Introduction: when the trust model can’t be trusted Secrets vaults are the backbone of digital infrastructure. They store the credentials, tokens, and certificates that govern access to systems, services, APIs, and data. They’re not just a part of the trust…

where my words occasionally escape /dev/null

A newly disclosed vulnerability in Python’s standard library, CVE-2024-12718, allows attackers to modify file metadata or file permissions outside the intended extraction directory. This issue affects systems running Python 3.12 and above when using tarfile.extract()…

Prompt injection pervades discussions about security for LLMs and AI agents. But there is little public information on how to write powerful, discreet, and reliable prompt injection exploits. In this post, we will design and implement a prompt injection exploit…

Curious to hear about our experience exploiting Retbleed (a security vulnerability affecting modern CPUs)? Then check out this post to see how we pushed the boundaries of Retbleed exploitation and understand more about the security implications of this exploit…

The Eye Security Research team has uncovered a new critical misconfiguration that exposed sensitive data at internal Microsoft applications.

Agent trajectory walkthroughs of a fully autonomous hacking system | AI for Security, AIxCC

Abusing Windows file names that exceed 260 characters to bypass the EDR's sample collection tool by the pentester. Redteam trick

Walk through our investigation workflow, cryptographic analysis, and end-to-end data-recovery strategy, proving that "encrypted" doesn't mean unrecoverable

Learn about CVE-2025-50154 and its risk of NTLM attacks and RCE even after Microsoft’s fix for CVE-2025-24054.

Hello world! long time no see. I was so busy, mainly with working on symbol.exchange (btw opened a new “Bug Driven Development” community) and started to try my way in academia.

Examining Critical Vulnerabilities in Xerox FreeFlow Core (CVE-2025-8355 and CVE-2025-8356)

IntroductionIn early June, I was reviewing a new Linux kernel feature when I learned about the MSG_OOB feature supported by stream-oriented UNIX domain socke...

It’s Friday, but we’re here today with unscheduled content - pushing our previously scheduled shenanigans to next week.

Fortinet is no stranger to the watchTowr Labs research team. Today we’re looking at CVE-2025-25256 - a pre-authentication command injection…

When Defenders Become the Attackers: The Elastic EDR 0-Day (RCE + DoS) Part 2: Click here for Elastic EDR 0-day Part II - Technical Evidence and the TriggerIntroductionSecurity software is supposed to defend. But what happens when the very tool trusted to…

Introduction

Affected Versions Vendor Response Linux kernel release the patch (https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=35f56c554eb1b56b77b3cf197a6b00922d49033d) Background The ipset subsystem in the Linux kernel is a framework used…

Update: Mauro Soria pointed out that this attack vector can be easily adapted for phishing scenarios:

Hardcoded credentials, pointless encryption, and generous APIs exposed details of every employee and made it possible to break into internal websites.

Click to read the article on phrack

Exploiting random number generators requires math, right? Thanks to C#’s Random, that is not necessarily the case! I ran into an HTTP 2.0 web service issuing password reset tokens from a custom encoding of (new Random()).Next(min, max) output. This led to…