A hands-on test of Homebrew 7.0.0's built-in vulnerability scanner and package sandboxing using a deliberately vulnerable tap, benchmarked against osv-scanner and Socket.
A Telegram Desktop XSS flaw in its HTML export escaping logic let attackers exfiltrate entire chat histories, showing why desktop webview apps still inherit browser-grade attack surfaces.
A technical walkthrough of the malicious Axios npm release shows exactly how a postinstall hook escalates from a dependency install into remote code execution inside CI pipelines, and which lockfile and install-script signals developers should audit first.
A hands-on audit guide covering how publicly reachable Vite dev servers leak .env secrets and cloud credentials through the /@fs file-read endpoint and the HMR WebSocket, along with the binding, firewall, and rotation fixes that close the exposure.
Anthropic's disclosure that attackers abused Claude to scan 1.8 million Android apps for embedded secrets shows how cheap LLM-assisted static analysis has become, and why React Native developers should scan their own APK, IPA, and JS bundle artifacts for hardcoded keys before shipping.
A hands-on audit of a WebAuthn passkey login flow showing why FIDO2 credentials still fall to real-time adversary-in-the-middle proxy phishing that steals session tokens, and which layered defenses — token binding, device-bound credentials, conditional access, and short session lifetimes…
A practical guide to GitLab CVE-2026-85706 covering patch priority, self-hosted triage steps, and indicator-of-compromise hunting for exposed installations.
A practical guide to validating your malware detection pipeline against AI-reconstructed fragments, with defensive tests, failure modes, and tuning strategies drawn from the latest Anthropic threat findings.
An analysis of the Conti ransomware playbook that shows how exposed RDP, privilege escalation, lateral movement, and domain-level encryption can be used to audit and harden a modern stack.
A practical guide to auditing Citrix NetScaler deployments for the authentication bypass vulnerability that CISA has warned is being actively exploited, including detection steps and configuration checks.
A step-by-step technical breakdown of how attackers use Microsoft Teams messages to deliver phishing links that leverage browser Blob URLs to render convincing fake login forms directly on the victim's device.
This post examines how the BlueMoon exploit kit allegedly chains Chrome and Windows zero-days to break out of the browser sandbox, highlighting the attack flow, impacted systems, and the defensive controls developers and security teams should prioritize.
An analysis of the ShieldCrash Windows Defender zero-day that bypasses Microsoft’s patch and can expose arbitrary file reads as SYSTEM on affected Windows systems.
Learn how attackers are abusing FortiGate firewalls as a foothold for custom Node.js malware and what logs and running processes security teams should inspect to spot the implant early.
Microsoft’s record 974-flaw Patch Tuesday turns into a triage challenge as defenders race to prioritize two exploited Windows zero-days alongside a massive wave of fixes.
This post examines how Kimsuky’s use of an OpenCode AI agent to mass-produce LNK phishing decoys exposes build-chain signals defenders can use to detect and disrupt the campaign.
An analysis of the N-able N-central zero-day CVE-2026-86218 showing why emergency patching is only the first step for managed service providers and enterprise defenders.
An analysis of CVE-2026-75754 in ASUS Control Center explaining how the flaw enables unauthenticated root access, what systems are affected, and how defenders should respond.
A look at how a Metabase zero-day in the ShipMonk/Trezor breach exposed 67,000 U.S.
Learn how to hunt PHP web shells in Magento and Adobe Commerce by checking suspicious files, reviewing logs for compromise indicators, and verifying that critical patches are actually applied.
Attackers reportedly used an unpatched TeamCity server to breach JetBrains Cadence and steal AWS credentials, underscoring how CI/CD infrastructure can become an initial access vector.
This post examines how attackers are chaining Claude, Qwen, and DeepSeek into agentic workflows for real-world cyberattacks and what defenders should watch for in multi-model abuse.
Google’s emergency Chrome fix for an actively exploited V8 zero-day highlights why teams running Chromium-based apps need to patch quickly, verify embedded browser versions, and tighten update workflows.
A practical security analysis of how AI agent memory stores can be poisoned with persistent prompt injection, and what developers can do to detect, contain, and prevent it.