October 2026 has brought a dense series of cybersecurity disclosures, software vulnerabilities, data exposures and infrastructure incidents…

From suspicious emails and SIEM alerts to log correlation, account compromise, and incident response — a practical walkthrough of a…

Otomatisasi pengujian penetrasi keamanan siber tidak lagi terbatas pada pengeksekusian skrip statis yang kaku. Penetrasi keamanan modern…

In this room, I explored a Linux machine, found a few misconfigurations, and used them to gain access as a normal user before escalating to…

How shared sessions, authentication mechanisms, and weak tenant isolation can expose one customer’s environment to another.

JavaScript often contains a near-complete map of an application’s roles and routes. The bug appears when the backend mistakes a hidden…

A debugging file can turn a minified bundle back into readable source. In March 2026, one packaging mistake showed how much that can…

Modül II — Klasik Authentication

A practical, detailed method to turn a simple upload button into RCE, XSS, or full server compromise

In the previous article, we touched upon the basics of certificates, mTLS, x509 standard for certificates, along with public and private…

In October 2026, the cybersecurity and software engineering communities confronted a major structural threat: PHP2Shell. Comprising two…

Project: Shopping Portal Reference: PHPGurukul Vulnerability Name: PHP2Shell CVE IDs: CVE-2026–109618, CVE-2026–109619 Severity: Critical…

Project: Online Food Ordering System Reference: SourceCodester Vulnerability Name: PHP2Shell CVE IDs: CVE-2026–109618, CVE-2026–109619…

Two critical vulnerabilities. Remote code execution. Millions of potentially exposed services. And a security lesson that goes far beyond…

Mobile digital forensics provides critical advantages in legal, corporate, and criminal investigations by unlocking, preserving, and…

Howdy fellers! During my recent bug hunting in VDP programs, I was analyzing a presentation platform and came across a vulnerability. At…

A single undocumented parameter turned every call to a video-conferencing platform’s API into an unauthenticated one.

It’s been quiet around here for a while. This is why: I spent the last month sharpening for the SecureWV 2026 CTF, “Directive Zero” — and…

A cross-account authorization flaw hidden inside a preference endpoint

A practical, step-by-step guide to turning “boring” endpoints into real valid bugs

Symantec researchers have captured the full playbook of an autonomous LLMjacking agent that hijacks exposed AI models to run its own attacks. Once connected, the agent can scan the internet, break…