Vulnerability intelligence that predicts avenues of attack with speed and accuracy.

A hidden .mcp.json file lets attackers achieve remote code execution in Claude Code via a malicious pull request — no user action required. See the PoC.

Decode and edit JWTs live, crack weak secrets, and forge tokens with alg:none, algorithm confusion, jwk/jku and kid injection. Free, and everything runs in your browser.

How a missing Firestore security rule on tl;dv exposed 181,874 meetings from 84,312 users across 35,003 domains, including live calls I could join uninvited, and how six months of disclosure got me nothing but seen receipts.

SCTPhantom is a Linux kernel use-after-free in SCTP's dynamic address reconfiguration code.

With access to Jira, Confluence, Microsoft 365, Google Workspace, Slack, and more, RovoBlast shows how a single link turns AI permissions into a low-friction path for data exposure.

The Connective signing extension, used by 8 of the 10 largest banks in Belgium and 60+ government agencies, let any website read your eID and Maestro cards, recover your eID PIN, and trigger a drive-by RCE. All the victim sees is a file download.

Introduction During recent threat hunting, I identified suspicious PowerShell content being served directly from an IP address and a domain: hxxp://203[.]188[.]171[.]166/hxxps://dorenzaa[.]com/ Bot…

Posted by Prize_Region5503 - 4 votes and 0 comments

Chrome is developing a default protection to block policy-installed extensions that hijack the New Tab page or search engine on consumer PCs.

AmberWolf Security Research Blog

Sending an RFC 9114-compliant trailer HEADERS frame to music.youtube.com causes Google's ESF (Edge Side Frontend) to hang for ~60 seconds before closing the connection with QUIC INTERNAL_ERROR (0x0001) — the RFC-defined signal for implementation errors. 100…

Drinor was awarded $150,000 for CVE-2026-20685 targeting Apple's Private Cloud Compute, the inference backbone of Apple Intelligence capabilities.

This work is my contribution to Sentry's AI Security research initiative, run through SARC, the Sentry Applied…

A Russian-speaking operator's open directory exposed the tools used to exploit and watch Ukrainian IP cameras, alongside attempts to breach government and military sites.

The file NTUSER.MAN is a Windows user-profile registry hive used with mandatory profiles. It contains pre-defined configuration settings that are loaded into the registry (HKEY_CURRENT_USER) when t…

I built a fake stack in user-mode memory and pivoted the kernel into it. SMAP should have thrown a #PF and blue-screened the box. Instead, I got SYSTEM. This is the three-experiment proof that Windows leaves its own guard down.

Posted by Idov31 - 1 vote and 0 comments

Imperva Red Team uncovered CVE-2026-17106, a container-to-host arbitrary file-write vulnerability in Docker’s docker cp command. Docker later confirmed that the same CVE also affected sbx cp when copying files out of Docker Sandboxes. A malicious container…

A lapsed DMARC reporting domain, re-registered for $10, collected aggregate reports for 86 domains across 20+ organizations. How it happened, and how to check yours.