A memory image was acquired from a suspected compromised Windows workstation. The system belonged to a user flagged for potentially…

Bridges are DeFi’s biggest graveyard. Billions have vanished through exploits of wrapped assets and ass bridges. Soul Protocol built its system to avoid that pitfall entirely. Instead of dragging…

Happy to share with you my writeup for solving 4 DFIR challenges out of 5 in CAT Reloaded CTF  — CATF2025.

Let’s be honest: cybersecurity often feels like a never-ending game of cat and mouse.  Attackers only need to be right once. We need to be…

The cybersecurity landscape is constantly shifting, marked by an escalating volume and sophistication of threats. Traditional vulnerability…

In an era defined by rapid digital transformation and an ever-expanding threat landscape, the proactive identification and mitigation of…

In an era defined by persistent cyber threats and rapidly expanding digital footprints, the traditional approaches to vulnerability…

In an increasingly complex and interconnected digital landscape, proactive cybersecurity measures are paramount for organizational…

Hack into a vulnerable database server with an in-memory data-structure in this semi-guided challenge!

I was privileged to be able to participate int Catreloaded 2025 CTF and in this writeup I will show the solution to the challenges which I was able to solve when we open the challenge we are prompted…

Exploiting Insecure Direct Object Reference and Linux Capabilities through Privilege escalation using Linpeas in the Cap HackTheBox machine

The digital landscape continuously evolves, making robust vulnerability assessment more critical than ever before. As organizations face…

APPERENTICE-PRACTITIONER Labs

A critical vulnerability in the Directus API (CVE-2025-55746) allows unauthenticated attackers to silently upload and modify files, leading to webshells and RCE.

A new report reveals a stealthy attack on GeoServer using a critical RCE flaw. Instead of ransomware, attackers are hijacking servers to earn passive income.

A new report from HarfangLab details two recent UAC-0057 (Ghostwriter) campaigns targeting Ukraine and Poland with malicious archives and multi-stage implants.

A critical flaw in the widely used sha.js library (CVE-2025-9288) can lead to hash collisions and private key extraction, threatening web applications.

UNC5518 is using "ClickFix," a new technique that weaponizes fake CAPTCHAs to trick users into launching malware and providing access to other criminal groups.

A new report reveals a sophisticated spear-phishing campaign targeting finance executives. The attack uses social engineering and legitimate tools to evade detection.