Deep dive analysis of the TETRA cyber incident which disrupted operations at Taiwan High Speed Rail (THSR) in April 2026.

Recent attempts to ban VPNs to stop users from evading age-verification laws are a growing threat to journalism

A polished security write-up about an OLX verification-code flaw that still leaked the correct code during lockout and led to account takeover.

DNS queries travel in plain text by default — even when your site uses HTTPS. Here's how DoH, DoT, DoQ and DoH3 work, how they compare in performance (real benchmarks from 3,000+ resolvers), and which one is right for your website.

After our last episode on Multi-SSO Cognito User Pools, we are back with another issue. This time, we are looking at one of those AWS components that is everywhere and rarely questioned deeply enough: the Elastic Load Balancer.

How we discovered an RCE in the AI Pentester Strix (sandbox) and how to find prompt injections with impact.

The Lithuanian Prosecutor General’s Office is investigating the theft of over 600,000 Center of Registers records via compromised institutional credentials.

Burp Suite AI Reporter generates vulnerability findings from HTTP pairs using Burp AI or Ollama/OpenAI. Export to Markdown in one click.

On 18 May 2026, Dutch investigators seized more than 800 servers and broke up a hosting operation that prosecutors say powered Russian cyberattacks across the EU. We had spent the previous year watching the same network from the other side. After the seizure…

An end-to-end Adversary-in-the-Middle attack against synced passkeys in the PhishU Framework. Capture the GPM PIN at sign-in, add an operator-owned passkey for persistence, then unlock the entire synced credential vault from the operator's own infrastructure.

Sixty-four years of credential security, and why the first hour of every incident is still the same question.

Three weeks of one Dutch ASN sending 3,861 hits at Anthropic-proxy paths. Port 11434 (Ollama) holding 50-80 distinct source IPs per week since March. A single 45-minute sweep from one IP that lists credential paths for Claude, Codex, Gemini, DeepSeek, DashScope…

<p>Turning a SELECT-only PostgreSQL SQL injection into remote command execution when the injected role is a PostgreSQL superuser.</p>

The April 2026 Kemper Corporation Salesforce data breach, orchestrated by ShinyHunters via social engineering, exposed 269,000 sensitive consumer records.

Urban VPN's Chrome extension accepted commands from any website via postMessage with no origin validation. Any page could disconnect your VPN, reroute your traffic, disable security features, and more - silently, with zero user interaction.

28/05/2026 Introduction A few years ago we looked at how Visual Studio Code extensions could be used for initial access in red team engagements; at the time, the results were...

Broken access control in GraphQL API allowing unauthorized access to orders and event data.

This is a quick post I wanted to write about a “hobby project” I spent a weekend on. It has little to do with real cryptography, and mostly doesn’t expose a particularly exciting …

15 kernel bugs, including 3 RCEs, 5 LPEs, and 1 bhyve escape.

Benchmarking LLMs on real-world CVE patching