Do you want to know what your phone is sending & receiving? Nowadays, that means you need to control who it trusts. In modern connections everything sent &...

Source-code analysis of the Corp MDM Android spyware campaign targeting logistics companies through fake Google Play pages, with SMS theft, call forwarding, persistence, C2, and detection details.

It’s been a month since I published the first part of this research, and interest from the Postgres community has been higher than I expected. Most vendors I contacted were shy to respond, so the Databricks team’s blog post Collaboration makes us all stronger…

A local lab, 34 recorded runs, and 6 stolen credential files. You tell an agent to check a library's docs; the website steals your session and executes commands before the model speaks.

Ubuntu Linux Use-After-Free Enables Host-Root Container Escape · Chinese UTA0565 Uses Chrome-Windows Zero-Days for CLEANGULP · Process Parameter Poisoning EDR Evasion Technique

Human approval is often treated as the last security boundary before an agent executes a consequential operation. That boundary is only meaningful if the operation presented for review is the...

Well, well, well, well, well, well, well, well, well, well, well, well, well, well, well. We're back. Sorry.

We've been watching the onslaught of vulnerabilities flood the internet. Every man, dog, and their grandmas (apparently?) are now using LLMs to find…

How hard is it to bypass EDR in the modern times with AI? As it turns out, not very hard.

Chaining an AtlasService binder command injection and an olc2 HAL binder method into uid 0 with all Linux capabilities from a plain installable app on OxygenOS 16.

External security researchers at Accomplish identified a vulnerability in Cloudflare Containers that could expose residual disk data from previous workloads. We explain how the issue worked, how we investigated it, and the steps we took to remediate it.

While testing deep links in Chrome for iOS, we noticed a small but important difference. Opening a third-party app through a custom URL scheme normally produced a confirmation prompt. Shortcuts were an exception. As they’re handled by a native Apple app,…

PHP's http:// stream wrapper sent Authorization, Cookie and Proxy-Authorization to any host a redirect pointed at, the bug curl fixed in 2018.

Ontinue researchers uncover the Lunex malware platform, revealing a sophisticated attack chain, BYOVD techniques, and previously unreported capabilities.

Download the 2026 State of AI Security Report. Real-world telemetry from 1,200+ organizations reveals AI vulnerability, agent, and encryption gaps.