Security-first SSRF protection for Node.js outbound HTTP requests https://www.npmjs.com/package/nullspace
The Story of a Perfect Exploit Chain: Six Bugs That Looked Harmless Until They Became Pre-Auth RCE in a Security Appliance https://mehmetince.net/the-story-of-a-perfect-exploit-chain-six-bugs-that-looked-harmless-until-they-became-pre-auth-rce-in-a-security-appliance/
Mehmet Ince @mdisec - Vulnerability Researcher | Building security products | Security Advisor | Amateur Muay Thai fighter
The Story of a Perfect Exploit Chain: Six Bugs That Looked Harmless Until They Became Pre-Auth RCE in a Security Appliance - Mehmet…
It was May 2024, and our internal security team was evaluating the LogPoint SIEM/SOAR platform to replace our existing platform, potentially. As part of a habit I’ve built over the years —and honestly, part of our 3rd party due diligence— I gave myself 24…
MongoBleed: CVE-2025-14847 Memory Corruption in MongoDB. Your Database Talks Back https://phoenix.security/mongobleed-vulnerability-cve-2025-14847/
Phoenix Security
MongoBleed: CVE-2025-14847 Memory Corruption in MongoDB. Your Database Talks Back
MongoBleed vulnerability (CVE-2025-14847) leaks MongoDB heap memory without auth via zlib. See affected versions, exposure, and fixes.
Tailscale Security - A Threat-Based Hardening Guide for Growing Companies #TailscaleSecurity #ThreatModeling #NetworkHardening #AccessControl #ComplianceAudit https://www.adversis.io/blogs/tailscale-hardening-guide
www.adversis.io
Tailscale Security - A Hardening Guide for Growing Companies
A threat analysis and compliance mapping guide for Tailscale deployments. Check out tailsnitch to audit your setup
Reverse engineering my cloud-connected e-scooter and finding the master key to unlock all scooters https://blog.nns.ee/2026/01/06/aike-ble/
blog.nns.ee
Reverse engineering my cloud-connected e-scooter and finding the master key to unlock all scooters | nns.ee
Ethical Hacking and Cybersecurity Blog
Zen and the Art of Microcode Hacking https://bughunters.google.com/blog/zen-and-the-art-of-microcode-hacking
Google
Blog: Zen and the Art of Microcode Hacking
This blog post covers the full details of EntrySign, the AMD Zen microcode signature validation vulnerability recently discovered by the Google Security team.
Digital Forensics: Basic Linux Analysis After Data Exfiltration https://hackers-arise.com/digital-forensics-basic-linux-analysis-after-data-exfiltration/
Ni8mare - Unauthenticated Remote Code Execution in n8n (CVE-2026-21858) #Ni8mare #n8n #RCE #CVE202621858 #Vulnerability https://www.cyera.com/research/ni8mare-unauthenticated-remote-code-execution-in-n8n-cve-2026-21858
Cyera
Ni8mare - Unauthenticated Remote Code Execution in n8n (CVE-2026-21858)
Cyera Research Labs has discovered a "worst-case scenario" flaw in n8n, the industry-leading platform for AI and workflow automation. Dubbed "Ni8mare," this vulnerability (CVE-2026-21858) allows an unauthenticated remote attacker to gain full administrative…
CVE-2026-21876: Critical Multipart Charset Bypass Fixed in CRS 4.22.0 and 3.3.8 https://coreruleset.org/20260106/cve-2026-21876-critical-multipart-charset-bypass-fixed-in-crs-4.22.0-and-3.3.8/
CRS Project
CVE-2026-21876: Critical Multipart Charset Bypass Fixed in CRS 4.22.0 and 3.3.8
OWASP CRS addresses a critical charset validation bypass in rule 922110 affecting all supported versions. The vulnerability allowed UTF-7 and other charset-based attacks to evade detection through a chained rule processing flaw.
WhatsApp Signal Privacy Vulnerability: Silent Tracking Attack Exposed (2026) #WhatsAppSignal #PrivacyVulnerability #SilentTracking #MetadataLeak #DeviceProfiling https://baizaar.tools/whatsapp-signal-privacy-vulnerability-attack-2026/
BAIZAAR
WhatsApp Signal Privacy Vulnerability: Silent Tracking Attack Exposed (2026) - BAIZAAR
Critical WhatsApp Signal privacy vulnerability exposed. Attackers track activity via delivery receipts. Learn protection steps for this 2026 timing attack.
Do you remember "The Conscience of a Hacker"? It's been 40+ years now... we're definitely getting old (but luckily so!) :( https://phrack.org/issues/7/3
Phrack
Hacker's Manifesto
Click to read the article on phrack
Malware Analysis, Phishing, and Email Scams #TechSupportScam #BrowserDeception #FakeWindowsUpdate #SimulatedBSOD #PsychologicalTrap https://malwr-analysis.com/2026/01/09/fake-windows-update-and-bsod-alerts-used-in-a-tech-support-scam/
Malware Analysis, Phishing, and Email Scams
Fake Windows Update and BSOD Alerts Used in a Tech Support Scam
Overview While reviewing submissions received through the WordPress feedback form on my website, I came across a URL that initially appeared unremarkable. Such submissions are common and often cont…
[Research] LLVM based VMProtect Devirtualization: Part 1 (EN) #VMProtectDevirtualization #LLVMAnalysis #CodeObfuscation #DynamicTracing #SymbolicExecution https://hackyboiz.github.io/2025/09/11/banda/LLVM_based_VMP/en/
[Research] VMProtect Devirtualization: Part 2 (EN) #VMProtectDevirtualization #LLVMAnalysis #CodeObfuscation #DynamicTracing #SymbolicExecution https://hackyboiz.github.io/2025/12/11/banda/VMPpart2/en/
CVE-2025-6554: The (rabbit)
Hole #CVE20256554 #V8Exploit #TheHoleLeak #TDZBypass #TypeConfusion https://retr0.zip/blog/cve-2025-6554-the-rabbit-hole.html
Hole #CVE20256554 #V8Exploit #TheHoleLeak #TDZBypass #TypeConfusion https://retr0.zip/blog/cve-2025-6554-the-rabbit-hole.html
Gixy-Next: NGINX Configuration Security Scanner for Security Audits #NginxSecurity #ConfigScanner #VulnDetection #HardeningTool #GixyNext https://gixy.io/
Gixy-Next
Gixy-Next: NGINX Security Scanner & Configuration Hardening
Gixy-Next is an open source static analyzer for NGINX configurations. It detects security vulnerabilities, unsafe directives, compliance issues, and performance misconfigurations in nginx.conf before deployment.
WTF Are Abliterated Models? Uncensored LLMs Explained https://webdecoy.com/blog/wtf-are-abliterated-models-uncensored-llms-explained/
WebDecoy
WTF Are Abliterated Models? Uncensored LLMs Explained - WebDecoy
What abliterated means in AI models: how abliteration removes the refusal direction from LLMs, why it matters for security, and which models are abliterated.