Stay current: Get research alerts for newly disclosed vulnerabilities and exposures If you're running WordPress and want to check if your instance is vulnerable, you can use our tool we've hosted here: https://wp2shell.com/. We held off on publishing this…

Two components can each pass every scan and still combine into a vulnerability that lives in the seam between them.

ipapi.is offers precise IP data via a user-friendly API, encompassing geolocation, ASN data, hosting detection, VPN detection, and proxy detection.

SindriKit 1.5.0 introduces structural and instruction-level polymorphism via the SND_MORPH engine to eradicate static signatures on every build.

Evaluations and research on security, software, and AI by Vikrant Singh Chauhan.

Exploit development for the Windows WalletService vulnerability, from caller-controlled known-folder resolution to a persisted ESE callback and an interactive SYSTEM shell.

My thoughts on WHOIS and RDAP protocols.

The EV charging industry has well-established security standards. OCPP provides clear guidelines for securing the communication channel between EV Chargers and the Charging Station Management System. While the industry has focused on securing the backend…

Tachyon reviews pull requests in full-codebase context, validates exploitability, and gives developers fix-ready security findings before code merges.

The FCC has proposed Know-Your-Customer rules that would require telecom companies to collect a name, physical address, and government ID for every cellphone customer.

Island researchers uncover 7,600+ malicious GitHub repos, over 800 posing as AI Skills and MCP servers, that trick AI agents into recommending malware.

CybelAngel analysts found a decade of confidential financial sector data exposed on a personal NAS device, a huge third-party risk.

TLDR WPForms Lite is a WordPress form plugin with 5 million plus active installations. Public advisory data identifies versions 1.10.0.1 through 1.10.0.4 as affected by CVE-2026-4986: the PayPal Commerce webhook processed incoming events without first verifying…

On Tuesday, July 14, Microsoft released the largest Patch Tuesday update in its history, fixing more than 600 vulnerabilities. A bug I reported to Microsoft on May 17 was patched as CVE-2026-50458 in this release, so I am publishing the writeup I wrote at…

We’re on a journey to advance and democratize artificial intelligence through open source and open science.

Researcher @sagitz_ disclosed a remote code execution vulnerability in GitHub, earning a $100,000 bounty—the largest payout in the platform's bug bounty program.