Ontinue researchers uncover the Lunex malware platform, revealing a sophisticated attack chain, BYOVD techniques, and previously unreported capabilities.

Download the 2026 State of AI Security Report. Real-world telemetry from 1,200+ organizations reveals AI vulnerability, agent, and encryption gaps.

macOS creates a fully read/write CDC-ACM serial device node with no TCC gate. Chained with a HID keyboard interface on the same USB composite device, this exfiltrates SSH keys, cloud credentials, and secrets in 24 seconds through a channel that shows no consent…

A retrospective on CVE-2025-39964, an AF_ALG race condition I found in 2025 before Copy Fail drew attention to the same subsystem. I explain the out-of-bounds scatterlist access, the usercopy oracle, and the exploit that achieved root and a Docker container…

A fake WIRED interview routed through Calendly gave attackers access to Peter Reinhardt’s X account for a few minutes. I traced the campaign, filed abuse reports, and documented the offline status and provider receipts.

SAFA details the full exploitation of CVE-2025-13032, turning a double-fetch vulnerability in Avast's kernel driver into a local privilege escalation to SYSTEM on Windows 11.

How an LLM-guided fuzzing lead turned into a zero-click iMessage trigger that fires before you ever open the message. Apple shipped the fix as CVE-2026-86869 across iOS, iPadOS, and macOS 27. Enjoy my full voyage.

We scanned 7,040 directory-listed U.S. local-business websites for security headers. Half met none of seven criteria. Full report, data and code.

Default Helm security audit across 15 AI serving, vector database and MCP charts. Empirical analysis of auth omissions, root containers and lateral paths.

Technique performs Windows process code injection by leveraging a Windows named pipe, it does not use VirtualAllocEx and WriteProcessMemory

When a swarm of 700 OpenAI agents hacked Hugging Face in July, they left behind a public trail of evidence.