Every day, the cybersecurity world produces an absurd amount of information.

Subtitle:

Open Redirects are often treated as the “jaywalking” of web vulnerabilities. Many bug bounty programs explicitly mark them as out-of-scope…

Introduction

## Overview

At a glance Actor or group: Tajin Group (suspected Chinese-speaking cybercriminal syndicate) Activity type: Phishing, payment card theft, and money laundering Targets or victims: Mainland Chinese …

TL;DR Google released security updates on September 17, 2026, addressing sixteen vulnerabilities in its web browser. These Google Chrome vulnerabilities include two critical flaws that permit memo…

A severe Dokploy OS command injection vulnerability threatens self-hosted Platform as a Service (PaaS) environments. Tracked in vulnerability note VU#280377 and assigned CVE-2026-72878, this criti…

At a glance Actor or group: Unidentified cybercrime group (financially motivated threat actors) Activity type: Device code phishing, OAuth token theft, and business email compromise Targets or vic…

https://medium.com/@mansigolecha84_17480/im-starting-my-100-hour-bug-bounty-challenge-here-s-my-method-f26a40f02df5?source=friends_link&sk=b…

What’s up folks. So this one wasn’t some deep, multi-hour recon grind — it was one of those bugs that just falls into your lap while you’re…

An authorization flaw in GitLab’s AI detection API, the evidence behind my report, and the permission change that fixed it.

A company lobby is often the first point of contact between visitors and the workplace. Behind the reception process, however, there are…

The browser was never meant to become a battlefield.

Most AI claims on pentest vendor pages are true. A surprising number just aren’t about pentesting.

Lab eight in my Web Security Academy series — the first one where the vulnerability lives in the filesystem, not the login form

Moving from cybersecurity theory to hands-on practice and what my first lab experience taught me.

Authentication / Password Reset Testing

A trusted XML request should never be able to decide which Java objects your server creates.