A URL validator does not validate a request. It validates one representation of a request at one moment. Thirteen language stacks, twelve bug families, and live product cases - changedetection.io reaching IMDS, GitLab discarding its own DNS pin, Mealie approving…

cipher security labs performs deep technical security research across real-world software, systems, and adversarial techniques.

A QR code built from markup instead of an image gives email filters nothing to scan. Here is how the technique works and what it took to ship it reliably.

Analysis of GAPIUpdate.dmg, its macOS execution chain, Odyssey Stealer C2 infrastructure, wallet replacement, and 27 related GitHub DMGs.

AI powered agentic attacks are scary, but agents are particularly “suggestible” allowing us to both detect and derail them

Coder's own delivery infrastructure was hijacked to serve credential-stealing modules from the real registry.coder.com. No CVE, no poisoned package, nothing for a scanner to match.

Microsoft tracked a million-message phishing campaign using invisible Unicode Tags to hide loan lures and bypass email filters.

Exploring digital survival engineering and protecting humanitarian infrastructure in conflict zones.

Six months ago, I installed OpenClaw, connected OpenRouter and assumed the agent was just expensive to run. Four days later, I found requests in Chinese that weren't mine. It cost me about $100 over a few days, but you can lose much more. Now I'm building…

TantoSec turned an unauthenticated AES-CBC padding oracle in Telerik UI for ASP.NET AJAX into remote code execution, chaining a decrypt-versus-parse oracle, a predictable HMAC key, and a type-name deserialisation gadget.

Pulling the firmware off the flash chip, decompressing the kernel, and finding an undocumented root login the owner cannot change.

As AI agents are deployed to automate more tasks, they become more capable. And as the famous quote goes: "With great power comes great responsibility." Assuming that humans in the loop can mitigate t...

Apply for the open Trust Me Im The System Arango Db Bugs Secure System Architecture position at Remedio. View complete job responsibilities, requirements, and submit your application online today.

A single exposed directory held the full toolkit behind a Redis cryptomining botnet. We parsed the operator's own campaign logs to confirm 3,562 compromised servers and map their tradecraft.

The first zero-click worm to spread through WeChat calls across iOS and Android.

The Windows Security Center collects and presents information about the status of the antivirus control (Windows Defender or 3rd party). When a third-party antivirus is installed, Windows Defender …

The FortiPAM Chrome extension (1M+ users), used for Privileged Access Management, let any site set the browser's proxy for the session, open a new tab and stream screen recordings of it to an attacker's server. CVSS 9.1. CVE-2026-84388.

A measured investigation into MPEG-TS segments served under .woff2 URLs, cached at Cloudflare, and reproduced across two delivery paths.