When a critical Linux kernel privilege escalation was publicly disclosed, Cloudflare's security and engineering teams detected, investigated, and mitigated the threat across our global fleet, confirming zero customer impact and no malicious exploitation.

Can AI actually hack? 2,639 real challenge attempts, 10 models, 5 categories

LucidBit Labs research shows how Samsung's FIVE integrity subsystem exposed an app-reachable kernel use-after-free with multiple exploit-relevant primitives.

A leaked dataset from 4vps[.]su shows a hosting environment where proxy networks, criminal infrastructure, and targeted attack activity coexist without requi...

Campus Recruiting vulnerability exposed student information, and Audit Tracking Management System vulnerability exposed confidential internal audit data.

In my last post, I argued that the Axios compromise was catchable because the malicious versions had no provenance — they were pushed by hand with a stolen t...

Discover how we hatch ventures with founders and apply.

Discover how antivirus works and how to setup a lab for (Windows Defender) antivirus bypass. Basic code is provided to start experimenting !

Stay current: Get research alerts for newly disclosed vulnerabilities and exposures WiseTech Global develops CargoWise, one of the most widely deployed logistics software platforms in the world. It is used by freight forwarders, customs brokers, warehousing…

CVE-2025-52465 write-up covering GeoServer's Master Password Dump flaw, arbitrary file creation, affected versions, and practical impact.

The explosive popularity of OpenClaw in early 2026 transformed AI from a system that answers questions into an agent that executes operations on your behalf. "Skills" are the primary mechanism through which Agents acquire these capabilities, making them the…

Kickbacks.ai security review and reverse engineering. This VS Code extension patches files, runs unsigned updates, and acts as adware. What businesses should know.

New DoS attack: 37/41 HTTP frameworks vulnerable by default. 64 connections at 1 byte/s exhausts PHP/Laravel in <2 min. Full PoC + paper + Docker testbed included.

How Reddit accidentally leaked its spamurai system.

Threat intelligence report: WhatsCluster: Analysis of a 50-Extension WhatsApp CRM Platform. Research by MalExt Sentry.

How much of an LLM system prompt actually leaks? A measured study of system prompt extraction (OWASP LLM07, System Prompt Leakage), tested against ground truth across four models. Real numbers, and one result that surprised me.

At WWDC 2025, Apple announced macOS 26 Tahoe. One of the new features in macOS Tahoe is a new disk image format: ASIF. Designed for use with virtual machines (its documentation lives under the Virtualization framework), ASIF takes a lot of inspiration from…

How competent are local AI models for cyber security bug hunting and research?

Eliminate the overhead and lack of idempotency of a full Windows system in automated testing. A practical guide to configuring WinPE and QEMU for lightning-fast boot, automating kernel debugging, and avoiding KDNET pitfalls.

Classic remote injection lands in SindriKit: shellcode in a handful of lines, full PE mapping in one chain call, and a cleaner syscall resolver pipeline.

Welcome back to another watchTowr Labs blog post.

This time, we're looking at Progress Kemp LoadMaster, a load balancer that sits at the edge of a lot of enterprise networks. Edge appliances have a habit of becoming the way in rather than the thing keeping…