Threat intelligence report: WhatsCluster: Analysis of a 50-Extension WhatsApp CRM Platform. Research by MalExt Sentry.

How much of an LLM system prompt actually leaks? A measured study of system prompt extraction (OWASP LLM07, System Prompt Leakage), tested against ground truth across four models. Real numbers, and one result that surprised me.

At WWDC 2025, Apple announced macOS 26 Tahoe. One of the new features in macOS Tahoe is a new disk image format: ASIF. Designed for use with virtual machines (its documentation lives under the Virtualization framework), ASIF takes a lot of inspiration from…

How competent are local AI models for cyber security bug hunting and research?

Eliminate the overhead and lack of idempotency of a full Windows system in automated testing. A practical guide to configuring WinPE and QEMU for lightning-fast boot, automating kernel debugging, and avoiding KDNET pitfalls.

Classic remote injection lands in SindriKit: shellcode in a handful of lines, full PE mapping in one chain call, and a cleaner syscall resolver pipeline.

Welcome back to another watchTowr Labs blog post.

This time, we're looking at Progress Kemp LoadMaster, a load balancer that sits at the edge of a lot of enterprise networks. Edge appliances have a habit of becoming the way in rather than the thing keeping…

A white-box audit of the end-to-end encrypted booking platform OpenReception found 16 vulnerabilities, four of them critical.

Signer.Digital's browser extension and its native helper turned a path-traversal bug into drive-by remote code execution on Windows. Any web page you visited could load an attacker DLL into a process on your machine, then escalate to administrator with a…

The world's largest health information platform ships with default admin credentials and never forces a password change. 90 days of responsible disclosure, no substantive response.

Well, well, well - once again, the cat has dragged us in and spat us out.

Today, we find ourselves questioning the reality we sit within. Must it be so predictable, and why us? “But watchTowr, what do you mean?”

Well, if you’re here, you likely fit into…

A free, open-source CLI and GitHub Action for dependency diffs, SBOMs, vulnerability and license audits, and explaining why packages are present in your builds.