This research post describes the process of finding and exploiting a local privilege escalation in the Wibu-Systems CodeMeter application

Technical writeup for CVE-2026-8508 covering the social-login bypass path, affected models, proof, and full captive-portal emulation workflow.

A memory-corruption RCE in the Call of Duty 1 dedicated server, a binary that has been on the internet for two decades, found and weaponized in a single evening with an AI agent driving the disassembly.

A postmortem on my own EDR: no auth on self-destruct, permissive agent keys, forged automation results, LDAP injection, and 8 routes with no authorization check.

This post surveys everything Marshal.load calls on its own, on Ruby 4.0.6, and finds six kick-off gadgets, hash, eql?, <=>, to_str, to_s and respond_to?, that were never written for deserialisation and can't be hardened away like marshal_load.

Well, this sounds awkward.

An exposed staging server reveals ownCloud pre-signed URL abuse against a Philippine nuclear agency and exploitation of a naval contractor's WordPress website.

How I chained three public V8 bugs against Google's v8CTF, escaped the V8 sandbox, printed a real flag, and still received no bounty.

The cybersecurity startup failed to gain enough commercial momentum to continue operating. Customers will have 60 days to migrate before the company's registry is switched off. 

Acronis Threat Research Unit (TRU) has identified an ongoing campaign delivering a previously undocumented custom backdoor against Afghan telecom providers and South Asian critical infrastructure organizations. The backdoor, tracked as PATCHCORD, is a compiled…