The Transition to Passwordless Security Passwords are gradually giving way to passkeys as the primary means of digital authentication. Nevertheless, account security remains heavily dependent on h…

The Emergence of Agent-Against-Agent Exploits An AI agent can deceptively trigger another agent with elevated privileges. Consequently, an attacker can exploit this mechanism to compromise a softw…

The Emergence of Fabricated Vulnerabilities Vulnerability databases recently received reports of critical SQLite flaws. These fictitious vulnerabilities boasted severity scores reaching a staggeri…

While CVSS is still the right tool for many AI security findings, AI safety needs customer-specific, outcome-based scoring.

TL;DR: A permissions endpoint expected a single numeric user ID in one POST parameter. Sending two IDs separated by a comma — victim first…

Part 3 — The complete email OSINT workflow, in order: validation, dorking, the pivot, verification discipline, the legal line, and a…

How I used a 3-line bash script to find 8 backdoorable plugins in an official plugin registry — and why this attack requires zero exploits.

Type https://example.com into a browser and hit Enter. A page shows up — text, maybe an image or a login box — and you move on. You don't…

What’s up everyone! Nitin here 👋

Direct injection and jailbreaks keep getting closed as informational. The findings that pay chain a hidden instruction to a real…

Finding and proving a cross-user resource deletion vulnerability through JS bundle analysis and sequential ID enumeration

A walkthrough of abusing RFC 7591 Dynamic Client Registration left open in production

Finding 500, 1,000, or even 10,000 subdomains isn’t the difficult part of bug bounty reconnaissance.

Two Recent Grafana Security Issues Every Security Team Should Understand

The login form is the first unauthenticated entry point to most web applications. When it’s vulnerable to SQL injection, attackers can…

The Biggest Security Lie Developers Still Believe “It’s secure. We have a firewall, we use HTTPS, and we’ll run a scan before we go live.” If you’ve heard these words — or worse, said …

Credit: Cloudanix

This week, I attended the Melbourne Secure Software & AppSec Summit 2026.

Six disclosed findings across Anthropic, Google, and OpenAI CI integrations share one root cause. An explanation of what it is, why each…

Exploring HTTP Verb Tampering and Broken Access Control