How a missing tenant-to-SSO binding turned a valid authentication response into cross-organization account takeover

I Found a Tiny Filename Bypass That Broke a “Safe” Loader — and Earned $ $$$ السلام عليكم ورحمة الله وبركاتة Sometimes the best security findings start with a …

بِسْمِ اللَّهِ رَبِّ الْعَالَمِينَ، وَالصَّلَاةُ وَالسَّلَامُ عَلَى رَسُولِنَا الْأَمِينِ.

Testing Duplicate Upload Protection

Still Securing Your Computer

Description : Linux Machine CTF! You’ll learn about enumeration, finding hidden password files and how to exploit php deserialization!

🚨 TP-Link Archer AX55 (Hardware V4) Just Got a Serious Wake-Up Call

We live in an era of digital dependency, existing as mere tenants of our own identities. Every day, we navigate the web using a patchwork…

A story about how one shared default password, combined with a simple user-enumeration flaw, turned into a critical account takeover…

Certificate Ethical Hacker

I Got Root. Now What?

Lab Disclaimer: This walkthrough is based on an intentionally vulnerable DC-6 machine used for cybersecurity learning. Perform these…

Windows Domain: When there are a large number of users spread across different places, managing them individually is not possible, so a…

Disclaimer: This article documents my learning experience in a TryHackMe lab. All investigation activities were performed in the authorized…

Most teams treat the OpenAPI file as documentation.

At a glance On September 9, 2026, federal security agencies exposed intellectual property theft targeting American artificial intelligence developers. Field Details Actor or Group China-based AI f…

TL;DR Microsoft’s September 2026 Patch Tuesday fixes 996 vulnerabilities. Two of them are zero-days already exploited in the wild. Both are Windows elevation of privilege flaws that attacker…

SNMP leaks a password baked into a script’s argv, a REST API’s backup endpoint turns into remote code execution inside a Docker container…

Welcome to this new Medium post. In this article, we’ll explore a technique to dump Windows credentials using a File Handle Redirection…