The Windows Security Center collects and presents information about the status of the antivirus control (Windows Defender or 3rd party). When a third-party antivirus is installed, Windows Defender …

The FortiPAM Chrome extension (1M+ users), used for Privileged Access Management, let any site set the browser's proxy for the session, open a new tab and stream screen recordings of it to an attacker's server. CVSS 9.1. CVE-2026-84388.

A measured investigation into MPEG-TS segments served under .woff2 URLs, cached at Cloudflare, and reproduced across two delivery paths.

Security research uncovers an integer underflow in Apple's mach_o Archive parser causing OOB reads, DoS, and information disclosure in tools

Bug bounty initiatives can be a useful tool for companies to source security research focused on their products and get ahead of attackers. From a security researcher’s perspective, it’s a great way to gain experience and contribute to the overall security…

An operator weaponized CVE-2026-15409 two days after disclosure, extracting LDAP credentials and running DCSync against Active Directory via SonicWall appliances.

A novel technique for writing ELF shared objects and achieving code execution in Python, Ruby, and Node.js using the sqlite_dbpage virtual table.

An untrusted repository opened in Claude Code can escape the macOS sandbox and run commands on your computer as your privileged user. You never get the permission prompt.

Learn how to hack APIs in 2026. This updated guide covers BOLA/IDOR, GraphQL flaws, OAuth misconfigurations, race conditions, and AI-backed API vulnerabilities.

A real Carnival booking confirmation passed SPF, DKIM and DMARC while one link served customers malware. The lapsed domain behind it, and what it delivered.

Networks ranked by how much they probe the internet relative to the address space they announce. Live from open honeypot telemetry.

A Zero Trust microsegmentation guide, with special consideration for agentic AI security & hybrid IT and OT security. Implement lateral movement prevention.

Paxton10 is an access control system widely deployed across commercial buildings in the UK and Europe. This post documents a chain of vulnerabilities that allows a network-adjacent, unauthenticated attacker to obtain operating system command execution on…

How we designed pwnproxy's event bus with bounded per-channel, per-subscriber queues, three QoS classes (CRITICAL with retries, IMPORTANT with coalescing, BEST_EFFORT with drops) and a producer that never blocks.

An attacker-controlled workspace/project folder, containing a .git/ directory, can escape the Cursor CLI's macOS sandbox and run code on your Mac with the logged-in user's full authority, no permission prompt, regardless of tool permission mode. The same…

Two unauthenticated requests: poison a Magento failure report, then drive the email template system into the DI compiler that includes it.

Every interception tool works by editing one Android config file. Flutter has never read that file. Here is how we find the function that actually decides, without a byte signature, and what happened when we ran it against every Flutter app on one phone.

In 2024 and 2025, we reassessed remote Spectre attacks on our Workers infrastructure. We share details about the new attack primitives like Spectre gadgets, remote timers, achieving co-location and how new defenses further harden Cloudflare Workers.