Category: Web | Difficulty: Easy (But I think it should be a Medium Difficulty :) )

Discover how to access and benefit from the latest x reward program.

Koi Security exposed ShadyPanda, which infected 4.3M+ users by weaponizing trusted browser extensions (WeTab, Clean Master) through auto-updates. The malware performs RCE and exfiltrates data to China.

Zscaler exposed Matanbuchus v3.0, a MaaS downloader pivoting to ransomware. The stealthy C++ malware uses Protobufs for C2, QuickAssist for access, and time-wasting loops to bypass sandboxes.

A 3-flaw chain (CRLF, Auth Bypass, SQLi) achieves root RCE on Synology BeeStation. The exploit uses a "Dirty File Write" SQLi to inject a malicious crontab entry, bypassing the lack of a PHP interpreter.

Trend Micro exposed Water Saci, a campaign using LLMs to convert malware from PowerShell to Python, accelerating its spread via a WhatsApp worm. The multi-stage attack deploys a trojan capable of VNC mirroring and overlay attacks.

A High-severity Vim for Windows flaw (CVE-2025-66476) allows arbitrary code execution. The editor executes malicious binaries in the current working directory instead of safe system paths when running commands like :grep.

AWS Nova Forge allows deep customization of Nova 2 models via open-training (pre-, mid-, post-training). This ensures reliable AI outputs aligned with enterprise operational constraints.

Android 16's second update brings AI notification summaries and anti-scam tools. Accessibility gains Gemini-powered TalkBack and Expressive Captions for enhanced user experience.

Raspberry Pi raised prices on Pi 4 and Pi 5 models by up to $25, citing AI-driven memory demand. It simultaneously launched a new $45, 1GB Pi 5 entry model.

AWS launched Frontier Agents, a new class of autonomous AI agents (Kiro, Security Agent, DevOps Agent) capable of long-running, independent software engineering tasks.

AWS launched the Nova 2 model family (Lite, Pro, Omni) and Nova Act, an agent platform achieving 90% reliability in web-browsing tasks, with Nova Forge for deep customization.

Now I want to share how I solved the vulnlab from vulnhub, namely dc3. Let’s go straight to the method.

A deep-dive into stealthy command-and-control channels, covert communication techniques, EDR evasion, fallback C2 paths, and real-world…

API reconnaissance is the critical first step in API security testing. Before you can secure or test an API, you need to discover it and…

Splunk Basics — Did you SIEM

The Data Compass and the Dawn of Digital Sensation

Hi! Wellcome✋

To provide more professional and comprehensive cybersecurity insights, the Criminal IP Technical Blog has been newly integrated into the…

This writeup provides an overview of a real PikaBot loader sample, focusing on its behavior inside a sandbox