In my previous blog posts, Azure’s Weakest Link? and Azure’s Weakest Link - Full Cross-Tenant Compromise, I gave an overview of the severely insecure architecture behind API Connections in Azure, a part of Azure Logic Apps, and an instance of a full cross…

Nearly half the credential-phishing Grizzly catches isn't on Google's blocklist yet. Here's exactly how we measure that.

SConnect (1M+ users), the extension and native host used to authenticate with 3SKey, SWIFT, eIDs and other hardware signing tokens, had a drive-by RCE: any site or iframe could silently download and run a DLL by exploiting an uninitialised-memory bypass in…

Adding security.txt to the web should be easy. The RFC is fairly simple, and there aren’t many ways to fail. Well, at least I thought that, until now. Let’s look at how a very small standard can fail in surprisingly creative ways.

How Reddit accidentally leaked its spamurai system.

Adding PQC to this product was like installing a vault door on a tent. The server could intercept your keys and an RCE let attackers run code on your desktop.

Penetration testing, cloud security, AI red-teaming, and LLM security — built by a Google Cloud security engineer.

In March 2025 we published an analysis of a remote code execution vulnerability in Open Build Service (OBS), tracked as CVE-2024-22033. A little over a year later we went back to the same attack surface and found a second, distinct flaw of the same family.…

How a WordPress libheif RCE uses returned pixels to bypass ASLR, trigger a heap overflow and execute commands on exact Ubuntu and Debian stacks.

Threat intelligence report: RedirectorsHub: SelectorsHub Forced-Tab Ad Network. Research by MalExt Sentry.

A fast paced hacking roguelite built on real cybersecurity tradecraft. Recon targets, steal creds, move laterally, exfiltrate data, and ransom organizations to pay off your "Debts To Be Paid". Over 500 cards and items to discover. High risk, high reward.…

Welcome back to yet another episode of "security was taken seriously".

Being who we are (and constantly being exposed to what we see…), we recognize we have been doomed to eternal damnation as we keep on watching security best practices crumble behind “secure…

What the Rockstar Games security incidents teach defenders about phishing-resistant MFA, SaaS token risk, internal segmentation, and data exfiltration detection.

Learn crypto exchange security with Bitvulnex, Blaze’s open-source lab featuring 40 planted vulnerabilities, CTF mode, and local Docker installation.