A detailed guide on how to exploit the Solmagorn machine on TryHackMe, covering the stages of initial access and privilege escalation.

Understanding CVE-2026–109618 and CVE-2026–109619, available security patches, and an open-source assessment tool developed by Grupo Oruss.

A short writeup of a bulk-harvestable metadata leak, how I found it, and what it says about the way we publish documents.

GoDaddy revoked 404,607 SSL/TLS certificates after finding certificate-policy errors, with affected sites including some Gibraltar government websites.

Wikidata, Overpass, RDAP, crt.sh…and the last one is the tool you probably haven’t tried yet

A duplicate decision may settle a reward. It does not settle whether a reported vulnerability has been fixed.

Your scanner may be working perfectly. Your security strategy may still be dangerously incomplete.

The Guardrails are real but they are protecting the wrong People

PHP2Shell is two critical flaws in PHP itself. CVE-2026–109618 and CVE-2026–109619 let an unauthenticated attacker reach remote code…

October 2026 has brought a dense series of cybersecurity disclosures, software vulnerabilities, data exposures and infrastructure incidents…

From suspicious emails and SIEM alerts to log correlation, account compromise, and incident response — a practical walkthrough of a…

Otomatisasi pengujian penetrasi keamanan siber tidak lagi terbatas pada pengeksekusian skrip statis yang kaku. Penetrasi keamanan modern…

In this room, I explored a Linux machine, found a few misconfigurations, and used them to gain access as a normal user before escalating to…

How shared sessions, authentication mechanisms, and weak tenant isolation can expose one customer’s environment to another.

JavaScript often contains a near-complete map of an application’s roles and routes. The bug appears when the backend mistakes a hidden…

A debugging file can turn a minified bundle back into readable source. In March 2026, one packaging mistake showed how much that can…

Modül II — Klasik Authentication

A practical, detailed method to turn a simple upload button into RCE, XSS, or full server compromise

In the previous article, we touched upon the basics of certificates, mTLS, x509 standard for certificates, along with public and private…

In October 2026, the cybersecurity and software engineering communities confronted a major structural threat: PHP2Shell. Comprising two…

Project: Shopping Portal Reference: PHPGurukul Vulnerability Name: PHP2Shell CVE IDs: CVE-2026–109618, CVE-2026–109619 Severity: Critical…