Amazon uncovered an advanced APT simultaneously exploiting Cisco ISE RCE (CVE-2025-20337) and Citrix Bleed Two (CVE-2025-5777) as zero-days. The attacker deployed a custom in-memory web shell on Cisco ISE.

A new macOS threat uses malicious AppleScript (.scpt) files, disguised as documents/updates, to bypass Gatekeeper and execute stealers like MacSync and Odyssey, exploiting user trust.

Zoho issued an urgent patch for a Critical (CVSS 9.8) Unauthenticated SQL Injection flaw (CVE-2025-8324) in Analytics Plus. The bug risks remote query execution and account takeover. Update to Build 6171.

How I Became the #1 Security Researcher on the DHS Vulnerability Disclosure Program (October 2024 — April 2025)

In the world of cybersecurity, the initial reconnaissance phase is one of the most critical steps. The more you know about your target, the…

Análisis de la vulnerabilidad BOLA (Broken Object Level Authorization), su explotación (escalada horizontal/vertical) y metodología de…

I changed user_id=42 to user_id=43… and suddenly I was looking at someone else’s profile.

Introducción

After obsessing over and completing my first CTF challenge, Bandit by OverTheWire, I was introduced to microcorruption by NCC Group. From…

The Washington Post has confirmed a data breach that exposed personal and financial information belonging to nearly 10,000 current and…

“OWASP top 10–2025 vs 2021- The “what” and “why”” is published by Cyberbali.

A practical dive into the first two CISSP domains — Security & Risk Management and Asset Security with simple command line tasks that show…

Introduction

In 2025, WhatsApp scams have become increasingly sophisticated, making it essential for users to stay vigilant. One prevalent method…

Acompañame a hacer la maquina “Jerry” en HTB. Esta fue bastante directa, ideal para entender un vector de ataque muy común en servidores…

Como hackers chineses usaram o Claude para fazer em segundos o que uma equipe inteira de especialistas levaria semanas, e por que isso muda…

Abstract: This document provides an introduction and operation of the whole process by using today’s popular Internet vulnerabilities and…

RansomHouse claimed a ransomware attack on Italian fiber producer Fulgar, posting samples of stolen financial and corporate data after gaining access on October 31.

Cybersecurity firms are sounding the alarm over a critical vulnerability in Fortinet FortiWeb, the company’s Web Application Firewall (WAF) product. The flaw, which has been observed activel…

ASUS released an urgent patch for a Critical (CVSS 9.3) Auth Bypass flaw (CVE-2025-59367) in its DSL Series Routers. The bug allows remote attackers to gain unauthorized access without credentials. Update firmware immediately.