At 2:14 a.m., a production server hit 100% disk usage, yet du accounted for barely 40%. Nothing was missing, nothing was growing. 🔍

Hands-on notes from an authorized INE reconnaissance lab

In this article, I will walk you through a step-by-step penetration testing process, covering service reconnaissance, credential…

Hands-on notes from an authorized Information Gathering lab

Pada writeup kali ini saya akan membahas room CVEPHP2Shell di TryHackMe. Room ini membahas dua vulnerability kritis pada runtime PHP, yaitu…

Reverse vs Bind Shells

Hello.

Scenario

Task 1: Deploying the machine

How partial failures, misleading success responses, asynchronous processing, and distributed-system inconsistencies turn a green status…

PHP disclosed a second RCE path on October 23, two days after the emergency PHP2Shell fixes.

Dubai, UAE, 26th October 2026, CyberNewswire

eMudhra will leave the global SSL/TLS certificate market after eight intermediate CA private keys were found easily guessable, prompting browser distrust actions.

Every password reset flow makes the same implicit promise: the link in your inbox is the only way in, because the token inside it could not…

How to spot, confirm, and fix SSRF, SSTI, SSI, and XSLT injection.

Your online store may look completely normal while malicious code operates behind the scenes.

When security teams discuss web vulnerabilities, attention usually gravitates toward application-level flaws in third-party Composer…

I started building Master Nmap Recon with a simple idea: Cybersecurity tools become easier to understand when we break them down into…

A security scanner can tell you that something looks suspicious.

SQL injection UNION attack, determining the number of columns returned by the query

From a malicious Word document to a fully owned machine, using Sysmon logs, Timeline Explorer, Wireshark and Brim.