Lite XL versions 2.1.8 and earlier contain vulnerabilities that allow arbitrary code execution and can lead to Remote Code Execution.

Intro Earlier this year, in January, Oracle Cloud's login service (login.us2.oraclecloud.com) was breached—this led to the compromise of 6M records and over 140k Oracle Cloud tenants. Analysis showed that the threat actor had exploited an older CVE (CVE-2021…

We discovered a remote code execution vulnerability in Microsoft's Update Health Tools (KB4023057) through an abandoned Azure Blob. Here’s how we found it, how it worked, and what it means for your Windows environment.

Summary Sliver is a powerful command and control (C2) framework designed to provide advanced capabilities for covertly managing and controlling remote systems.

1.0 The Silicon Root of Trust: Pre-Boot & Hardware Primitives


The security of the macOS platform on Apple Silicon is not defined by the kernel; it is defined by the physics of the die. Before the first instruction of kernelcache is fetched, a complex, cryptographic…

A new wave of the Shai-Hulud malware is compromising hundreds of npm packages and destroying user home directories. Get live updates and mitigation steps.

Similar to " Solving the CTF challenge - Network Forensics (packet and log analysis), USB Disk Forensics, Database Forensics, Stego " this c...

Abusing Write Path Traversal for Living Off the Land Remote Code Execution

More impressions:
/ wearetroopers
/ ernw_itsec
https://infosec.exchange/@WEareTROOPERS
https://infosec.exchange/@ERNW https://ernw.de

#TROOPERS #ITsecurity #ERNW

A data-driven reconstruction of the bulletproof hosting provider Media Land, using leaked internal records to analyze customer structure, address space alloc...

GeoServer is an open-source geospatial server used to publish and share spatial data and map services through standardized OGC interfaces. In affected versions, the WMS GetMap endpoint fails to disable external entity expansion when parsing SLD/XML documents.

Join our monthly cloud security CTF challenge, built by top Wiz researchers. Solve real-world scenarios and rise to the top of the leaderboard.

CAI using MCP, Model Context Protocol, to secure Sublight Shipping's autonomous robot fleet. Learn how CAI integrated seven data sources to uncover systemic vulnerabilities and secure a $50M contract renewal.

A complete journey from understanding Named Pipes to building an undetectable PrintSpoofer learning Windows internals, token impersonation, RPC, and evasion techniques along the way.

Tempesta FW 0.8 introduces a zero-copy per-CPU access logs streaming to a ClickHouse database. This article discusses how to analyse that data for L7 DDoS mitigation and bot management. Finally, we introduce our new open-source project, WebShield, which automatically…

Earlier this year, our CTI team set out to build something we'd been thinking about for a while: a phishing intelligence pipeline that could actually keep up with the threat. We combined feeds from hundreds of independent sources with our own real-time hunt…

“” is published by Grzegorz Wypych (h0rac) in ByteRay.

This morning, an advisory was released for Next.js about a vulnerability that leads to RCE in default configurations, with no prerequisites. The root cause of this issue lies in React Server Components, which Next.js utilizes. Over the last day, we have noticed…

CVE PoC Search from James Sawyer's JS Labs indexes GitHub proof-of-concept links for rapid vulnerability exploration.