Paxton10 is an access control system widely deployed across commercial buildings in the UK and Europe. This post documents a chain of vulnerabilities that allows a network-adjacent, unauthenticated attacker to obtain operating system command execution on…

How we designed pwnproxy's event bus with bounded per-channel, per-subscriber queues, three QoS classes (CRITICAL with retries, IMPORTANT with coalescing, BEST_EFFORT with drops) and a producer that never blocks.

An attacker-controlled workspace/project folder, containing a .git/ directory, can escape the Cursor CLI's macOS sandbox and run code on your Mac with the logged-in user's full authority, no permission prompt, regardless of tool permission mode. The same…

Two unauthenticated requests: poison a Magento failure report, then drive the email template system into the DI compiler that includes it.

Every interception tool works by editing one Android config file. Flutter has never read that file. Here is how we find the function that actually decides, without a byte signature, and what happened when we ran it against every Flutter app on one phone.

In 2024 and 2025, we reassessed remote Spectre attacks on our Workers infrastructure. We share details about the new attack primitives like Spectre gadgets, remote timers, achieving co-location and how new defenses further harden Cloudflare Workers.

Reachability, status, TLS and latency for 7,097 public hosts, measured with one identified, rate-limited request and published with the method and the limits.

Because we can!

Two authorization bypasses in n8n’s AI agents let low-privileged users perform actions beyond those allowed by their role, including executing arbitrary nodes and exfiltrating credentials in cleartext. In some configurations, the same attack path can also…

Nicolas Krassas says his group killed its AI security startup idea and released OpenHunterAI, a source-available red-team engine for web, API and LLM apps.