With the thousands of Bug Bounty Programs currently hosted on Intigriti, HackerOne, Bugcrowd and other platforms, it is very easy to get…

In the world of cybersecurity, theory only gets you so far. To truly understand the cat-and-mouse game between attackers and defenders, you…

Whispers From Rome

Good morning dear USA. I have a proof about Azerbaijan Polis Department and him collectively uniformed and create illegally actions ,& this names make illegaly acts from Azerbaijan Polis …

The first Congressional hearing on autonomous AI cyberattacks is scheduled for December 17. The questions they’re asking are the right…

A strong defense requires a multi-layered, SAP-specific security strategy combining hardening, monitoring, network segmentation, incident…

A critical remote code execution (RCE) vulnerability has been discovered in the Ray framework, putting AI and Python developers at risk of having their systems compromised. The vulnerability, trac…

A sophisticated new cyber espionage campaign has been uncovered by Zscaler Threat Hunting, revealing how a Russia-aligned Advanced Persistent Threat (APT) group known as Water Gamayun is weaponizi…

The highly anticipated October release of EA’s Battlefield 6 has become a digital minefield for gamers. Bitdefender Labs has identified multiple active malware campaigns exploiting the shooter’s p…

Alert: Malicious Blender files are delivering StealC V2 infostealer. 3D artists downloading from free sites are at risk. Disable auto-run scripts now.

Critical alert: Twonky Server suffers unpatched flaws (CVE-2025-13315/16) allowing full takeover. Vendor has no fix; isolate your server immediately.

A massive leak exposes Iran's Department 40 (APT35). Discover how IRGC hackers build target packages for assassination squads and drone strikes.

CVE-2025-66035: Angular protocol-relative URLs leak XSRF tokens, bypassing CSRF protection. Update to v19.2.16, v20.3.14, or v21.0.1 now.

The application is a Flask-based e-commerce platform running inside a Docker container. The attack chain combines a JWT role forgery…

Your first stop in ethical hacking.

During my OSCP labs and internal network simulations, I struggled with traditional pivoting tools like SSH tunneling and Chisel — either…

DCSync is one of those attacks that sounds more complicated than it actually is. Here’s the concept: if an attacker has an account with the…