CERT Polska exposed NGate, an Android malware that tricks users into tapping their card against their phone to steal NFC EMV data and PINs. The data is then relayed to an ATM for cash withdrawal.

Trustwave confirmed the "Trinity of Chaos" alliance (Scattered Spider, LAPSUS$, ShinyHunters) launched a federated EaaS model for high-profile extortion, driven by performance, theatrics, and insider recruitment.

CISA added two critical, actively exploited flaws to its KEV Catalog: Gladinet LFI (CVE-2025-11371) risks RCE via machine key theft, and CWP RCE (CVE-2025-48703) allows unauthenticated admin takeover.

Google Translate rolled out a Gemini-powered "Advanced" mode that sacrifices speed for higher accuracy and contextual fluency. The feature is currently limited to select language pairs like English/French/Spanish.

China's RedDrip exposed APT zero-day exploitation of Android email clients, achieving 1-click RCE via the ZipperDown flaw to steal account tokens and compromise targets around the Korean Peninsula.

A Critical RCE flaw (CVE-2025-11953, CVSS 9.8) in React Native Community CLI allows unauthenticated attackers to execute arbitrary code via a command injection in the exposed Metro Dev Server.

A Critical (CVSS 9.8) LFI flaw (CVE-2025-12493) in ShopLentor (WooCommerce Builder) allows unauthenticated attackers to run arbitrary .php files and compromise 100K+ e-commerce sites.

CTF — Based

Advanced mapping of API vulnerabilities with OWASP Top 10 and CVSS. Details reconnaissance phases and defense evasion techniques.

An easy OSINT demo and safety guide

If you’re still on Windows 10 or thinking about what comes next, you’ve probably noticed the buzz.

As always we’ll start off with an nmap scan.. This is alot of information.. So bare with me..

TL;DR: In this lab, I analyzed a vulnerable WordPress-based web server running on Apache. I started with enumeration (port scan and…

Blockchain has long been seen as unbreakable — a fortress of trust securing trillions in crypto. But the rise of quantum computing could…

Continuing my home SOC lab journey, I hit an interesting challenge: my Wazuh server is cloud-hosted on Linode, but my Splunk Enterprise…

Extracting a Whitespace-Hidden Flag

This is a short walkthrough of Intro to Cyber Threat Intel from TryHackMe

Episode 10: Detection Engineering Life Cycle (Part 2)

We’ve reached the final challenge. Stuxbot has evolved, and it’s time to put everything we’ve learned to the test. This skills assessment…

“3.5 million jobs. $100K+ starting pay. Zero unemployment.” Sounds too good to be true? It’s not — if you know how to play the game.