Discover how China-linked Red Menshen uses the stealthy, kernel-level BPFDoor backdoor to infiltrate global telecom networks and spy on users

DVRTC is a vulnerable VoIP and WebRTC lab for hands-on security training, with exercises covering SIP enumeration, RTP attacks, TURN abuse, and more.

Ласкаво просимо до нашого ІТ-блогу — незалежного кіберпростору для тих, хто хоче розуміти, як насправді працюють технології, сервери та безпека в сучасному

Lasso research reveals a 42% bypass rate in ServiceNow’s AprielGuard. Discover why standalone guardrails often fail in enterprise AI environments.

On March 27th, the telnyx popular PyPI library was compromised. new versions of telnyx were uploaded to PyPI, 4.87.1 and 4.87.2. Both contains malicous payload, this compromise is linked to TeamPCP

How the PhishU Framework simulates ClickFix with callback analytics, reporting, and campaign-specific training.

How the PhishU Framework simulates Microsoft Entra OAuth Consent Grant phishing with persistent token capture, live notifications and an interactive Token Explorer.

A high-level look at one-click transparent AiTM proxying, Google support, and Chrome heuristic evasion in the PhishU Framework.

PyPI package 'telnyx' versions 4.87.1 and 4.87.2 contain malware from threat actor TeamPCP. Malware runs on import, uses WAV steganography for payloads

Download redatcted_resume.pdf on LimeWire

Two medium-severity findings chained into full admin compromise on a SaaS pen test. Attack walkthrough, Docker PoC lab, and fixes.

6 specialized AI subagents for penetration testing. Plan engagements, analyze recon, research exploits, build detections, check STIGs, and write reports -- all through Claude Code.

We gave our AI agent admin access to production infrastructure. Then we tried to trick it into leaking everything. Here's what happened.

Sequels? Pain? We're obviously talking about Citrix NetScalers, yet again.

Welcome back to another watchTowr Labs blog post - pull up a chair, we always welcome new members to our group therapy sessions.

If you asked a C programmer what they most dislike…

How the PhishU Framework simulates Microsoft Entra device code phishing with silent token capture, live notifications, and Token Explorer follow-on actions.

Learn how attackers hide malware inside WAV audio files using steganography, based on the real-world TeamPCP supply chain campaign.

Today, we woke up with a nagging feeling: what if Citrix had, in fact, patched multiple Memory Overread vulnerabilities as part of CVE-2026-3055?

While we've been using our analysis from Part 1 (please read it first, as this post will be brief) to accurately…

AI middleware shouldn’t be a data drain. Cyera uncovers 3 critical LangChain vulnerabilities. See the research and learn how to patch your AI stack now.

Supply chain attacks cascade through ecosystems in ways traditional metrics hardly capture. GitGuardian evaluates the PCP Team incidents and finds damage spread to thousands of public targets.

Collaborative threat intelligence note-taking platform