Island researchers uncover 7,600+ malicious GitHub repos, over 800 posing as AI Skills and MCP servers, that trick AI agents into recommending malware.

CybelAngel analysts found a decade of confidential financial sector data exposed on a personal NAS device, a huge third-party risk.

TLDR WPForms Lite is a WordPress form plugin with 5 million plus active installations. Public advisory data identifies versions 1.10.0.1 through 1.10.0.4 as affected by CVE-2026-4986: the PayPal Commerce webhook processed incoming events without first verifying…

On Tuesday, July 14, Microsoft released the largest Patch Tuesday update in its history, fixing more than 600 vulnerabilities. A bug I reported to Microsoft on May 17 was patched as CVE-2026-50458 in this release, so I am publishing the writeup I wrote at…

We’re on a journey to advance and democratize artificial intelligence through open source and open science.

Researcher @sagitz_ disclosed a remote code execution vulnerability in GitHub, earning a $100,000 bounty—the largest payout in the platform's bug bounty program.

PE-OopsSec helps red teams, pentesters, and game developers give their payloads a final once‑over before putting them into the real world

Reproduce the wp2shell unauth WP RCE that combines REST batch-route confusion (CVE-2026-63030) and WP_Query SQL injection (CVE-2026-60137).

AI pentesting agents are increasingly credible as offensive security systems, but current benchmarks still provide limited guidance on which will perform best in real-world targets. Existing...

It needs no password and breaks no MFA. How device code phishing hijacks Microsoft 365 with a single code, and the one Entra setting that blocks it.

An exposed open directory on a Hong Kong server revealed an autonomous AI agent running unattended, an unreported Go implant, and target-specific tooling used against Thailand's Ministry of Finance.

Untrusted content in a Claude Cowork session can escape the VM it's sandboxed in and read and write files anywhere on your Mac. The kernel bug that makes it possible isn't the interesting part. Four design decisions are, and they'd have stopped the next kernel…