This will be a blog series where we’ll do a deep dive into the Mercusys MB115-4G router, which, as of today (02/17/2026), is the best-selling router on Amazon Spain. In this first post, we’ll cover the workflow from receiving the device to gaining a root…

An exposed open directory linked to The Gentlemen revealed EtherRAT, a Node.js backdoor that resolves rotating C2 domains through an Ethereum smart contract.

Download scientific diagram | Traditional networking versus SDN networking from publication: Energy-Aware Routing in Carrier-Grade Ethernet Using SDN Approach | Soft-Defined Networking (SDN) is a new approach that enables operators to easily manage all the…

Summary A use-after-free vulnerability in the Linux kernel bridge (net/bridge) Spanning Tree Protocol (STP) implementation. A bridge that is administratively down while kernel STP is enabled, together with a port driven into the LEARNING state, arms periodic…

Django's admin auto-linked URLField values without validating the scheme — a stored javascript: value rendered as a live link. Fixed in 6.0.8 and 5.2.17.

OpenAI restarted agent training two days after a model-caused Artifactory outage. The agents then rebuilt their deleted communication channel.

How Coinspect traced a wallet-drain investigation back to a twelve-year-old insecure randomness flaw, searched for exposed addresses at scale, and disclosed the findings...

Vulnerability intelligence that predicts avenues of attack with speed and accuracy.

A hidden .mcp.json file lets attackers achieve remote code execution in Claude Code via a malicious pull request — no user action required. See the PoC.

Decode and edit JWTs live, crack weak secrets, and forge tokens with alg:none, algorithm confusion, jwk/jku and kid injection. Free, and everything runs in your browser.

How a missing Firestore security rule on tl;dv exposed 181,874 meetings from 84,312 users across 35,003 domains, including live calls I could join uninvited, and how six months of disclosure got me nothing but seen receipts.

SCTPhantom is a Linux kernel use-after-free in SCTP's dynamic address reconfiguration code.

With access to Jira, Confluence, Microsoft 365, Google Workspace, Slack, and more, RovoBlast shows how a single link turns AI permissions into a low-friction path for data exposure.

The Connective signing extension, used by 8 of the 10 largest banks in Belgium and 60+ government agencies, let any website read your eID and Maestro cards, recover your eID PIN, and trigger a drive-by RCE. All the victim sees is a file download.

Introduction During recent threat hunting, I identified suspicious PowerShell content being served directly from an IP address and a domain: hxxp://203[.]188[.]171[.]166/hxxps://dorenzaa[.]com/ Bot…

Posted by Prize_Region5503 - 4 votes and 0 comments

Chrome is developing a default protection to block policy-installed extensions that hijack the New Tab page or search engine on consumer PCs.

AmberWolf Security Research Blog