Discovered flaws in Claude Code expose path restriction bypass and command injection risks - turning AI inward with inverse prompting

BitLocker is a full disk encryption feature which was designed to protect data by providing encryption to entire volumes. In Windows endpoints (workstations, laptop devices etc.), BitLocker is typi…

A penetration testing tool for odoo applications. Contribute to MohamedKarrab/odoomap development by creating an account on GitHub.

Upstream HTTP/1.1 is inherently insecure, and routinely exposes millions of websites to hostile takeover. Join the mission to kill HTTP/1.1 now

This blog walks you through using our script to audit a Salesforce environment, uncovering excessive permissions and platform-specific risks like SOQL injection.

Introduction: when the trust model can’t be trusted Secrets vaults are the backbone of digital infrastructure. They store the credentials, tokens, and certificates that govern access to systems, services, APIs, and data. They’re not just a part of the trust…

DarkCloud Stealer's delivery has shifted. We explore three different attack chains that use ConfuserEx obfuscation and a final payload in Visual Basic 6.

Today Koi exposes one of the most notorious attack groups we’ve yet to encounter — Greedy Bear. The group lunched a coordinated attack…

where my words occasionally escape /dev/null

A newly disclosed vulnerability in Python’s standard library, CVE-2024-12718, allows attackers to modify file metadata or file permissions outside the intended extraction directory. This issue affects systems running Python 3.12 and above when using tarfile.extract()…

Prompt injection pervades discussions about security for LLMs and AI agents. But there is little public information on how to write powerful, discreet, and reliable prompt injection exploits. In this post, we will design and implement a prompt injection exploit…

Curious to hear about our experience exploiting Retbleed (a security vulnerability affecting modern CPUs)? Then check out this post to see how we pushed the boundaries of Retbleed exploitation and understand more about the security implications of this exploit…

The Eye Security Research team has uncovered a new critical misconfiguration that exposed sensitive data at internal Microsoft applications.

SquareX launches two open-source toolkits to help security teams simulate and defend against browser-based attacks that evade traditional enterprise defences.

How context engineering is reshaping the future of AI development — and why your emotional intelligence might be your most valuable asset

The era of patient, methodical reconnaissance is over. Your AI coding assistant has already done all the work for attackers.

540K subscribers in the netsec community. /r/netsec is a community-curated aggregator of technical information security content. Our mission is to extract signal from the noise — to provide value to security practitioners, students, researchers, and hackers…

Agent trajectory walkthroughs of a fully autonomous hacking system | AI for Security, AIxCC

Defining good SLAs is a tough challenge, but it’s at the heart of any solid vulnerability management program. This article helps internal security teams set clear SLAs, define the right metrics, and adjust their ticketing system to build a successful vulnerability…

Abusing Windows file names that exceed 260 characters to bypass the EDR's sample collection tool by the pentester. Redteam trick

Software is being built faster than ever, and that makes it easier for security issues to slip through. That’s why catching flaws early in…