Over the past X months, Eye Research has been actively disabling the vulnerable update mechanism used by the popular download client PopCorn Time. This involved executing code on systems running the vulnerable software. This is the story on how we got here…

Forever caught live malware on a customer's machine attempting a new kind of attack: a file planted in the Downloads folder that turns your own AI coding agent against you. Here's how it works on Codex and Claude Code, and why the vector stays open.

Sébastien Féry told RuntimeWire that FoxIO reported the flaw through the channel in Bun's security policy and "never heard back." Bun shipped HTTP/3 security fixes Thursday in a release that doesn't mention FoxIO or the report.

Banks including Morgan Stanley, Bank of America, JPMorgan, Wells Fargo and others are racing to contain agent risks.

Cyber attacks now hit hospitals, power grids, banks and government agencies, and the tools on both sides are changing fast. Here’s a quick look at three trends I’m watching. 1. AI is changing both offense and defenseSecurity teams use AI to find and patch…

Diving into EMFI characterization on the new STM32H5 MCU. Learn how to map, analyze faults, and compare custom injection coils.

Introducing pathrunner, a modular, cloud-native offensive security framework that automates the exploitation of AWS IAM privilege escalation paths.

CVE-2026-110355: Unauthenticated SSTI in Imperia CMS 11.5.4 and earlier enables remote code execution via SiteActive's TEMPLATE parameter when PHP is available.

Over the past X months, Eye Research has been actively disabling the vulnerable update mechanism used by the popular download client PopCorn Time. This involved executing code on systems running the vulnerable software. This is the story on how we got here…

Cloudflare's new post-quantum GeoKey Manager protects geographically fenced decryption keys from harvest now, decrypt later attacks. Learn how we redesigned our cryptography stack to support strict data sovereignty in a post-quantum world.

TCL 50C721 (RTD1319 / Mali-G31) root toolkit — autonomous CVE-2022-22706 exploit chain

According to CrowdStrike's report and other media coverage, hackers are using LLM-based penetration testing harnesses to hack web applications. In this article, I analyzed three open-source harnesses

Preface AWS announced the general availability of the AWS MCP Server on May 6, 2026. It is a managed remote Model Context Protocol (MCP) server.
An MCP server exposes certain tools/functions and lets your AI agent call them. It extends your AI agent’s capabilities.…

We tested Context Bombs against seven AI models, measuring how deceptive documents, false leads and recovery tasks change attacker time, cost and completed objectives.

The AI RCEssion is driven by tech debt, but that debt is not evenly distributed. As vulnerabilities rise its time for a return to the basics.

A victim asked for /account and got the attacker's marker back, on a backend socket the proxy believed was clean. Ten products reuse a connection where the previous request is not finished, and reuse is not the defect. Turning it off takes the crossings to…

How to intercept and edit HTTP/3 traffic. Learn what a proxy sees on QUIC streams, how QPACK hides headers, and how to edit and replay requests, tested in a real lab.

We solve the world’s toughest cyber challenges—creating breakthrough technology and embedding it into the systems that run everything.

A .po translation file is meant to be data. In Godot 4.1 and later, part of it is executed as code (the chain is present in the engine source from 4.1; I confirmed it at runtime on 4.7). A player...

A vulnerability in Telerik UI for ASP.NET AJAX led to an arbitrary file read via RadImageEditor's image cache. Leaking web.config turned it into RCE.