In March 2025 we published an analysis of a remote code execution vulnerability in Open Build Service (OBS), tracked as CVE-2024-22033. A little over a year later we went back to the same attack surface and found a second, distinct flaw of the same family.…

How a WordPress libheif RCE uses returned pixels to bypass ASLR, trigger a heap overflow and execute commands on exact Ubuntu and Debian stacks.

Threat intelligence report: RedirectorsHub: SelectorsHub Forced-Tab Ad Network. Research by MalExt Sentry.

A fast paced hacking roguelite built on real cybersecurity tradecraft. Recon targets, steal creds, move laterally, exfiltrate data, and ransom organizations to pay off your "Debts To Be Paid". Over 500 cards and items to discover. High risk, high reward.…

Welcome back to yet another episode of "security was taken seriously".

Being who we are (and constantly being exposed to what we see…), we recognize we have been doomed to eternal damnation as we keep on watching security best practices crumble behind “secure…

What the Rockstar Games security incidents teach defenders about phishing-resistant MFA, SaaS token risk, internal segmentation, and data exfiltration detection.

Learn crypto exchange security with Bitvulnex, Blaze’s open-source lab featuring 40 planted vulnerabilities, CTF mode, and local Docker installation.

One encrypted web page makes GitHub Copilot CLI read local files and send them to an attacker in 28 seconds. GitHub won't call it a vulnerability.

One encrypted web page makes GitHub Copilot CLI read local files and send them to an attacker in 28 seconds. GitHub won't call it a vulnerability.

DiagNG, the open-source successor to QCSuper: a Linux GUI tool, now in beta, that produces 2G/3G/4G/5G PCAP captures from Qualcomm Snapdragon basebands.

See how Horizon3 reverse engineered CVE-2026-102489 in Zammad, reproduced the session leak, hijacked an admin session, and achieved remote code execution.

Samsung Galaxy S26 hacked three times. OpenAI Codex falls to a single bug. Oracle AI Database chained with 5 zero-days. Here is the full Day 1 breakdown. #Pwn2Own #ZeroDay #ZeroHack

To rebuild one submitted form, React scanned every field in the request once for each reference it contained. Nothing capped either number, so one 900 KB POST makes the server do 100 million checks and freeze.

A tool I built for driving an Android phone from a browser tab, with screen mirror, logcat, file browser, proxy, and Frida in the same window.

CVE-2026-47483 lets attackers crash NVIDIA DCGM Exporter via pprof. See what 2,000+ exposed GPU servers leaked and how to fix it.