Threat intelligence report: RoguePlanet - 2 million installs, one hijacked search bar. Research by MalExt Sentry.

Practical pentesting notes for vibe-coded apps, covering JWT flaws, exposed secrets, broken authorization, SSRF, and other boundary failures.

The Internet is almost anonymous and privacy-preserving by design. I mean, unless some administrator actively tries to track you, there is no built-in...

A technical analysis of a live Google Ads malvertising campaign abusing Claude AI, Base64-obfuscated shell commands and trusted domains to deliver the MacSync infostealer.

Summary A vulnerability in vBulletin has been identified, the vulnerability allows an unauthenticated user to cause the vBulletin to execute arbitrary code (PHP) on the remote server. Vendor Response The vendor has issued a fix available at: https://foru…

VE Commercial Vehicles’ My Eicher platform had a critical vulnerability that let you take over anyone’s account and gain control over their vehicle fleets.

Threat intelligence report: BrainDrain - SecondBrain's Prompt Optimizer Collects Your AI Chats. Research by MalExt Sentry.

Coding Pollard's 1974 Paper on Factoring Within P-1 Multiplicative Subgroups

The state of vibe-coded app security (549 repos) — first-party research from ogbuilds, based on 549 repos. secure·vibes heuristic rules engine (no AI pass) run over 549 public GitHub repos that describe themselves as AI- or vibe-coded. The original 107-repo…

A 20-year-old vulnerability gave us access to bare-metal servers - and a foothold in the no man’s land of data center infrastructure.

Even in modern web apps, IDOR bugs are treated as one-off findings. What if we designed patterns that made introducing IDOR impossible?

PoC for CVE-2024-1813: unauthenticated PHP object injection in Simple Job Board ≤ 2.11.0, chained to RCE via AIOSEO/Monolog.

Hunt.io and NetAskari trace a leaked Android RAT framework across 170 active servers, analyze the APK builder internals, and document a successor platform called Night Dragon targeting Chinese users.

A look at two undocumented, AI-built phishing kits that automate the full business email compromise chain: device code phishing, token theft, persistence, and AI-driven invoice fraud.

Anthropic researchers find weaknesses in cryptographic algorithms with Claude Mythos Preview

Hush Security raised a $30 million Series A from Akamai, Battery Ventures and YL Ventures to expand its runtime identity and access platform for AI agents.

Security experts

How we went hunting for attack chain primitives on Home Assistant and ended up with an interesting exploit by abusing FFmpeg input streams.

We’re on a journey to advance and democratize artificial intelligence through open source and open science.

Analyzing Eufy Security Ecosystem and reverse engineering of its doorbell component

A 16 actor map of a Chinese reward farming scene, built out from a single GitHub repo over a weekend. The operators know GitHub is dangerous and scrub their history religiously, but they defend the page and forget the graph: the scrub itself is a trace, and…