Introduction

How I read the vulnerable PHP source, triggered the OOM condition by hand, found the one-line patch and learned why the runtime is the…

PHP released fixes for CVE-2026–109618 (memory corruption when PHP runs out of memory) and CVE-2026–109619 (use-after-free in request…

A beginner’s notes on how mobile apps are tested for security problems, and the tools testers use.

Room access: https://tryhackme.com/room/justlooking

When I started learning cybersecurity, I assumed that completing a beginner learning path would mean learning everything from scratch.

A detailed guide on how to exploit the Solmagorn machine on TryHackMe, covering the stages of initial access and privilege escalation.

Understanding CVE-2026–109618 and CVE-2026–109619, available security patches, and an open-source assessment tool developed by Grupo Oruss.

A short writeup of a bulk-harvestable metadata leak, how I found it, and what it says about the way we publish documents.

GoDaddy revoked 404,607 SSL/TLS certificates after finding certificate-policy errors, with affected sites including some Gibraltar government websites.

Wikidata, Overpass, RDAP, crt.sh…and the last one is the tool you probably haven’t tried yet

A duplicate decision may settle a reward. It does not settle whether a reported vulnerability has been fixed.

Your scanner may be working perfectly. Your security strategy may still be dangerously incomplete.

The Guardrails are real but they are protecting the wrong People

PHP2Shell is two critical flaws in PHP itself. CVE-2026–109618 and CVE-2026–109619 let an unauthenticated attacker reach remote code…

October 2026 has brought a dense series of cybersecurity disclosures, software vulnerabilities, data exposures and infrastructure incidents…

From suspicious emails and SIEM alerts to log correlation, account compromise, and incident response — a practical walkthrough of a…

Otomatisasi pengujian penetrasi keamanan siber tidak lagi terbatas pada pengeksekusian skrip statis yang kaku. Penetrasi keamanan modern…

In this room, I explored a Linux machine, found a few misconfigurations, and used them to gain access as a normal user before escalating to…

How shared sessions, authentication mechanisms, and weak tenant isolation can expose one customer’s environment to another.