Today, Ivanti published an advisory.

“No way?” we hear you say. "Yes way!"

Today’s advisory outlines two vulnerabilities in Ivanti’s Sentry product, appealing directly to our inner desire for sophisticated server-side, pre-authenticated vulnerabilities.…

Three critical vulnerabilities in Jupyter Enterprise Gateway allow a notebook user to escalate privileges and fully compromise the underlying Kubernetes cluster.

wdavdaemon, the privileged Microsoft Defender daemon on macOS, restores quarantined files without revalidating the recorded path at restore time. Plant a file, let it be quarantined, then swap its parent directory for a symlink to a privileged location. The…

ASSIGNED (gabriel.petcu) in CA Program - CA Certificate Compliance. Last updated 2026-06-10.

Discover how fraudsters attack facial recognition with deepfakes and spoofing, and how liveness detection helps stop biometric attacks.

FedRAMP penetration testing guide for cloud service providers. Learn what 3PAO assessors expect, how to scope the test, and get ATO-ready in 48 hours.

Two security tools in one CLI. Audit your code, or attack it. Same binary, two tabs.

A pre-authentication XXE injection on ArubaOS 8.13.2.0 port 32000 enables OOB SSRF. Confirmed via wire-level pcap and the controller's own sshd logs. Submitted to HPE Bugcrowd — closed as theoretical despite four evidence items.

Map auth flows, scan domains A-F, analyse HAR files, and auto-populate your asset inventory. The AI-native security workspace built for serious security work.

What happens when you unleash an AI across all of Google's infrastructure? 1,500 APIs, 3,600 keys, and $500,000 in bounties later, here's what I found.

Anthropic shipped its first Mythos-class model with a 1M token context and an 80.3% SWE-Bench Pro score. What that unlocks, what it threatens, and how Cleo already runs on it.

We benchmarked Claude Fable 5 on 200 real-world coding tasks for the Agent Security League.

Detections for Claude Enterprise built on Compliance API content: a prefilter and LLM judge that catch prompt injection, jailbreaks and data exfiltration.

It is yet another day in this parallel universe of security, where the devices we bolt onto the edge of our networks to keep the bad people out are, with remarkable consistency, the exact thing that let the bad people in.

While we’ve seemingly had a breather…

DPAPI's CREDHIST file stores a chain of encrypted historical password material that is rarely targeted during offensive engagements. This post explores the structure of CREDHIST entries, how we extended DPAPISnoop to extract offline-crackable hashes, and…

Worried about supply chain attacks hitting your repos? Detect compromised credentials the moment anyone uses them. Free, forever.

A compatibility matrix tracking OAuth refresh-token support across 14 MCP clients. Covers status, root causes, SDK layers, and server-side workarounds.

Three posts? In three days? Are we insane?

We're home alone, there's no one to stop us, and we're up past bedtime. So, we need to talk about Splunk.

On June 10th, Splunk published this CVE-2026-20253 advisory:

It has everything that we love:

* No authentication

March 31, 2026, two malicious axios versions live for ~3 hours, a RAT on every machine that ran a fresh install. Then the turn — the signal that something wa...