Cybersecurity systems: The Reason Companies Need You to Protect Them

The person who runs a comic store claims to have a rare collection, but engages in misleading behavior. He makes false promises to…

This series walks you through the process of building a web application from scratch while simultaneously examining one of the most common…

(2025 Edition: No bigger headline, just the moment your device turned against you.)

This is a walkthrough of Pyramid of Pain from TryHackMe

How a simple rebinding trick enabled remote attackers to hijack Burp’s MCP tools and access internal networks

لقد تحدثت كثيرًا عن كونك أكثر قراصنة النخبة في النظام الشمسي. أثبت ذلك وطالب بحقك في الحصول على لقب نخبة قراصنة النخبة

You talked a big game about being the most elite hacker in the solar system. Prove it and claim your right to the status of Elite Bounty…

Diving into attacks, concepts, and techniques in cybersecurity. Here’s a summary of what I’ve covered: *Types of Malware:* - *Spyware*: Tracks online activity, logs keystrokes, and captures …

Introduction: Learning Linux Without a Safety Net

“Identity theft is not a JOKE, Jim!!!! Millions of families suffer every year.” — Dwight Kurt Schrute (The Office U.S.)

I survived the OSI model wars, so you don’t have to. Here’s what actually matters.

About this lab

Atlassian patched a Critical (CVSS 8.7) Path Traversal flaw (CVE-2025-22167) in Jira Software/Service Management that allows attackers to perform arbitrary file writes. Immediate update is urged.

Symantec exposed a complex Chinese APT network (Glowworm/UNC5221) deploying Zingdoor and ShadowPad across US/South American targets. The groups abuse DLL sideloading and PetitPotam for credential theft.

A NuGet typosquat named Netherеum.All used a Cyrillic homoglyph to fool 11M+ downloads. The malicious package injected an XOR-decoded backdoor to steal crypto wallet and private key data.

A Critical RCE flaw (CVE-2025-59287, CVSS 9.8) in WSUS allows unauthenticated attackers SYSTEM access via AuthorizationCookie deserialization. The issue was patched in the October update.

Elastic exposed Chinese threat actors exploiting public ASP.NET machine keys to deploy TOLLBOOTH IIS backdoor and HIDDENDRIVER kernel rootkit. The malware performs stealthy SEO cloaking.

Group-IB exposed MuddyWater using NordVPN to send phishing emails that deliver the Phoenix v4 backdoor. The malware steals credentials via a custom Chromium stealer disguised as a calculator.

SUSE patched a Critical RCE flaw (CVE-2025-54469, CVSS 10.0) in NeuVector Enforcer that allows attackers to inject commands via unsanitized environment variables, risking container root shell access.