A real Carnival booking confirmation passed SPF, DKIM and DMARC while one link served customers malware. The lapsed domain behind it, and what it delivered.

Networks ranked by how much they probe the internet relative to the address space they announce. Live from open honeypot telemetry.

A Zero Trust microsegmentation guide, with special consideration for agentic AI security & hybrid IT and OT security. Implement lateral movement prevention.

Paxton10 is an access control system widely deployed across commercial buildings in the UK and Europe. This post documents a chain of vulnerabilities that allows a network-adjacent, unauthenticated attacker to obtain operating system command execution on…

How we designed pwnproxy's event bus with bounded per-channel, per-subscriber queues, three QoS classes (CRITICAL with retries, IMPORTANT with coalescing, BEST_EFFORT with drops) and a producer that never blocks.

An attacker-controlled workspace/project folder, containing a .git/ directory, can escape the Cursor CLI's macOS sandbox and run code on your Mac with the logged-in user's full authority, no permission prompt, regardless of tool permission mode. The same…

Two unauthenticated requests: poison a Magento failure report, then drive the email template system into the DI compiler that includes it.

Every interception tool works by editing one Android config file. Flutter has never read that file. Here is how we find the function that actually decides, without a byte signature, and what happened when we ran it against every Flutter app on one phone.

In 2024 and 2025, we reassessed remote Spectre attacks on our Workers infrastructure. We share details about the new attack primitives like Spectre gadgets, remote timers, achieving co-location and how new defenses further harden Cloudflare Workers.

Reachability, status, TLS and latency for 7,097 public hosts, measured with one identified, rate-limited request and published with the method and the limits.