A technical analysis of a live Google Ads malvertising campaign abusing Claude AI, Base64-obfuscated shell commands and trusted domains to deliver the MacSync infostealer.

Summary A vulnerability in vBulletin has been identified, the vulnerability allows an unauthenticated user to cause the vBulletin to execute arbitrary code (PHP) on the remote server. Vendor Response The vendor has issued a fix available at: https://foru…

VE Commercial Vehicles’ My Eicher platform had a critical vulnerability that let you take over anyone’s account and gain control over their vehicle fleets.

Threat intelligence report: BrainDrain - SecondBrain's Prompt Optimizer Collects Your AI Chats. Research by MalExt Sentry.

Coding Pollard's 1974 Paper on Factoring Within P-1 Multiplicative Subgroups

The state of vibe-coded app security (549 repos) — first-party research from ogbuilds, based on 549 repos. secure·vibes heuristic rules engine (no AI pass) run over 549 public GitHub repos that describe themselves as AI- or vibe-coded. The original 107-repo…

A 20-year-old vulnerability gave us access to bare-metal servers - and a foothold in the no man’s land of data center infrastructure.

Even in modern web apps, IDOR bugs are treated as one-off findings. What if we designed patterns that made introducing IDOR impossible?

PoC for CVE-2024-1813: unauthenticated PHP object injection in Simple Job Board ≤ 2.11.0, chained to RCE via AIOSEO/Monolog.

Hunt.io and NetAskari trace a leaked Android RAT framework across 170 active servers, analyze the APK builder internals, and document a successor platform called Night Dragon targeting Chinese users.

A look at two undocumented, AI-built phishing kits that automate the full business email compromise chain: device code phishing, token theft, persistence, and AI-driven invoice fraud.

Anthropic researchers find weaknesses in cryptographic algorithms with Claude Mythos Preview

Hush Security raised a $30 million Series A from Akamai, Battery Ventures and YL Ventures to expand its runtime identity and access platform for AI agents.

Security experts

How we went hunting for attack chain primitives on Home Assistant and ended up with an interesting exploit by abusing FFmpeg input streams.

We’re on a journey to advance and democratize artificial intelligence through open source and open science.

Analyzing Eufy Security Ecosystem and reverse engineering of its doorbell component

A 16 actor map of a Chinese reward farming scene, built out from a single GitHub repo over a weekend. The operators know GitHub is dangerous and scrub their history religiously, but they defend the page and forget the graph: the scrub itself is a trace, and…

Numbat is Perplexity’s open-source agent security suite for client endpoints. It detects, prevents, and investigates risky AI agent behavior on macOS, Linux, and Windows.

Ethiack research team discovered KindaRails2Shell (CVE-2026-66066): a critical RCE in Ruby on Rails via Active Storage. 500,000+ sites affected. Find out if you are and how to mitigate.

Twists Make Elliptic Curves Wildly Insecure. Here'a Cheatsheet Using Bitcoin's Familiar Secp