A growing list of named vulnerabilities, attack techniques and exploits.

Golang maps have some randomness in them. Why? To make developers not rely on the ordering and prevent hash collision DoS attacks. Read this article to learn more about the design and consequences of this.

Quacc++ combines grep.app's massive repo search with Semgrep's static analysis to automate vulnerability hunting across all public GitHub code. Built for security researchers.

Mindgard Research found persistent trust flaws in AI coding agents that can let changed project configs execute without re-approval.

Découvrez le contournement BitLocker et la réalité des downgrade attacks face à la vulnérabilité CVE-2025-48804.

Learn how AISLE discovered a command injection to root RCE vulnerability in FreeBSD.

Honey tokens are fake credentials that alert you of breaches when attackers use them.

This document describes the Dirty Frag vulnerability class, first discovered and reported by Hyunwoo Kim (@v4bel), which can obtain root privileges on.

Hyunwoo Kim has announced the Dirty Frag security flaw, a local-privilege-escalation (LPE) vuln [...]

ShinyHunters breached Canvas — the LMS used by 41% of North American universities. Harvard, Penn, Duke, K-12 schools. Private messages, grades, student records. May 12 ransom deadline. Full breakdown at Hitechies.

A case study of how Cilium secures its CI/CD pipeline end to end: SHA-pinned actions, two-phase checkouts for pull_request_target, Re...

Existing benchmarks for LLM-based vulnerability detection compress model performance into a single metric, which fails to reflect the distinct priorities of different stakeholders. For example, a...

#RemoteAccessTrojan

Using a self-orchestrating team of agents, with a dash of activation steering, to find vulnerabilities in everything from the Linux kernel to Docker and OpenSSL.

Discover the risks of memory poisoning in AI agents and learn effective defenses against this critical security threat in our detailed guide.

Wave chamber: built and producing pool-accepted shares. Single-photon successor: 65,000× faster again. SHA-256 is not broken; the substrate it assumed is.

TLDR The 90 day responsible disclosure window was built for a world where bug finders were rare and exploit development was slow. That world is gone. LLMs have compressed both timelines to near-zero. I have seen it first hand, and so has everyone else paying…