Hunt.io recovered a single operator's toolkit from an open directory: 14,530+ Dahua cameras compromised across Ukraine and Russia in 35 days. Inside the campaign

AI agents take orders from other AI agents. Mine won't. Try to break it.

Posted by Fit_Veterinarian4403 - 0 votes and 0 comments

Kimi Desktop's Windows group-chat updater downloads an executable and agent instructions from mutable locations without enforcing Moonshot's code signature.

Burp Suite is built for HTTP. When you're testing a thick client that speaks raw TCP, TLS, or a custom binary protocol, you need a different tool. Here's how to intercept non-HTTP thick client traffic with InterceptSuite.

What the Agent attempted with DNS in the Hugging Face–OpenAI Intrusion Incident of July 2026

This will be mostly rambling disguised as a technical walkthrough. I will touch on certain topics such as hardware roots of trust, signed image formats, Qualcomm boot stages, Android Verified Boot, UEFI, measured boot, and remote evidence (remote attestation).…

Abstract In this paper we’ll show that HTTP Header Injection is severely underestimated. Forget open redirects or Cross-Site Scripting and instead, embrace the catastrophic potential of the CRLF-Power

Disclosure: this research was conducted using an ANY.RUN account provided as part of a collaboration. All analysis and conclusions are my own.
TLDR Found an unreported Silver Fox campaign serving ValleyRAT to Indian taxpayers with a fake “GSTR-3B overdue”…

wasm2c sets a table's size from the element count the guest declared, then ignores whether the allocation succeeded. Make it fail and every table index becomes an absolute address on the host.

Federal indictment charges 17 members of Iran's Mabna Institute with stealing $3.4B in research from 322 universities in 22 countries.

After many years of complaining about how insecure SAML is, I decided to try to prove it by using Claude Code to hack every SAML implementation I could find.

A free, read-only collector that turns an AWS account or Organization into a BloodHound OpenGraph dataset, drawing edges only where an offline IAM evaluation resolves to Allow.