Introduction

Fortinet recently patched a critical authentication bypass vulnerability that gives an attacker the ability to login as an administrator,

1Day vulnerability research by Hakai - Research Team



This post is about the journey to create a Proof-of-concept about CVE-2022-40684, this vulnerability has been assigned by Fortinet as an authentication bypass using an alternate path or channel vulnerability…

Analysis of Attack Cases: From Korean VPN Installations to MeshAgent Infections ASEC

ESET researchers reveal details about a prevalent cryptor that operates as a cryptor-as-a-service and is used by tens of malware families.

A new vulnerability could allow an attacker with root access to bypass SIP in macOS and perform arbitrary operations on a device.

RedTeam Pentesting discovered that the web interface of STARFACE as well as its REST API allows authentication using the SHA512 hash of the password instead of the cleartext password. While storing password hashes instead of cleartext passwords in an application’s…

In this article, you will find some features of C++17 that can also be helpful in the embedded world.

Eclypsium Research discovers that Gigabyte motherboards have an embedded backdoor in their firmware, which drops a Windows executable that can download and execute additional payloads insecurely. The backdoor affects gaming PCs and high-end computers.

NoirGate provides on-demand ephemeral anonymous shells secured by TOTP - GitHub - Shell-Company/Noirgate: NoirGate provides on-demand ephemeral anonymous shells secured by TOTP

Up until recently, we've enjoyed in-memory loading of Mach-O bundles courtesy of dyld and its NSCreateObjectFileImageFromMemory/NSLinkModule API methods. And while these methods still exist today, there is a key difference.. memory modules are now persisted…

We analyze Mirai variant IZ1H9, which targets IoT devices. Our overview includes campaigns observed, botnet configuration and vulnerabilities exploited.

ReversingLabs researchers say the ability to execute malicious Python byte code files poses yet another supply chain risk.

Privacy and surveillance are two sides of a coin, and the conditions that have blurred the boundaries between them have also paved the way for the thriving of

Given my interest in SCM and CI systems I was a little keen to see how this is done at Mozilla as part of their bug bounty program. Thanks to freddy I was granted Level 1 access to Mozilla’s SCM at hg.mozilla.org in late 2022. As Mozilla is a pretty transparent…