A technical overview of how to load malicious code into .NET assemblies

Stay current: Get research alerts for newly disclosed vulnerabilities and exposures Smashing the ServiceNow Sandbox: Pre Authentication RCE This blog post is our second exploring pre-auth script execution security vulnerabilities in ServiceNow. If you haven't…

There is a lot of hype with LLMs and their capabilities. Models such as “Mythos” are praised like the modern era Gods. Developers fully rely on basic prompts for their work, quickly for…

How an Infostealer Infection Led to a Sophisticated ClickFix Campaign at Artlist How an Infostealer Infection Led to a Sophisticated ClickFix Campaign at Artlist A shared research investigation…

The same isolation flaw (the un-retrofitted read sibling) in 78 of 200+ multi-tenant AI and SaaS products. The pattern, the fixes that shipped, and how to check your own.

How I tricked Claude into leaking your deepest, darkest secrets

Escaping the ServiceNow sandbox to obtain RCE

Our ruleset for C/C++ vulnerability research has been upgraded for improved accuracy and performance, and published in the Semgrep register.

This was discoved with DeepZero
Tracked as CVE-2026-13585. ASUS has published a vendor advisory with countermeasures.
ASUS ships a kernel driver called bsitf.sys with their Business Manager and Software Manager. It creates a device at \\.\bsitf that requires…

Autonomous blackbox penetration testing by CyEyes.

RFC 8628's device authorization grant lets a TV or CLI

How the Escape DAST uncovered a missing default that lets any Immich user read locked-folder photos without the PIN.

Exploit development for a Windows AppResolver authorization issue fixed in July 2026, from a zero-capability AppContainer to an interactive SYSTEM shell.

Don't believe that this is real? OpenWRT pre-auth remote root exploit 0day (CVSS 9.6, CRITICAL). Submitted this morning to the project. Technical details with-held for future publication. I have so far ran against OpenWRT, Horde, Django, WordPress, Gitlab…

Check whether your WordPress site is affected by the pre-authentication RCE in WordPress Core. A free checker from Searchlight Cyber.

President Trump’s bold vision to secure and accelerate American artificial intelligence (AI) innovation is being actioned through the creation of “GOLD

A practical guide to source code analysis for pentesters. Learn SAST, manual review, tooling, and how to integrate code review into your pentest reports.

A technical teardown of a multi-stage .NET dropper chain that hides its loaders inside bitmap pixel channels, wraps an Eazfuscator crypter around an academic epidemiology simulator, and delivers AsyncRAT 0.5.8. Includes pixelchain, a keyless end-to-end chain…

How three small bugs in WordPress Core chain into CVE-2026-63030 (wp2shell), a pre-auth RCE reachable with a single anonymous POST to the REST API batch endpoint.