A free, read-only collector that turns an AWS account or Organization into a BloodHound OpenGraph dataset, drawing edges only where an offline IAM evaluation resolves to Allow.

Tata’s nexarc platform had a vulnerability where OTPs could be decrypted from API responses, making it easy to take over any account.

Text template files can contain C# or Visual Basic code that could be compiled and executed at build time. Threat actors can create or modify .tt files to execute code in the context of a trusted p…

Our investigation uncovers two sophisticated telecom surveillance campaigns and, for the first time, links real-world attack traffic to mobile operator signalling infrastructure. The findings expose how suspected commercial surveillance vendors (CSVs) exploit…

This research post describes the process of finding and exploiting a local privilege escalation in the Wibu-Systems CodeMeter application

Technical writeup for CVE-2026-8508 covering the social-login bypass path, affected models, proof, and full captive-portal emulation workflow.

A memory-corruption RCE in the Call of Duty 1 dedicated server, a binary that has been on the internet for two decades, found and weaponized in a single evening with an AI agent driving the disassembly.

A postmortem on my own EDR: no auth on self-destruct, permissive agent keys, forged automation results, LDAP injection, and 8 routes with no authorization check.

This post surveys everything Marshal.load calls on its own, on Ruby 4.0.6, and finds six kick-off gadgets, hash, eql?, <=>, to_str, to_s and respond_to?, that were never written for deserialisation and can't be hardened away like marshal_load.

Well, this sounds awkward.