News & Articles

A use-after-free vulnerability in the Linux kernel's Netfilter nf_tables subsystem allowed unprivileged users to achieve local privilege escalation and container escape through double-free exploitation in verdict expression handling.

A sophisticated multi-year supply chain attack embedded a backdoor in XZ Utils versions 5.6.0/5.6.1, intercepting SSH authentication to enable pre-auth remote code execution on countless Linux systems through malicious build-time modifications.

A type confusion vulnerability in V8's Maglev JIT compiler allowed attackers to achieve remote code execution through specially crafted JavaScript, exploiting incorrect type assumptions during optimization.

A type confusion vulnerability in Chrome's V8 JavaScript engine allowed remote attackers to escape the renderer sandbox through crafted HTML pages, affecting billions of users before patches rolled out in May 2024.

A use-after-free vulnerability in the Linux kernel's netfilter connection tracking subsystem enabled local privilege escalation to root on systems with vulnerable kernel versions through manipulation of network namespace operations.

A sophisticated multi-year supply chain attack embedded a backdoor in XZ Utils (liblzma) that targeted OpenSSH authentication, nearly compromising millions of Linux systems before accidental discovery in March 2024.

A seemingly harmless XML upload feature turned into a critical vulnerability chain when I discovered the application was running on AWS EC2 with overly permissive IAM roles.

A critical race condition in the two-factor authentication reset flow allowed me to take over any account by winning a 50ms race between state checks.

For malware analysts and threat hunters who want to learn YARA rule writing by creating a practical rule that detects Cobalt Strike beacon configuration blocks.

For incident responders who need to quickly analyze a memory dump with Volatility 3, this cheatsheet walks through the essential commands to identify malicious processes, network connections, and injected code.

A seemingly innocent merge utility in a corporate dashboard led me down a rabbit hole of JavaScript prototype chains, culminating in full account takeover of any user—including the CEO.

What started as a basic HTML-to-PDF feature in a SaaS application ended with me holding the keys to their entire AWS infrastructure, including production databases and S3 buckets containing 2M+ customer records.

For malware analysts and detection engineers who want to learn YARA fundamentals by creating a real-world rule to identify Emotet loader artifacts.

For incident responders and SOC analysts who need a quick-reference guide to extract critical artifacts from memory dumps using Volatility 3 in the first 30 minutes of analysis.

A previously unknown authentication bypass vulnerability in FortiGate edge appliances is being weaponized by multiple threat actors, with at least two ransomware operations now pivoting from initial access brokers to direct exploitation.

European lawmakers have passed sweeping amendments to the Network and Information Security Directive, dramatically compressing incident notification windows and extending coverage to organizations with as few as 10 employees.

Security researchers have demonstrated a technique that completely circumvents VPN encryption on most operating systems by manipulating DHCP option 121, potentially exposing years of supposedly protected traffic to network-level surveillance.

Security researchers have disclosed a severe vulnerability in a popular open-source container registry that allows attackers to inject malicious images without triggering integrity checks, potentially compromising thousands of CI/CD pipelines.

A new directive from CISA mandates that all federal civilian agencies must completely phase out basic authentication and legacy protocols by December 31st, 2026, marking the most aggressive identity security timeline yet imposed on government networks.

A sophisticated threat campaign is exploiting misconfigured machine learning inference endpoints to deploy cryptominers and steal training data, revealing a new attack surface as AI infrastructure becomes increasingly prevalent in enterprise environments.

Five active, well-funded bug bounty programs across major platforms including Shopify, GitLab, PayPal, Spotify, and Snapchat. Programs offer rewards ranging from hundreds to hundreds of thousands of dollars for valid vulnerability reports.