At a glance Actor Lazarus Group, a North Korea-linked threat actor (Kaspersky, medium-to-high confidence) Activity Cyber espionage through spear phishing, watering-hole sites, and abuse of mandato…

TL;DR Oracle fixed a CVSS 10.0 E-Business Suite vulnerability, CVE-2026-101809, in its October 2026 Critical Patch Update. The flaw lets an unauthenticated attacker take over the Workflow product …

The open-source project cURL announced a significant restructuring of its triage workflow. Starting October 26, 2026, researchers must submit low and medium severity vulnerability reports directly…

Global advertising technology firms recently experienced intense anxiety following sudden updates to Apple’s WebKit browser engine. Now, Apple has broken its silence to explain the underlyin…

TL;DR The PHP team will ship a security release on October 21, 2026, at 14:00 UTC to fix two critical flaws rated CVSS v4.0 9.2. Leaks tie them to CVE-2026-109618 and CVE-2026-109619, described as…

Submission volume is still growing, but validity has recovered sharply. High-severity findings are increasing; repeat researchers are returning. The community is not simply producing more, but it is learning how to produce better.

The retrospective rule changes and mass spam closures did not just dismiss valid technical findings — they inflicted severe collateral…

A hands-on guide to historical scan analysis, domain relationships, URL discovery, and smarter OSINT workflows.

The thinking behind each find, not just the payloads.

Nineteen findings in a regulated health application. Eighteen were work. One made me walk around the block before writing it up.

AI can build a working web app surprisingly fast. The interesting part begins when you stop asking whether the code works and start asking…

I thought I understood how websites worked until I stopped looking at the page and started looking at the requests behind it.

A practical guide to understanding, testing, and fixing path traversal vulnerabilities

A finding-by-finding ledger for verifying evidence, fix scope, re-testing, and optional PR dispositions before Copilot security suggestions…

Can a single unpatched web page bring down a company’s customer trust overnight? In 2015, UK telecom provider TalkTalk found out the hard…

Investigating suspicious activity, unexpected external links, and hidden SEO spam in a WordPress website.

After testing security tools, I realized that a few small Python scripts could automate the repetitive work I kept doing by hand.

We have seen this movie before, and it never gets less uncomfortable.

Security remains one of the biggest challenges facing cryptocurrency exchanges. As trading platforms handle significant volumes of digital…

Most vulnerability programs are overwhelmed by findings and have little ability to prioritize beyond the CVSS score. In this post I…

And the report is 70% of the job.