Why did people love Private Access Tokens but hate the Web Environment Integrity API? They're the same thing!

A use-after-free in Android’s Binder driver, recorded once and replayed at will. Part 1 of a series building a full kernel exploit chain with time travel debugging.

A formatter, minifier or deobfuscator can be made to turn one script into another. 186 techniques across 37+ JavaScript processors, from Chromium DevTools to WebCrack, plus a Tetris script that becomes Snake.

PhantomBuffer EDR evasion uses stealth injection via SendMessage with WM_SETTEXT to effective bypass EDR (Endpoint Detection and Response)

An open, ever-growing database of real-time data. Follow a feed, get told. Web, RSS, API, CLI and MCP.

CVE-2026-108097: how a Drupal Field UI callback led to file disclosure and RCE in a paired lab. The contributed-module writer remains unverified.

This article introduces Rank-One Model Editing (ROME) attacks, where a malicious Python module rewrites a model's weights in GPU memory to corrupt its answers, and explains why CPU-focused security tooling misses this class of attack. We then run a ROME attack…

An unauthenticated attacker can read the whole GLPI database via the planning endpoint (GLPI ≤ 11.0.8). Analysis, proof of concept and the 11.0.9 fix.

Can HTTP/3 really give you 100k requests per second for content discovery? We tested it in a fork of ffuf and are releasing h3fuzz, a web UI for fuzzing.

A network named IgnoreAllPreviousInstructions got an AI search summary to write a poem. A home PTR tells AI agents to attack whoever sent them.

FortiSIEM CVE-2026-106173: Horizon3 analyzes how an unauthenticated gRPC service enables path traversal, arbitrary file writes, and remote code execution.

TLDR AI made finding bugs cheap. It did nothing to make getting paid for them any easier. The same bug now gets found by ten different people inside a fortnight. One of them collects the money. The other nine collect a polite duplicate notice and a dent in…

Free hosted CertStream API. Stream new TLS certificates and domain names in real time over WebSocket. No API key or sign-up. Works with certstream clients.

OffiDocs runs 60 Chrome extensions with 2.3M installs across 4 publisher accounts, mostly everyday office tools. 37 of them hex-encode and exfiltrate every full URL you visit, with no explicit consent, under privacy policies that allow sharing with business…

A post attributed to watchTowr names two PHP RCE vulnerabilities, but their existence, affected versions and patch status could not be independently confirmed.

This research documents my development of payloads for the CVE-2026-46633. - CVE-2026-46633 writeup.md

IPinfo scans reveal that 85% of exposed French refrigeration controllers had known security flaws before the October 2026 cyberattack.

CVE-2026-109618 FAQ: affected PHP versions, fixes and more - updated as details emerge.

PHP is a popular general-purpose scripting language that powers everything from your blog to the most popular websites in the world.

Introduction

uCreater (the vendor's own name for the product is YingGai) is a commercial Android surveillance platform built around 群控 (“mass control”). Branded through packages in the com.ucreator.* namespace, it is not a single malware family but a productized…