Nearly half the credential-phishing Grizzly catches isn't on Google's blocklist yet. Here's exactly how we measure that.

SConnect (1M+ users), the extension and native host used to authenticate with 3SKey, SWIFT, eIDs and other hardware signing tokens, had a drive-by RCE: any site or iframe could silently download and run a DLL by exploiting an uninitialised-memory bypass in…

Adding security.txt to the web should be easy. The RFC is fairly simple, and there aren’t many ways to fail. Well, at least I thought that, until now. Let’s look at how a very small standard can fail in surprisingly creative ways.

How Reddit accidentally leaked its spamurai system.

Adding PQC to this product was like installing a vault door on a tent. The server could intercept your keys and an RCE let attackers run code on your desktop.

Penetration testing, cloud security, AI red-teaming, and LLM security — built by a Google Cloud security engineer.

In March 2025 we published an analysis of a remote code execution vulnerability in Open Build Service (OBS), tracked as CVE-2024-22033. A little over a year later we went back to the same attack surface and found a second, distinct flaw of the same family.…

How a WordPress libheif RCE uses returned pixels to bypass ASLR, trigger a heap overflow and execute commands on exact Ubuntu and Debian stacks.

Threat intelligence report: RedirectorsHub: SelectorsHub Forced-Tab Ad Network. Research by MalExt Sentry.