How a simple business-logic flaw turned an invalid quantity into a zero-payable cart.

Security testing doesn’t always require complex exploits.

TL;DR Google released a Chrome security update, version 154.0.8037.92/.93, that fixes 33 security flaws. The top issue is CVE-2026-102331, a critical buffer overflow in the ANGLE graphics layer. G…

TL;DR CISA published advisory ICSA-26-272-06 on September 29, 2026, for a critical MikroTik RouterOS vulnerability, CVE-2026-84411. A single crafted HTTP request can give an unauthenticated attack…

How a mobile security assessment uncovered authorization flaws, insecure authentication token storage, and sensitive medical data surviving…

Welcome to this new Medium post, in this one we will see how to obtain a valid process handle without ever calling OpenProcess. We will use…

A practical walkthrough on configuring UFW firewall rules, auditing sockets, restricting privileges, and disabling unneeded daemons to…

Editorial is an easy difficulty Linux machine that features a publishing web application vulnerable to Server-Side Request Forgery (SSRF)…

TL;DR Walkthrough of the TryHackMe ADCS: NTLM Relay Walkthrough network room.

Overview

Badathala Jaisurya

Not the tools but The habits that matter , from BS Cyber Security student’s first month on the job.

Ascension is a fairly easy Linux based CTF hosted on hacksmarter.org, its author is Ryan Yager. Unlike other ctf’s this one has 6 flags…

Dutch police say a ShinyHunters suspect is also suspected of trying to arrange two murders abroad, a case separate from the cybercrime investigation.

TL;DR A Podman vulnerability, CVE-2026-94603, rated CVSS 10.0, lets a container image switch off nearly all sandboxing when started with podman run. It even overrides restrictions the user asked f…

TL;DR A JupyterLab Desktop vulnerability, CVE-2026-102530, rated CVSS 9.4, lets a malicious server URL run code on a user’s computer. The app displayed remote server URLs without sanitizing …

Sometimes the most interesting API vulnerabilities aren’t hidden behind complicated authorization logic.

Dependabot’s three-day pause shows why dependency automation now needs timing controls, evidence, and exception paths. Explain This: Dependabot’s Cooldown Is a Supply Chain Control, Not a …

Cyberattacks are becoming more sophisticated, and organizations can no longer rely solely on firewalls, endpoint protection, or…

The late ’00s to early ’10s witnessed the birth of social media platforms. YouTube, Facebook, and Instagram are some of the most notable…