This is the second year I have competed in JailCTF competition, first being in 2025. For this year specifically, I (competing as…

A few weeks back, I came across a post from a cybersecurity hiring manager that stopped me mid-scroll. It wasn’t about a shiny new…

The contemporary threat landscape is defined by a strategic shift: attackers are no longer content to slip past antivirus in user mode —…

Complete‍ 2026‍ Guide

Detecting and monitoring suspicious wireless activity across the ISM band with affordable hardware and open-source software.

The LYKNCTF was a whole whirlwind. Like any other CTFs, they too had many categories to choose from like Web, OSINT, Misc etc however I…

Solution:

Welcome back to another writeup! Today, we’re checking into The Byte Lotus Hotel for Day 2 of TryHackMe’s Hacker Holidays event.

Corporate systems designed to securely warehouse engineering blueprints and proprietary project documentation have morphed into a lucrative extortion vector for cybercriminals. Malicious actors ar…

GitHub and the Python Package Index (PyPI) have introduced strategic delays into dependency updates, discouraging developers from inadvertently deploying malicious packages upon initial release. D…

TL;DR A critical Gitea RCE flaw now has public details and a proof-of-concept exploit. Tracked as CVE-2026-60004, it scores a CVSS of 9.8. A user with repository write access can run shell command…

At a Glance Malware family Lampion, a Brazilian banking trojan from the ChePro lineage Threat actor No group named; operators tracked only as the Lampion crew Targets Portuguese speakers; 94.6% of…

At a glance Malware family msaRAT, a Rust remote access trojan Threat actor Chaos ransomware group (confirmed by Cisco Talos) Target or victims Windows hosts inside already-breached large organiza…

You have confirmed SQL injection against a Snowflake backend. The injected expression executes. The behavior is repeatable. The database is…

In this blog, I am going to share an account takeover vulnerability in a third-party provider widely used by many bug bounty programs.

How I Used XNLDorker to Discover Hidden Endpoints Across Multiple Search Engines

Part 4 of the Aii-Aii Hunter series: why “advise” vs “execute” is the whole point, and how the bridge actually works

OAuth Security Explained Without the Marketing OAuth 2.0 is often marketed as a “security protocol” that magically makes your application safe. In reality, OAuth is an authorization framework — …

A walkthrough of TryHackMe’s “Room 404” — Very Easy, 30 points, Web category — Day 2 of the Hacker Holidays event at the Byte Lotus Hotel.