You can’t sell bombs made out of power plants and wastewater facilities, as it turns out.

As mobile developers, we often focus on building fast, beautiful apps — but sometimes, we forget that security is just as important as…

“I destroyed months of your work in seconds.” — Replit’s AI

How I built an intelligent brute-force tool that automatically analyzes login forms using Large Language Models

How organizations can defend against one of the most common attack vectors in 2025.

Güvenlik Ayrıcalığına Son: Herkes İçin Kapsayıcı, Erişilebilir ve Akıllı Bir Mobil Güvenlik Mümkün mü? MerYunCyber, siber güvenliği bir ürün olmaktan çıkarıp, Cihaz-içi Yapay Zeka (On-Device AI) ve…

In the ever-changing world of cybersecurity, one truth remains constant: trust no one. But as threats evolve and networks grow more…

Hi my name is Samuel Parlindungan, CEH, EJPT. I would like to continue playing about session security especially csrf. Perhaps i will…

中文指令筆記

The Paris Prosecutor’s Office has opened a criminal investigation into Elon Musk’s X social network for “algorithmic manipulation aimed at…

الثغرة تم تصنيفها خطيرة (High)، مع إني بصراحة توقعتها متوسطة، بس الظاهر الموقع يهتم مرّة بأي شي له علاقة بالمستخدمين وخصوصيتهم، فعشان كذا…

Coercer is a python script to automatically coerce a Windows server to authenticate on an arbitrary machine through 9 methods.

Microsoft reveals a link between the defunct FMovies and a massive infostealer campaign that compromised over 1 million devices, stealing credentials and financial data.

Three malicious packages disguised as browser updates in the Arch User Repository (AUR) deployed the CHAOS RAT trojan, compromising Linux systems.

Japanese police have released a free decryption tool for Phobos and 8Base ransomware victims, offering hope for data recovery after a major international crackdown.

HPE warns of a critical vulnerability (CVE-2025-37103, CVSS 9.8) in Aruba Instant On APs with hardcoded credentials, allowing unauthenticated full administrative access. Update immediately!

A phishing campaign stole npm maintainer tokens, leading to trojanized versions of eslint-config-prettier, synckit, and other packages, enabling remote code execution on Windows systems.

Nokia's WaveSuite NOC platform has two severe command injection vulnerabilities (CVE-2025-24938, CVE-2025-24936) allowing remote code execution, even with low privileges.

A financially motivated threat group now known as Greedy Sponge has reemerged with a revamped campaign targeting organizations in Mexico, according to a detailed report by Arctic Wolf Labs. Active…

Trustwave uncovers an Android malware cluster using fake Facebook & TikTok apps to lure victims via brand impersonation, abusing permissions for data collection and traffic monetization.