A beginner-friendly breakdown of recon, payloads, and vulnerability discovery.

Understanding how insecure key lookups enable forged tokens and admin-level compromise.

Hi Vipul from The Hacker’s Log here — ready to take you inside the real world of cyber investigation.  Today, we’re going deep — into the…

Linux, khususnya distribusi Ubuntu Server, adalah salah satu pilihan paling populer untuk membangun web server. Stabilitas, keamanan, dan…

Tiệm Lẩu Đường Hạnh Phúc là một trò chơi di động hấp dẫn, kết hợp giữa yếu tố quản lý thời gian và mô phỏng. Trong game, người chơi sẽ vào…

This is my first time doing practical threat modelling on a (toy) system end-to-end. It’s not a production app, but it was enough to make…

The unfortunate truth is that poorly designed and improperly secured Artificial Intelligence integrations can be misused or exploited by…

Over the last weeks I’ve been moving from “just writing code” into thinking like a defender.

Artificial intelligence in the browser was supposed to be the upgrade we all wanted. A built-in assistant that reads pages for us, extracts…

It’s Not About the Tools, It’s About the Questions You Ask Before You Search.

มีข้อมูลหนึ่งที่น่าตกใจ แต่สะท้อนสถานการณ์จริงของ SME ไทยในปีนี้อย่างชัดเจน:

This is a focused, methodical walkthrough of the Cicada machine from Hack The Box, highlighting real-world attacker behavior, clean…

The Challenge of Connectivity in China

OpenAI is testing a "Confession" mechanism to reduce hallucinations. Models are trained to disclose internal flaws and lies, rewarding them for candor over accuracy.

Google expanded Android's call-scam protection. It detects suspicious calls while financial apps are open, triggering a 30-second mandatory pause for users.

Russia imposed a network-level blockade on Apple's encrypted FaceTime service, citing its alleged use for coordinating fraud and terrorist attacks, making the app unusable.

Apache HTTP Server 2.4.66 patched five flaws. Key fixes include a moderate SSRF flaw (CVE-2025-59775) that risks NTLM hash leakage on Windows, and a mod_userdir/suexec bypass. Update immediately.

ASEC exposed PrintMiner, a Monero cryptominer spreading via USB LNK files. It uses DLL Side-Loading (printui.exe) and "Smart Mining" to suspend activity when games or Task Manager are opened.

Apache patched a Catastrophic XXE flaw (CVE-2025-66516, CVSS 10.0) in Tika Core. The bug is exploitable via malicious XFA data inside a PDF, risking server-side data disclosure and RCE. Update immediately.

Amazon exposed Chinese APTs exploiting the React2Shell zero-day (CVE-2025-55182, CVSS 10.0) hours after disclosure. Earth Lamia and Jackpot Panda are actively targeting unpatched Next.js servers for reconnaissance.