Platform: HackTheBox (web) | Completed: 2026–07–23 Flag: HTB{[redacted]} Difficulty: Hard | Chain: HTTP Parameter Pollution -> SSRF ->…

The Emergence of a New Attack Vector Mobile artificial intelligence assistants, designed to operate smartphones autonomously, represent a novel tool for cyberattacks. Specialists have demonstrated…

Millions of vehicles across the United States carry a concealed device meant to guard them against theft. Instead, that device has allowed strangers to open doors, silence alarms, and immobilise e…

TL;DR A security researcher has published full details and proof-of-concept code for a Foxit PDF Reader vulnerability. Tracked as CVE-2026-57239, the flaw lets a local, unprivileged user gain NT A…

TL;DR Vercel fixed three Next.js vulnerabilities, each rated CVSS 8.3. Two of them allow Server-Side Request Forgery, while the third lets crafted requests slip past middleware-based authenticatio…

TL;DR CERT/CC published vulnerability note VU#326070 on July 16, 2026. It details an SGLang vulnerability, CVE-2026-14890, rated CVSS 9.1. An unauthenticated attacker can run code on the host, and…

Cracking Authentication Like a Pro

A Defensive Review of Common Security Weaknesses Discovered During an Authorized Capture The Flag Exercise

How OpenAI’s frontier AI escaped containment and breached Hugging Face in the first documented AI agent cyber incident.

A remotely exploitable stack-based buffer overflow in the Edimax BR-6478AC router lets attackers corrupt memory through its PPPoE…

In this write-up, I will explain the five major phases of penetration testing. Each phase has a specific objective and plays an important…

“The server was never the only thing you needed to understand. The browser has been running real logic, making real decisions, and holding…

SMB Enumeration for OSCP – A Practical Guide SMB (Server Message Block) enumeration is one of the most important phases during penetration testing. Misconfigured SMB services can expose sensitive …

Understanding BYOVD (Bring Your Own Vulnerable Driver) Attacks and How Adversaries Mute EDRs from Ring 0

This one runs entirely through a single, unassuming contact form, from a hidden backend parameter all the way to root.

SOMBEBODY HELP MEE!!! Lucky you! Here's the write-up you're looking for.