Groups of North Korean origin have long chosen the cryptocurrency sector as one of their targets, and until now, the main threat has come from the Lazarus

Explore OpenAPI security best practices. Learn the key methods and how they're implemented. See how liblab enhances SDK creation.

Following the adventure of manually discovering network-based vulnerabilities in the Linux kernel, I'm adding ksmbd-fuzzing functionality to the already extensive kernel-fuzzing tool that is Syzkaller.

In this blog post, I cover what we mean by secrets in application security, how to find secrets in your code, and how to prevent secrets from being leaked in your code.

Due to a recent Google change, MFA isn't truly MFA.

CVE-2023-38346 is a directory traversal vulnerability in Wind River's tarExtract function in VxWorks discovered by Pentagrid during a penetration test and source code review.

Dissecting DarkGate’s new key log encryption and tools to decrypt key log files

Welcome to How To Rotate, an open-source collection of API Key Rotation tutorials. Each tutorial provides step-by-step instructions on how to remediate a leaked API key security vulnerability by (1) Generating a new API key, (2) Replacing the compromised…

Our Research team discovered critical code vulnerabilities in Proton Mail, Skiff, and Tutanota. This post covers an XSS vulnerability in Tutanota Desktop and how it can be prevented.

Multiple memory corruption vulnerabilities were discovered in the LibHDF5 library including heap overflow, use-after-free and stack exhaustion.

Understand the assembly code generated for various Rust concepts like enums, match, self-passing, arrays, option, and smart pointers. Learn how the Rust language is translated to assembly and how the compiler optimizes the code. Also, discover the performance…

Finnish law enforcement authorities have announced the dismantling of PIILOPUOTI, a shady online marketplace that specialized in illegal drug trafficking

Group-IB analysts discovered and analyzed a cryptojacking campaign on a popular educational resource using Group-IB Managed XDR.

Visual studio code tunnel Introduction Since July 2023, Microsoft is offering the perfect reverse shell, embedded inside Visual Studio Code, a widely used …

Whoami?

I’ve recently been looking into iRacing, which is an online racing simulation video game.

Brief I may have achieved successful exploitation of a SharePoint target during Pwn2Own Vancouver 2023. While the live demonstration lasted only approximately 30 seconds, it is noteworthy that the process of discovering and crafting the exploit chain consumed…

CVE: CVE-2023-38831: A New WinRar Vulnerabilty A remote code execution when the user attempts to view a benign file within a ZIP archive. The issue occurs because a) ZIP archive may include a...