Static analysis on 12,750 n8n templates from n8n.io and GitHub. 716 expose pre-auth vulnerabilities. Six end-to-end demos: SSRF, SQL injection, RCE.

This research was recently presented at BSides Luxembourg 2026. This blogpost documents our findings presented during the talk. The BSides slides are posted here. Today, we’re also releasing the Docker-based playground utilized for the demos so anyone interested…

1/ We are sharing additional details regarding our investigation into unauthorized access to GitHub's internal repositories.

Yesterday we detected and contained a compromise of an employee device involving a poisoned VS Code extension. We removed the malicious…

Observed exploit path: unauthenticated wizard requests disclose admin, WLAN, and PPPoE credentials. Those leaked secrets then become a direct path to management-interface auth bypass.

Iran’s plan to “tax the internet” in the Strait of Hormuz highlights the regime’s push to profit from global data cables while restricting citizens online.

IBM X-Force Index 2026: supply chain attacks 4x in 5 years. 50% of global orgs had an AI-related security incident. North America most attacked for first time in 6 years. The common thread is preventable.

TLDR; Score severity by collision count. Researchers ship patches not just reports. Companies redesign for a world where the exploit lands before the patch. No magic. No vendor pitch. Just the playbook.
The last post went further than I expected. NYT’s Hard…

CVE-2026-45585 (CVSS 6.8): YellowKey bypasses BitLocker encryption via Windows Recovery Environment. No password cracking. No TPM exploit. Just a maintenance request the OS processed exactly as designed.

IBM X-Force Index 2026: supply chain attacks 4x in 5 years. 50% of global orgs had an AI-related security incident. North America most attacked for first time in 6 years. The common thread is preventable.

GitHub confirms ~3,800 internal repos breached via poisoned VS Code extension. TeamPCP (UNC6780) sells stolen source code for $50,000

Technical analysis of CVE-2026-40369, a 12-byte Windows kernel write reachable from browser sandboxes via NtQuerySystemInformation, leading to SYSTEM.

Unauthenticated ETHCheat requests return admin and WLAN secrets in the page markup on affected ZTE H298A and H108N router builds.

Angular. tj-actions. Cline. TanStack. The same class of attack has been quietly hijacking publish pipelines for two years. Here's what it is, how it works, and what you need to do today.

Three progressively compromised versions of a Microsoft-adjacent Python package deliver a full-featured infostealer that spreads through AWS and Kubernetes, exfiltrates every cloud credential it can find, and wipes disks on Israeli and Iranian systems

Upgrade your package manager before a supply chain attack makes that decision for you.

Inside SA-Core2026-004 On the 20th of May, the Drupal Security Team released SA-CORE-2026-004 (CVE-2026-9082), a Highly critical (20/25) SQL injection in Drupal core. The issue is reachable by fully anonymous users on any deployment that backs Drupal with…

Evidence-backed root-cause analysis of CVE-2021-35036, showing how low-privilege users could extract super-admin, TR-069, FTPS, and other credentials across Zyxel router, ONT, LTE, and 5G product lines.

By Faris | Cybersecurity Engineer & Threat Researcher | @farixzz | NullByte Collective

A four-byte type, an eight-byte stride, one root shell.

Hi! Last Thursday, as part of the Burp Extensibility Month on the PortSwigger Discord server, I gave a talk on […]