The Axios npm hijack exposed millions to a RAT. Discover how North Korean-nexus actor UNC1069 used a masterful phishing ruse to bypass 2FA and steal credentials.

A massive fire at an AWS facility in Bahrain highlights a dangerous shift toward kinetic strikes on cloud infrastructure. Is your multi-region strategy ready?

TP-Link warns of high-severity flaws (CVSS 8.7) in Tapo C520WS cameras. Attackers can bypass auth or blind your security. Update to firmware 1.2.4 now!

If you squint and look at the CISA KEV list, you might think it's made up exclusively of vulnerabilities in file transfer solutions.

While this would be wrong (and you shouldn’t squint, it’s bad for your eyes), file transfer solutions do play a decent role…

Today, we woke up with a nagging feeling: what if Citrix had, in fact, patched multiple Memory Overread vulnerabilities as part of CVE-2026-3055?

While we've been using our analysis from Part 1 (please read it first, as this post will be brief) to accurately…

Sequels? Pain? We're obviously talking about Citrix NetScalers, yet again.

Welcome back to another watchTowr Labs blog post - pull up a chair, we always welcome new members to our group therapy sessions.

If you asked a C programmer what they most dislike…

This overview of the basics of Cloud Security includes some tips and resources for getting started in defending the cloud.

Real-world account of how insecure databases and an AI chatbot left customer data exposed and how it could have been prevented.

While hunting for broken link takeover opportunities, I came across an old Google Cloud Storage bucket that was previously used for Helm…

Free Link 🎈

How I earned $12,500 finding GraphQL introspection and batch query vulnerabilities in a fintech startup’s API infrastructure

Based on “Reverse Engineering a WhatsApp 0-Click Vulnerability” by Billy Ellis

How context engineering and AI agents unlock real exploitation — not just recon — in penetration testing, red teaming, and bug bounty…

I was staring at a clean search page on a private bug bounty program. No errors. No leaked data. Just “No results” or a normal page load

Based on “Live bug bounty hunting on Hackerone | Live Recon | part 2" by The Cyberboy

By Shah kaif | “Every leaked API key started as a commit someone thought was private.” | LinkedIn

In March 2026, we ran BugQuest, a 31-day campaign covering everything you need to know about finding and exploiting broken access control vulnerabilities. From understanding the basics of authenticati...

Hello hackers, Welcome to the latest edition of Bug Bytes! In this month’s issue, we’ll be featuring:   Earning $180K via SSRFs Free Burp Suite Pro licenses for top hackers  Bypassing tricky file uplo...

At Intigriti, we host monthly web-based Capture The Flag (CTF) challenges as a way to engage with the security researcher community. This month's challenge, brought forward by Kulindu , presented us...

In an NCSC blog on adapting vulnerability disclosure for AI safeguards, the authors posed questions to researchers. Intigriti observations and response.