My thoughts on WHOIS and RDAP protocols.

The EV charging industry has well-established security standards. OCPP provides clear guidelines for securing the communication channel between EV Chargers and the Charging Station Management System. While the industry has focused on securing the backend…

Tachyon reviews pull requests in full-codebase context, validates exploitability, and gives developers fix-ready security findings before code merges.

The FCC has proposed Know-Your-Customer rules that would require telecom companies to collect a name, physical address, and government ID for every cellphone customer.

Island researchers uncover 7,600+ malicious GitHub repos, over 800 posing as AI Skills and MCP servers, that trick AI agents into recommending malware.

CybelAngel analysts found a decade of confidential financial sector data exposed on a personal NAS device, a huge third-party risk.

TLDR WPForms Lite is a WordPress form plugin with 5 million plus active installations. Public advisory data identifies versions 1.10.0.1 through 1.10.0.4 as affected by CVE-2026-4986: the PayPal Commerce webhook processed incoming events without first verifying…

On Tuesday, July 14, Microsoft released the largest Patch Tuesday update in its history, fixing more than 600 vulnerabilities. A bug I reported to Microsoft on May 17 was patched as CVE-2026-50458 in this release, so I am publishing the writeup I wrote at…

We’re on a journey to advance and democratize artificial intelligence through open source and open science.

Researcher @sagitz_ disclosed a remote code execution vulnerability in GitHub, earning a $100,000 bounty—the largest payout in the platform's bug bounty program.

PE-OopsSec helps red teams, pentesters, and game developers give their payloads a final once‑over before putting them into the real world

Reproduce the wp2shell unauth WP RCE that combines REST batch-route confusion (CVE-2026-63030) and WP_Query SQL injection (CVE-2026-60137).