ElectroNG is now free and open source! Today we are releasing both the desktop application and its core analysis engine under the Apache License 2.0, opening up years of Doyensec’s work on Electron application security to the community.

Walking through the Xen, Linux, and toolstack changes that let a paravirtualized guest own an IOMMU-backed PCI device—TPU and NVIDIA GPU alike.

Joining a multiplayer server is an ordinary player action. In Godot 4.0 and later, in games using the engine's standard spawning setup, a peer with authority over the relevant spawner — by default the...

The New Prompt Injection: Vulnerable Dependency Seeding

We achieved XSS through Cloudflare's /cdn-cgi/image/ endpoint by chaining an SVG sanitizer bypass with a Chromium Cache-Control trick that strips CSP. The same trick also works on Netlify and S3.

Author: Vlad Pasca   Executive Summary SEO poisoning campaign targets DeepSeek AI tool searchers through first-page malicious domains. Multi...

Discover the security findings from scanning 7.25 million public repositories on Gitee, which uncovered 26,400 verified-live credentials, cloud keys, and enterprise AI tokens.

CVE-2026-97631 (CVSS 4.0 9.5) hits EDK II's PXE driver through edk2-stable202608. No vendor firmware fix yet. Find which hosts are yours to fix in an hour.

DTLS is the engine's optional encryption layer for UDP multiplayer. In every version of Godot I inspected the source of — 3.2.2 and 4.7 through 4.7.2 — one unauthenticated datagram can overwrite...

Diving into the Steam platform for local and remote code execution vulnerabilities.

Egov.Integrations.MPass.Saml before 10.0.4 does not bind the signed XML reference to the trusted SAML response root. Upgrade to 10.0.4 or later.

During a penetration test, I exploited CVE-2025-30023 (insecure deserialization) chained with CVE-2025-30026 (authentication bypass) to get SYSTEM-level RCE on two Windows machines running Axis Camera Station on a factory. After that, I discovered CVE-2026…

This is what I built for Pwn2Own Berlin 2026 — a completely handmade, logic-only Microsoft Edge Full Chain, with no memory corruption, and no AI at all! 🔥

Previdian Research — 28 October 2026

On 28 October, Previdian observed successful remote code execution on four PHP/Apache honeypots configured to provide highly favourable conditions for exploitation. Apache launched an attacker-supplied shell command and…

Remedio disclosed a critical TeamViewer remote code execution vulnerability (CVE-2026-11585). Explore the exploit chain and affected versions

Summary In VNC the server announces the screen size and the viewer allocates a pixel buffer for it. TightVNC computes that buffer’s byte size in a 32-bit int. A server announcing 32768 x 32769 at 32bpp makes the size wrap from 4 GB to 128 KB, while the viewer…

Cursor, GitHub Copilot, Codex, VS Code and Claude Desktop each built a browser into their AI assistant, then enriched it beyond what a normal browser allows. Those enrichments broke the browser threat model, letting a web page or a local file reach the machine…

A real RCE vulnerability, left unpatched, does nothing inside a sandbox. See how deny-by-default WebAssembly components block every move a malicious zip makes.

Four false positives in four vulnerability classes had one root cause: the scanner accepted something it had caused as proof. A template matched a marker it had put in the request. An SSRF probe counted a callback our own client made. Here are the four, and…