We’re on a journey to advance and democratize artificial intelligence through open source and open science.

Researcher @sagitz_ disclosed a remote code execution vulnerability in GitHub, earning a $100,000 bounty—the largest payout in the platform's bug bounty program.

PE-OopsSec helps red teams, pentesters, and game developers give their payloads a final once‑over before putting them into the real world

Reproduce the wp2shell unauth WP RCE that combines REST batch-route confusion (CVE-2026-63030) and WP_Query SQL injection (CVE-2026-60137).

AI pentesting agents are increasingly credible as offensive security systems, but current benchmarks still provide limited guidance on which will perform best in real-world targets. Existing...

It needs no password and breaks no MFA. How device code phishing hijacks Microsoft 365 with a single code, and the one Entra setting that blocks it.

An exposed open directory on a Hong Kong server revealed an autonomous AI agent running unattended, an unreported Go implant, and target-specific tooling used against Thailand's Ministry of Finance.

See how XBOW autonomously uncovered three critical Microsoft RCEs by tracing ordinary image-processing and file-upload paths to proven code execution.

Untrusted content in a Claude Cowork session can escape the VM it's sandboxed in and read and write files anywhere on your Mac. The kernel bug that makes it possible isn't the interesting part. Four design decisions are, and they'd have stopped the next kernel…

Hear your own voice cloned in real time and understand why your team is vulnerable to vishing.

Get the latest updates concerning DEF CON and the next DEF CON Conference!

If you run Falco, an EDR, or a generic host agent on a validator and a network-DoS attack against the node went undetected, this explains why. A technique-by-technique analysis of five reproduced P2P-infrastructure attacks against the syscall detection surface.…

Threat intelligence report: RoguePlanet - 2 million installs, one hijacked search bar. Research by MalExt Sentry.

Practical pentesting notes for vibe-coded apps, covering JWT flaws, exposed secrets, broken authorization, SSRF, and other boundary failures.

The Internet is almost anonymous and privacy-preserving by design. I mean, unless some administrator actively tries to track you, there is no built-in...

A technical analysis of a live Google Ads malvertising campaign abusing Claude AI, Base64-obfuscated shell commands and trusted domains to deliver the MacSync infostealer.

Summary A vulnerability in vBulletin has been identified, the vulnerability allows an unauthenticated user to cause the vBulletin to execute arbitrary code (PHP) on the remote server. Vendor Response The vendor has issued a fix available at: https://foru…

VE Commercial Vehicles’ My Eicher platform had a critical vulnerability that let you take over anyone’s account and gain control over their vehicle fleets.

Threat intelligence report: BrainDrain - SecondBrain's Prompt Optimizer Collects Your AI Chats. Research by MalExt Sentry.

Coding Pollard's 1974 Paper on Factoring Within P-1 Multiplicative Subgroups