# ⚡ The Hunter Archive — Security Research Binder > Exported on 10/29/2026 · Developed by JOJIN JOHN --- ## [My eJPTv2 Journey — 82%](https://infosecwriteups.com/my-ejptv2-journey-82-a135093b247d?source=rss----7b722bfd1b8d---4) - **Source:** infosecwriteups.com · **Author:** Aruvasaga chithan A - **Date:** 2026-07-27T09:39:44.000Z - **Tags:** #ethical-hacking #pentesting #ejpt --- ## [Unauthenticated Disclosure of A/B Test Data in Convert Pro — How Two Forgotten AJAX Endpoints…](https://infosecwriteups.com/unauthenticated-disclosure-of-a-b-test-data-in-convert-pro-how-two-forgotten-ajax-endpoints-dbefc9c3e440?source=rss----7b722bfd1b8d---4) - **Source:** infosecwriteups.com · **Author:** Shikhali Jamalzade - **Date:** 2026-07-27T09:38:59.000Z - **Tags:** #cybersecurity #technology #bug-bounty-writeup #wordpress #bug-bounty --- ## [One Header Away from 10+ GB of Customer Documents (PII) — $6K Bounty](https://infosecwriteups.com/one-header-away-from-10-gb-of-customer-documents-pii-6k-bounty-0c0ac8c335f2?source=rss----7b722bfd1b8d---4) - **Source:** infosecwriteups.com · **Author:** Alvin Ferdiansyah - **Date:** 2026-07-27T09:38:35.000Z - **Tags:** #bug-bounty-writeup #bucketlist #bug-bounty #bug-bounty-tips #authentication --- ## [How I Found a Bug Worth $3,500 — In a Feature Nobody Was Watching.](https://infosecwriteups.com/how-i-found-a-bug-worth-3-500-in-a-feature-nobody-was-watching-6773df9fce72?source=rss----7b722bfd1b8d---4) - **Source:** infosecwriteups.com · **Author:** Vishw Bhatt - **Date:** 2026-07-27T09:37:44.000Z - **Tags:** #admin-panel #file-upload #bug-bounty --- ## [Unprotected admin functionality with unpredictable URL — PortSwigger Access Control Lab 2](https://infosecwriteups.com/unprotected-admin-functionality-with-unpredictable-url-portswigger-access-control-lab-2-63dd82874875?source=rss----7b722bfd1b8d---4) - **Source:** infosecwriteups.com · **Author:** Zeyad Naguib - **Date:** 2026-07-27T09:36:25.000Z - **Tags:** #access-control #authentication #broken-access-control #role-based-access-control #authorization --- ## [LetsDefend: SOC169 — Possible IDOR Attack Detected (Walkthrough)](https://infosecwriteups.com/soc169-possible-idor-attack-detected-walkthrough-letsdefend-19c048fea9b1?source=rss----7b722bfd1b8d---4) - **Source:** infosecwriteups.com · **Author:** Prince Lassey - **Date:** 2026-07-27T09:36:11.000Z - **Tags:** #lets-defend #walkthrough #soc-analyst #idor #ctf-writeup --- ## [LetsDefend Challenge: Memory Analysis (Walkthrough)](https://infosecwriteups.com/letsdefend-challenge-memory-analysis-walkthrough-24b15eee4deb?source=rss----7b722bfd1b8d---4) - **Source:** infosecwriteups.com · **Author:** Prince Lassey - **Date:** 2026-07-27T09:36:05.000Z - **Tags:** #incident-response #memory-analysis #soc #cybersecurity #letsdefend-challenge --- ## [VulnNet: Roasted Tryhackme ctf walkthrough](https://infosecwriteups.com/vulnnet-roasted-tryhackme-ctf-walkthrough-0f30563c58f7?source=rss----7b722bfd1b8d---4) - **Source:** infosecwriteups.com · **Author:** Aniket Nayak - **Date:** 2026-07-27T09:31:45.000Z - **Tags:** #vulnnet-roasted #infosec #ctf #tryhackme #tryhackme-walkthrough --- ## [Pickle Rick Tryhackme CTF](https://infosecwriteups.com/pickle-rick-tryhackme-ctf-a10360eba93f?source=rss----7b722bfd1b8d---4) - **Source:** infosecwriteups.com · **Author:** Aniket Nayak - **Date:** 2026-07-27T09:31:38.000Z - **Tags:** #tryhackme #ctf #tryhackme-walkthrough #pickle-rick #ctf-writeup --- ## [Tryhackme New Room — FLIP](https://infosecwriteups.com/tryhackme-new-room-flip-2e2894c52148?source=rss----7b722bfd1b8d---4) - **Source:** infosecwriteups.com · **Author:** Sahil Malvi - **Date:** 2026-07-27T09:30:14.000Z - **Tags:** #crypto #tryhackme #flip #aes-cbc #cybersecurity --- ## [How a Hidden GraphQL Endpoint Led Me to a Critical SQL Injection Worth €2,500](https://medium.com/@0x0sadat/how-a-hidden-graphql-endpoint-led-me-to-a-critical-sql-injection-worth-2-500-a2e39521944b?source=rss------bug_bounty-5) - **Source:** medium.com/tag/bug-bounty · **Author:** 0xSADAT - **Date:** 2026-07-27T14:58:18.000Z - **Summary:** A simple directory fuzzing session uncovered a hidden GraphQL endpoint. A harmless-looking search bar eventually turned into a confirmed… Continue reading on Medium » - **Tags:** #bug-bounty-writeup #infosec #bug-bounty #info-sec-writeups #cybersecurity --- ## [Python Web Penetration Testing — Day 6: Detecting and Exploiting SQL Injection Vulnerabilities](https://osintteam.blog/python-web-penetration-testing-day-6-detecting-and-exploiting-sql-injection-vulnerabilities-490bf8527686?source=rss------bug_bounty-5) - **Source:** medium.com/tag/bug-bounty · **Author:** Aman Sharma - **Date:** 2026-07-27T13:14:49.000Z - **Summary:** I spent weeks ignoring SQL injection Continue reading on OSINT Team » - **Tags:** #bug-bounty #technology #programming #penetration-testing #cybersecurity --- ## [Subdomain Enumeration Mastery : Subdomain Enumeration Like Pro](https://medium.com/@nitishmukhiya/subdomain-enumeration-mastery-subdomain-enumeration-like-pro-5ab2c934c880?source=rss------bug_bounty-5) - **Source:** medium.com/tag/bug-bounty · **Author:** Nitish Mukhiya - **Date:** 2026-07-27T13:11:52.000Z - **Summary:** A practical, step-by-step methodology for bug bounty hunters and security researchers Continue reading on Medium » - **Tags:** #subdomains-enumeration #bug-bounty #web-hacking #subdomain-hunt #cybersecurity --- ## [PentesterFlow: How AI Is Changing Penetration Testing](https://medium.com/@xpert4cyber/pentesterflow-how-ai-is-changing-penetration-testing-bdacfbfa533f?source=rss------bug_bounty-5) - **Source:** medium.com/tag/bug-bounty · **Author:** Xpert4Cyber - **Date:** 2026-07-27T12:58:07.000Z - **Summary:** AI just changed how penetration testing works — and it’s not the “AI replaces hackers” story you might expect. Continue reading on Medium » - **Tags:** #penetration-testing #cybersecurity #artificial-intelligence #bug-bounty #ethical-hacking --- ## [Open Redirect & Bypass Techniques: A Practical Methodology for Security Testing](https://medium.com/@N0aziXss/open-redirect-bypass-techniques-a-practical-methodology-for-security-testing-8cea7631b91b?source=rss------bug_bounty-5) - **Source:** medium.com/tag/bug-bounty · **Author:** N0aziXss - **Date:** 2026-07-27T11:54:35.000Z - **Summary:** Subtitle: Continue reading on Medium » - **Tags:** #oauth #bug-bounty #open-redirect #pentesting #methodology --- ## [OWASP Top 10 Isn’t Enough: Security Tests Every Pentester Should Perform](https://medium.com/@dharrunkrish03/owasp-top-10-isnt-enough-security-tests-every-pentester-should-perform-71bbd19cb1d9?source=rss------bug_bounty-5) - **Source:** medium.com/tag/bug-bounty · **Author:** Dharrunkrish - **Date:** 2026-07-27T11:40:20.000Z - **Summary:** A field guide to the vulnerability classes that separate a checklist tester from a professional penetration tester Continue reading on Medium » - **Tags:** #cybersecurity #bug-bounty #application-security #web-penetration-testing #ethical-hacking --- ## [Certificate Transparency — The Recon Superpower](https://kd-200.medium.com/certificate-transparency-the-recon-superpower-3dea8f58a5a0?source=rss------bug_bounty-5) - **Source:** medium.com/tag/bug-bounty · **Author:** Nitin yadav - **Date:** 2026-07-27T11:31:01.000Z - **Summary:** Hey friends! Nitin here 👋 Continue reading on Medium » - **Tags:** #bug-bounty #bug-bounty-tips #ethical-hacking #infosec #cybersecurity --- ## [Hashcat Blackbelt — Cracking WPA2 WiFi Like a Pro (Part 3)](https://medium.com/bug-bounty-hunting-a-comprehensive-guide-in/hashcat-blackbelt-cracking-wpa2-wifi-like-a-pro-part-3-bef1118e3258?source=rss------bug_bounty-5) - **Source:** medium.com/tag/bug-bounty · **Author:** ghostyjoe - **Date:** 2026-07-27T10:35:34.000Z - **Summary:** By Ghostyjoe™ Continue reading on Bug Bounty Hunting: A Comprehensive Guide in English and french » - **Tags:** #bug-bounty #security #hacking #password-cracking #cybersecurity --- ## [A New Beginning: Starting Fresh on Medium](https://medium.com/@commanak46/a-new-beginning-starting-fresh-on-medium-ad0660659046?source=rss------bug_bounty-5) - **Source:** medium.com/tag/bug-bounty · **Author:** commanak46 - **Date:** 2026-07-27T07:53:34.000Z - **Summary:** Leaving my old account behind and beginning a new writing journey with hope, determination, and a fresh start. Continue reading on Medium » - **Tags:** #technology #writing #cybersecurity #penetration-testing #bug-bounty --- ## [Turning Disclosed Bug Bounty Reports into a Skill Claude Can Execute](https://medium.com/@badekanrohan/turning-disclosed-bug-bounty-reports-into-a-skill-claude-can-execute-6e802ba004c6?source=rss------bug_bounty-5) - **Source:** medium.com/tag/bug-bounty · **Author:** rohan badekan - **Date:** 2026-07-27T06:08:47.000Z - **Summary:** Part 2 of the Aii-Aii Hunter series: how to write a “skill” that encodes judgment, not just vocabulary Continue reading on Medium » - **Tags:** #cybersecurity #ai #ai-security #bug-bounty #ai-agent --- ## [Smali By bithowl: Chapter 3 Android Bytecode Fundamentals](https://medium.com/@bithowl/smali-by-bithowl-chapter-3-android-bytecode-fundamentals-8b2ea2403f46?source=rss------bugbounty_writeup-5) - **Source:** medium.com/tag/bugbounty-writeup · **Author:** bithowl - **Date:** 2026-07-25T13:04:01.000Z - **Summary:** (“Every Android App Speaks a Language Your Phone Understands”) Continue reading on Medium » - **Tags:** #bugbounty-writeup #bug-bounty #bithowl --- ## [How a Simple Google Dork Led Me to Find Reflected XSS & HTML Injection on NASA and Earn a Letter of…](https://medium.com/@itss4leh/how-a-simple-google-dork-led-me-to-find-reflected-xss-html-injection-on-nasa-and-earn-a-letter-of-83075852de42?source=rss------bugbounty_writeup-5) - **Source:** medium.com/tag/bugbounty-writeup · **Author:** ItsS4LEH - **Date:** 2026-07-23T15:07:34.000Z - **Summary:** Disclaimer Continue reading on Medium » - **Tags:** #infosec #bug-bounty-tips #bug-bounty-writeup #bug-bounty #bugbounty-writeup --- ## [How a Simple Profile Setting Revealed Sensitive Credentials in a Bug Bounty Program](https://mazenrady.medium.com/how-a-simple-profile-setting-revealed-sensitive-credentials-in-a-bug-bounty-program-7809a8bdd827?source=rss------bugbounty_writeup-5) - **Source:** medium.com/tag/bugbounty-writeup - **Date:** 2026-07-19T08:09:01.000Z - **Summary:** .اللهم انفعنا بما علَّمتنا، وعلِّمنا ما ينفعنا، وزِدنا علمًا وفقهًا وفهمًا يا رب العالمين Continue reading on Medium » - **Tags:** #penetration-testing #information-disclosure #web-penetration-testing #bugbounty-writeup #bug-bounty --- ## [How I Earned a $300 Bug Bounty by Finding an Authorization Bypass in a Private Program](https://ameensec.medium.com/how-i-earned-a-300-bug-bounty-by-finding-an-authorization-bypass-in-a-private-program-cb9b560d1924?source=rss------bugbounty_writeup-5) - **Source:** medium.com/tag/bugbounty-writeup - **Date:** 2026-07-19T06:19:51.000Z - **Summary:** Authorization vulnerabilities are often overlooked because they don’t always involve complex exploits. Sometimes, a single… Continue reading on Medium » - **Tags:** #ethical-hacking #bugbounty-writeup --- ## [wp2shell: Breaking Down the Critical WordPress RCE (CVE-2026–60137 + CVE-2026–63030)](https://medium.com/@hacdoc/wp2shell-breaking-down-the-critical-wordpress-rce-cve-2026-60137-cve-2026-63030-6dbc48105d7f?source=rss------bugbounty_writeup-5) - **Source:** medium.com/tag/bugbounty-writeup - **Date:** 2026-07-18T16:50:21.000Z - **Summary:** Hi Guyz Continue reading on Medium » - **Tags:** #cybersecurity #wordpress #hacking #bugbounty-writeup --- ## [Smali By bithowl: Chapter 2 Why Every Android Hacker Needs Smali](https://medium.com/@bithowl/smali-by-bithowl-chapter-2-why-every-android-hacker-needs-smali-1d89d42f1b7c?source=rss------bugbounty_writeup-5) - **Source:** medium.com/tag/bugbounty-writeup - **Date:** 2026-07-16T12:20:24.000Z - **Summary:** (“The Code You See Isn’t Always the Code That Runs”) Continue reading on Medium » - **Tags:** #bug-bounty #bugbounty-writeup #bithowl --- ## [I Spent 5 Days Looking for a Bug That Didn’t Exist: NASA](https://root-vaibhav.medium.com/i-spent-5-days-looking-for-a-bug-that-didnt-exist-nasa-91f1ab879d45?source=rss------bugbounty_writeup-5) - **Source:** medium.com/tag/bugbounty-writeup - **Date:** 2026-07-13T08:03:56.000Z - **Summary:** Until I Realized I Was Asking the Wrong Question. Continue reading on Medium » - **Tags:** #bugbounty-writeup #hacking #nasa --- ## [Hacking the Hacker’s Assistant: How I Found a Critical Stored XSS in DeepSeek’s Code Sandbox](https://medium.com/@sumitshahorg/hacking-the-hackers-assistant-how-i-found-a-critical-stored-xss-in-deepseek-s-code-sandbox-0e31edc90e70?source=rss------bugbounty_writeup-5) - **Source:** medium.com/tag/bugbounty-writeup - **Date:** 2026-07-12T14:23:31.000Z - **Summary:** What’s up, hackers? Sumit here, aka hacksage 😌 Continue reading on Medium » - **Tags:** #deepseek #bugbounty-writeup #xss-attack #xss-vulnerability #cybersecurity --- ## [How I Bypassed a Mandatory 2FA Enforcement Just by Dropping One Request](https://medium.com/@northsidehacker/how-i-bypassed-a-mandatory-2fa-enforcement-just-by-dropping-one-request-863b79f88771?source=rss------bugbounty_writeup-5) - **Source:** medium.com/tag/bugbounty-writeup - **Date:** 2026-07-10T09:19:11.000Z - **Summary:** So I was testing a platform that forces every new user to set up 2FA before they can even see the dashboard. No skip button, no later… Continue reading on Medium » - **Tags:** #bug-bounty #web-security #bugbounty-writeup #infosec --- ## [TryHackMe: Passive Reconnaissance](https://medium.com/@eze_tg/tryhackme-passive-reconnaissance-a1dea31a0921?source=rss------penetration_testing-5) - **Source:** medium.com/tag/penetration-testing · **Author:** Chimeremeze - **Date:** 2026-07-27T14:27:57.000Z - **Summary:** Introduction Continue reading on Medium » - **Tags:** #tryhackme #penetration-testing #cybersecurity --- ## [Publisher: TryHackMe CTF Walkthrough](https://medium.com/@huzaifa_X_malik/publisher-tryhackme-ctf-walkthrough-cc97c9506153?source=rss------penetration_testing-5) - **Source:** medium.com/tag/penetration-testing · **Author:** Huzaifa Malik - **Date:** 2026-07-27T13:46:02.000Z - **Summary:** A begginer level CTF to practice the enumeration skills and perform multi-step privilege escalation Continue reading on Medium » - **Tags:** #ctf-writeup #penetration-testing #web-security #tryhackme #privilege-escalation --- ## [Python Web Penetration Testing — Day 6: Detecting and Exploiting SQL Injection Vulnerabilities](https://osintteam.blog/python-web-penetration-testing-day-6-detecting-and-exploiting-sql-injection-vulnerabilities-490bf8527686?source=rss------penetration_testing-5) - **Source:** medium.com/tag/penetration-testing · **Author:** Aman Sharma - **Date:** 2026-07-27T13:14:49.000Z - **Summary:** I spent weeks ignoring SQL injection Continue reading on OSINT Team » - **Tags:** #bug-bounty #technology #programming #penetration-testing #cybersecurity --- ## [PentesterFlow: How AI Is Changing Penetration Testing](https://medium.com/@xpert4cyber/pentesterflow-how-ai-is-changing-penetration-testing-bdacfbfa533f?source=rss------penetration_testing-5) - **Source:** medium.com/tag/penetration-testing · **Author:** Xpert4Cyber - **Date:** 2026-07-27T12:58:07.000Z - **Summary:** AI just changed how penetration testing works — and it’s not the “AI replaces hackers” story you might expect. Continue reading on Medium » - **Tags:** #penetration-testing #cybersecurity #artificial-intelligence #bug-bounty #ethical-hacking --- ## [Setup Oracle VirtualBox dan Instalasi Kali Linux sebagai Environment Network Penetration Testing](https://medium.com/@akcerman21/setup-oracle-virtualbox-dan-instalasi-kali-linux-sebagai-environment-network-penetration-testing-8546767f8c98?source=rss------penetration_testing-5) - **Source:** medium.com/tag/penetration-testing · **Author:** Thoaibi Afriadi - **Date:** 2026-07-27T12:15:09.000Z - **Summary:** Dalam dunia cybersecurity, khususnya Network Penetration Testing, lingkungan kerja yang aman sangat penting. Oleh karena itu, penggunaan… Continue reading on Medium » - **Tags:** #oracle-virtual-box #penetration-testing #cybersecurity #linux #kali-linux --- ## [Rooting DC-7: OSINT, a Leaky GitHub Repo, and a Cron Job Waiting to Be Abused](https://medium.com/@sithumsryt/rooting-dc-7-osint-a-leaky-github-repo-and-a-cron-job-waiting-to-be-abused-3d63e0b90875?source=rss------penetration_testing-5) - **Source:** medium.com/tag/penetration-testing · **Author:** Sithum Ranasinghe - **Date:** 2026-07-27T11:26:47.000Z - **Summary:** No CVE, no plugin exploit, no brute force. Just a username, a search engine, and a script that already runs as root. Continue reading on Medium » - **Tags:** #ctf #penetration-testing #vulnhub #ethical-hacking --- ## [Gemini 3.5 Flash Cyber Explained: Google’s AI-Powered Code Security Model](https://medium.com/@techlatest.net/gemini-3-5-flash-cyber-explained-googles-ai-powered-code-security-model-e8a5858538fc?source=rss------penetration_testing-5) - **Source:** medium.com/tag/penetration-testing · **Author:** Parvez Mohammed @ Techlatest.net - **Date:** 2026-07-27T11:24:35.000Z - **Summary:** Software security is entering a new era. Continue reading on Medium » - **Tags:** #google #google-gemini-3 #cybersecurity #penetration-testing #ai-model --- ## [5 Affordable Penetration Testing Companies I Actually Outsourced to as a Startup](https://medium.com/@nabishajaved/5-affordable-penetration-testing-companies-i-actually-outsourced-to-as-a-startup-bc3ad399ecd5?source=rss------penetration_testing-5) - **Source:** medium.com/tag/penetration-testing · **Author:** N .J - **Date:** 2026-07-27T10:55:39.000Z - **Summary:** Nearly half of small businesses have no cybersecurity budget at all, and only one in five ever runs an annual penetration test, according… Continue reading on Medium » - **Tags:** #web-penetration-testing #penetration-testing #pentesting --- ## [I Built My Own Local AI Tool for Penetration Testing](https://medium.com/@manikandank9840/i-built-my-own-local-ai-tool-for-penetration-testing-ff406dff4205?source=rss------penetration_testing-5) - **Source:** medium.com/tag/penetration-testing · **Author:** Manikandan - **Date:** 2026-07-27T09:17:20.000Z - **Summary:** I combined Ollama, OpenCode, and HexStrikeAI into one private, terminal-based security assistant. Continue reading on Medium » - **Tags:** #privacy #artificial-intelligence #penetration-testing #kali-linux #cybersecurity --- ## [A New Beginning: Starting Fresh on Medium](https://medium.com/@commanak46/a-new-beginning-starting-fresh-on-medium-ad0660659046?source=rss------penetration_testing-5) - **Source:** medium.com/tag/penetration-testing · **Author:** commanak46 - **Date:** 2026-07-27T07:53:34.000Z - **Summary:** Leaving my old account behind and beginning a new writing journey with hope, determination, and a fresh start. Continue reading on Medium » - **Tags:** #technology #writing #cybersecurity #penetration-testing #bug-bounty --- ## [Publisher: TryHackMe CTF Walkthrough](https://medium.com/@huzaifa_X_malik/publisher-tryhackme-ctf-walkthrough-cc97c9506153?source=rss------ctf_writeup-5) - **Source:** medium.com/tag/ctf-writeup · **Author:** Huzaifa Malik - **Date:** 2026-07-27T13:46:02.000Z - **Summary:** A begginer level CTF to practice the enumeration skills and perform multi-step privilege escalation Continue reading on Medium » - **Tags:** #ctf-writeup #penetration-testing #web-security #tryhackme #privilege-escalation --- ## [Capture The Flag with Powershell — UnderTheWire: Century](https://medium.com/@lumenyx/capture-the-flag-with-powershell-underthewire-century-ff61d04fee92?source=rss------ctf_writeup-5) - **Source:** medium.com/tag/ctf-writeup · **Author:** Lumenyx - **Date:** 2026-07-27T12:29:08.000Z - **Summary:** UnderTheWire is a game where you have to find the password to the next level using Powershell commands. Continue reading on Medium » - **Tags:** #ctf-writeup #ctf #powershell --- ## [The Beginner’s Guide to the Challenge Library: Section 1](https://ashish-vikramaditya.medium.com/the-beginners-guide-to-the-challenge-library-section-1-5ce0cdfbeaee?source=rss------ctf_writeup-5) - **Source:** medium.com/tag/ctf-writeup · **Author:** ASHISH YADAV - **Date:** 2026-07-27T12:18:39.000Z - **Summary:** Today I have completed the section 1 (Sanity) of learning path (The Beginner’s Guide to the Challenge Library). Continue reading on Medium » - **Tags:** #picoctf #cybersecurity #ctf-writeup #linux --- ## [Writeup for CyLab/picoCTF challenge “repetitions”](https://medium.com/@waltermoar/writeup-for-cylab-picoctf-challenge-repetitions-27d5245bc471?source=rss------ctf_writeup-5) - **Source:** medium.com/tag/ctf-writeup · **Author:** Walter Moar - **Date:** 2026-07-27T11:01:01.000Z - **Summary:** Learn how CyLab’s “repetitions” challenge explores Base64 encoding, using the Linux shell to decode a flag that has been Base64-encoded… Continue reading on Medium » - **Tags:** #cybersecurity #ctf #ctf-writeup #cylab #hacking --- ## [Six Locks, One Question: My FamPay CTF 2026 Writeup](https://medium.com/@bhatsupshubham/six-locks-one-question-my-fampay-ctf-2026-writeup-2cbf56d16e0b?source=rss------ctf_writeup-5) - **Source:** medium.com/tag/ctf-writeup · **Author:** Shubham Bhat - **Date:** 2026-07-27T07:26:03.000Z - **Summary:** An Android app, a web app, and one very talkative cloud instance — and how all six of them broke on the exact same question. Continue reading on Medium » - **Tags:** #ctf #ctf-writeup #cybersecurity --- ## [Conti Tryhackme Writeup](https://medium.com/@cristopher.gilbert27/conti-tryhackme-writeup-526ff55a778a?source=rss------ctf_writeup-5) - **Source:** medium.com/tag/ctf-writeup · **Author:** Enryuuu - **Date:** 2026-07-27T07:00:36.000Z - **Summary:** Introduction Continue reading on Medium » - **Tags:** #tryhackme #ctf-writeup #infosec #ctf #cybersecurity --- ## [TryHackMe: Simple CTF Walkthrough](https://medium.com/@jyothishbalachandran/tryhackme-simple-ctf-walkthrough-ec4e8da37738?source=rss------ctf_writeup-5) - **Source:** medium.com/tag/ctf-writeup · **Author:** JYOTHISH BALACHANDRAN - **Date:** 2026-07-27T05:53:33.000Z - **Summary:** …. Continue reading on Medium » - **Tags:** #ctf #capture-the-flag #tryhackme #ctf-writeup #cybersecurity --- ## [Starting my CTF journey](https://ashish-vikramaditya.medium.com/starting-my-ctf-journey-36c5d7fba14d?source=rss------ctf_writeup-5) - **Source:** medium.com/tag/ctf-writeup · **Author:** ASHISH YADAV - **Date:** 2026-07-27T02:21:54.000Z - **Summary:** Hi everyone, Continue reading on Medium » - **Tags:** #ctf-writeup #cybersecurity --- ## [Attack GraphQL — Skills Assessment Writeup](https://medium.com/@hassanbounty30/attack-graphql-skills-assessment-writeup-8708f970b577?source=rss------ctf_writeup-5) - **Source:** medium.com/tag/ctf-writeup · **Author:** Hassan Elsayed - **Date:** 2026-07-27T02:20:40.000Z - **Summary:** Hassan Elsayed Continue reading on Medium » - **Tags:** #web-penetration-testing #cybersecurity #ctf-writeup --- ## [HTB Web Attacks — Skills Assessment Writeup](https://medium.com/@hassanbounty30/htb-web-attacks-skills-assessment-writeup-3af460a2cab7?source=rss------ctf_writeup-5) - **Source:** medium.com/tag/ctf-writeup · **Author:** Hassan Elsayed - **Date:** 2026-07-27T01:56:26.000Z - **Summary:** Hassan Elsayed Continue reading on Medium » - **Tags:** #cybersecurity #ctf-writeup #web-penetration-testing --- ## [How a Hidden GraphQL Endpoint Led Me to a Critical SQL Injection Worth €2,500](https://medium.com/@0x0sadat/how-a-hidden-graphql-endpoint-led-me-to-a-critical-sql-injection-worth-2-500-a2e39521944b?source=rss------infosec-5) - **Source:** medium.com/tag/infosec · **Author:** 0xSADAT - **Date:** 2026-07-27T14:58:18.000Z - **Summary:** A simple directory fuzzing session uncovered a hidden GraphQL endpoint. A harmless-looking search bar eventually turned into a confirmed… Continue reading on Medium » - **Tags:** #bug-bounty-writeup #infosec #bug-bounty #info-sec-writeups #cybersecurity --- ## [GitLab RCE Vulnerability Explained: The Notebook Diff Exploit Chain](https://medium.com/@xpert4cyber/gitlab-rce-vulnerability-explained-the-notebook-diff-exploit-chain-be97e526f9d9?source=rss------infosec-5) - **Source:** medium.com/tag/infosec · **Author:** Xpert4Cyber - **Date:** 2026-07-27T12:57:44.000Z - **Summary:** GitLab just patched a remote code execution vulnerability that never got a CVE, never got a security advisory, and was triggered by… Continue reading on Medium » - **Tags:** #gitlab #infosec #devsecops #cybersecurity #vulnerability --- ## [Deconstructing a Phishing Email: A Step by Step Header Analysis & Investigation](https://mgunawardana.medium.com/deconstructing-a-phishing-email-a-step-by-step-header-analysis-investigation-8ddec9ea3c31?source=rss------infosec-5) - **Source:** medium.com/tag/infosec · **Author:** Mihindi Gunawardana - **Date:** 2026-07-27T12:10:54.000Z - **Summary:** Phishing remains one of the primary initial access vectors in real world cyberattacks. While modern security appliances catch a vast… Continue reading on Medium » - **Tags:** #phishing #cybersecurity #infosec #digital-forensics #threat-intelligence --- ## [Certificate Transparency — The Recon Superpower](https://kd-200.medium.com/certificate-transparency-the-recon-superpower-3dea8f58a5a0?source=rss------infosec-5) - **Source:** medium.com/tag/infosec · **Author:** Nitin yadav - **Date:** 2026-07-27T11:31:01.000Z - **Summary:** Hey friends! Nitin here 👋 Continue reading on Medium » - **Tags:** #bug-bounty #bug-bounty-tips #ethical-hacking #infosec #cybersecurity --- ## [Conti Tryhackme Writeup](https://medium.com/@cristopher.gilbert27/conti-tryhackme-writeup-526ff55a778a?source=rss------infosec-5) - **Source:** medium.com/tag/infosec · **Author:** Enryuuu - **Date:** 2026-07-27T07:00:36.000Z - **Summary:** Introduction Continue reading on Medium » - **Tags:** #tryhackme #ctf-writeup #infosec #ctf #cybersecurity --- ## [The Top 10 Data Breaches of 2026 (So Far) — July Edition](https://h3ckerboi.medium.com/the-top-10-data-breaches-of-2026-so-far-july-edition-1ee66a3c6e6d?source=rss------infosec-5) - **Source:** medium.com/tag/infosec · **Author:** Ayush Bagde - **Date:** 2026-07-27T06:25:04.000Z - **Summary:** We’re past the halfway mark of 2026, and the scoreboard is ugly. Vishing calls are beating firewalls, a single stale API token unlocked… Continue reading on Medium » - **Tags:** #cybersecurity #data-breach #shinyhunters #infosec #ransomware --- ## [Mobile Malware is Not Just a Consumer Problem: Securing Corporate BYOD Against Modern Threats](https://medium.com/@graysentinel.ai/mobile-malware-is-not-just-a-consumer-problem-securing-corporate-byod-against-modern-threats-8d22ec548ff5?source=rss------infosec-5) - **Source:** medium.com/tag/infosec · **Author:** GraySentinel- Cyber Defence Lab - **Date:** 2026-07-27T06:07:46.000Z - **Summary:** For years, mobile malware was dismissed as a consumer nuisance. Something that primarily targeted individuals for ad fraud or stealing… Continue reading on Medium » - **Tags:** #threat-intelligence #infosec #cyber-defense #cybersecurity #social-media --- ## [Multimodal Prompt Injection: When Images Attack](https://medium.com/@pardhivkrishna2412/multimodal-prompt-injection-when-images-attack-8fe17b8f2c43?source=rss------infosec-5) - **Source:** medium.com/tag/infosec · **Author:** Pardhivkrishna - **Date:** 2026-07-27T05:31:14.000Z - **Summary:** For the past few years, talking to AI has mostly been about having a conversation through text. You write a question in a chat box and the… Continue reading on Medium » - **Tags:** #artificial-intelligence #cybersecurity #genai #infosec #prompt-injection --- ## [I Tested 7 AI OSINT Agents on My Own Digital Footprint — Here’s What They Found in 4 Minutes](https://cybersecuritywriteups.com/i-tested-7-ai-osint-agents-on-my-own-digital-footprint-heres-what-they-found-in-4-minutes-e06984a25401?source=rss------infosec-5) - **Source:** medium.com/tag/infosec · **Author:** Aeon Flex, Elriel Assoc. 2133 [NEON MAXIMA] - **Date:** 2026-07-27T02:13:39.000Z - **Summary:** I thought I had good opsec. I was adorably wrong. Continue reading on Cyber Security Write-ups » - **Tags:** #cybersecurity #osint #hacking #infosec #privacy --- ## [Top 10 web hacking techniques of 2025](https://portswigger.net/research/top-10-web-hacking-techniques-of-2025) - **Source:** portswigger.net/research - **Date:** 2026-02-05T15:28:08.000Z - **Summary:** Welcome to the Top 10 Web Hacking Techniques of 2025, the 19th edition of our annual community-powered effort to identify the most innovative must-read web security research published in the last year - **Tags:** #security --- ## [Top 10 web hacking techniques of 2025: call for nominations](https://portswigger.net/research/top-10-web-hacking-techniques-of-2025-nominations-open) - **Source:** portswigger.net/research - **Date:** 2026-01-06T15:31:28.000Z - **Summary:** Update: nominations are now closed, and voting is live! Cast your vote here Over the last year, security researchers have shared a huge amount of work with the community through blog posts, presentati - **Tags:** #security --- ## [The Fragile Lock: Novel Bypasses For SAML Authentication](https://portswigger.net/research/the-fragile-lock) - **Source:** portswigger.net/research - **Date:** 2025-12-10T12:32:00.000Z - **Summary:** TLDR This post shows how to achieve a full authentication bypass in the Ruby and PHP SAML ecosystem by exploiting several parser-level inconsistencies: including attribute pollution, namespace confusi - **Tags:** #security --- ## [Introducing HTTP Anomaly Rank](https://portswigger.net/research/introducing-http-anomaly-rank) - **Source:** portswigger.net/research - **Date:** 2025-11-11T14:41:53.000Z - **Summary:** HTTP Anomaly Rank If you've ever used Burp Intruder or Turbo Intruder, you'll be familiar with the ritual of manually digging through thousands of responses by repeatedly sorting the table via length, - **Tags:** #security --- ## [WebSocket Turbo Intruder: Unearthing the WebSocket Goldmine](https://portswigger.net/research/websocket-turbo-intruder-unearthing-the-websocket-goldmine) - **Source:** portswigger.net/research - **Date:** 2025-09-17T12:40:06.000Z - **Summary:** Many testers and tools give up the moment a protocol upgrade to WebSocket occurs, or only perform shallow analysis. This is a huge blind spot, leaving many bugs like Broken Access Controls, Race condi - **Tags:** #security --- ## [Cookie Chaos: How to bypass __Host and __Secure cookie prefixes](https://portswigger.net/research/cookie-chaos-how-to-bypass-host-and-secure-cookie-prefixes) - **Source:** portswigger.net/research - **Date:** 2025-09-03T14:46:23.000Z - **Summary:** Browsers added cookie prefixes to protect your sessions and stop attackers from setting harmful cookies. In this post, you’ll see how to bypass cookie defenses using discrepancies in browser and serve - **Tags:** #security --- ## [Inline Style Exfiltration: leaking data with chained CSS conditionals](https://portswigger.net/research/inline-style-exfiltration) - **Source:** portswigger.net/research - **Date:** 2025-08-26T12:54:03.000Z - **Summary:** I discovered how to use CSS to steal attribute data without selectors and stylesheet imports! This means you can now exploit CSS injection via style attributes! Learn how below: Someone asked if you c - **Tags:** #security --- ## [Beware the false false-positive: how to distinguish HTTP pipelining from request smuggling](https://portswigger.net/research/how-to-distinguish-http-pipelining-from-request-smuggling) - **Source:** portswigger.net/research - **Date:** 2025-08-19T14:30:44.000Z - **Summary:** Sometimes people think they've found HTTP request smuggling, when they're actually just observing HTTP keep-alive or pipelining. This is usually a false positive, but sometimes there's actually a real - **Tags:** #security --- ## [HTTP/1.1 must die: the desync endgame](https://portswigger.net/research/http1-must-die) - **Source:** portswigger.net/research - **Date:** 2025-08-06T22:20:00.000Z - **Summary:** Abstract Upstream HTTP/1.1 is inherently insecure and regularly exposes millions of websites to hostile takeover. Six years of attempted mitigations have hidden the issue, but failed to fix it. This p - **Tags:** #security --- ## [Repeater Strike: manual testing, amplified](https://portswigger.net/research/repeater-strike-manual-testing-amplified) - **Source:** portswigger.net/research - **Date:** 2025-07-15T13:46:37.000Z - **Summary:** Manual testing doesn't have to be repetitive. In this post, we're introducing Repeater Strike - a new AI-powered Burp Suite extension designed to automate the hunt for IDOR and similar vulnerabilities - **Tags:** #security --- ## [Drag and Pwnd: Leverage ASCII characters to exploit VS Code](https://portswigger.net/research/drag-and-pwnd-leverage-ascii-characters-to-exploit-vs-code) - **Source:** portswigger.net/research - **Date:** 2025-04-30T12:37:11.000Z - **Summary:** Control characters like SOH, STX, EOT and ETX were never meant to run your code - but in the world of modern terminal emulators, they sometimes do. In this post, I'll dive into the forgotten mechanics - **Tags:** #security --- ## [Document My Pentest: you hack, the AI writes it up!](https://portswigger.net/research/document-my-pentest) - **Source:** portswigger.net/research - **Date:** 2025-04-23T13:17:24.000Z - **Summary:** Tired of repeating yourself? Automate your web security audit trail. In this post I'll introduce a new Burp AI extension that takes the boring bits out of your pen test. Web security testing can be a - **Tags:** #security --- ## [SAML roulette: the hacker always wins](https://portswigger.net/research/saml-roulette-the-hacker-always-wins) - **Source:** portswigger.net/research - **Date:** 2025-03-18T14:55:43.000Z - **Summary:** Introduction In this post, we’ll show precisely how to chain round-trip attacks and namespace confusion to achieve unauthenticated admin access on GitLab Enterprise by exploiting the ruby-saml library - **Tags:** #security --- ## [Shadow Repeater:AI-enhanced manual testing](https://portswigger.net/research/shadow-repeater-ai-enhanced-manual-testing) - **Source:** portswigger.net/research - **Date:** 2025-02-20T13:20:19.000Z - **Summary:** Have you ever wondered how many vulnerabilities you've missed by a hair's breadth, due to a single flawed choice? We've just released Shadow Repeater, which enhances your manual testing with AI-powere - **Tags:** #security --- ## [Top 10 web hacking techniques of 2024](https://portswigger.net/research/top-10-web-hacking-techniques-of-2024) - **Source:** portswigger.net/research - **Date:** 2025-02-04T15:01:48.000Z - **Summary:** Welcome to the Top 10 Web Hacking Techniques of 2024, the 18th edition of our annual community-powered effort to identify the most innovative must-read web security research published in the last year - **Tags:** #security --- ## [Bypassing character blocklists with unicode overflows](https://portswigger.net/research/bypassing-character-blocklists-with-unicode-overflows) - **Source:** portswigger.net/research - **Date:** 2025-01-28T13:58:28.000Z - **Summary:** Unicode codepoint truncation - also called a Unicode overflow attack - happens when a server tries to store a Unicode character in a single byte. Because the maximum value of a byte is 255, an overflo - **Tags:** #security --- ## [Stealing HttpOnly cookies with the cookie sandwich technique](https://portswigger.net/research/stealing-httponly-cookies-with-the-cookie-sandwich-technique) - **Source:** portswigger.net/research - **Date:** 2025-01-22T14:45:11.000Z - **Summary:** In this post, I will introduce the "cookie sandwich" technique which lets you bypass the HttpOnly flag on certain servers. This research follows on from Bypassing WAFs with the phantom $Version cookie - **Tags:** #security --- ## [Top 10 web hacking techniques of 2024: nominations open](https://portswigger.net/research/top-10-web-hacking-techniques-of-2024-nominations-open) - **Source:** portswigger.net/research - **Date:** 2025-01-08T14:07:27.000Z - **Summary:** Nominations are now open for the top 10 new web hacking techniques of 2024! Every year, security researchers from all over the world share their latest findings via blog posts, presentations, PoCs, an - **Tags:** #security --- ## [Bypassing WAFs with the phantom $Version cookie](https://portswigger.net/research/bypassing-wafs-with-the-phantom-version-cookie) - **Source:** portswigger.net/research - **Date:** 2024-12-04T15:03:35.000Z - **Summary:** HTTP cookies often control critical website features, but their long and convoluted history exposes them to parser discrepancy vulnerabilities. In this post, I'll explore some dangerous, lesser-known - **Tags:** #security --- ## [New crazy payloads in the URL Validation Bypass Cheat Sheet](https://portswigger.net/research/new-crazy-payloads-in-the-url-validation-bypass-cheat-sheet) - **Source:** portswigger.net/research - **Date:** 2024-10-29T13:59:13.000Z - **Summary:** The strength of our URL Validation Bypass Cheat Sheet lies in the contributions from the web security community, and today’s update is no exception. We are excited to introduce a new and improved IP a - **Tags:** #security --- ## [Concealing payloads in URL credentials](https://portswigger.net/research/concealing-payloads-in-url-credentials) - **Source:** portswigger.net/research - **Date:** 2024-10-23T12:59:05.000Z - **Summary:** Last year Johan Carlsson discovered you could conceal payloads inside the credentials part of the URL . This was fascinating to me especially because the payload is not actually visible in the URL in - **Tags:** #security --- ## [Introducing the URL validation bypass cheat sheet](https://portswigger.net/research/introducing-the-url-validation-bypass-cheat-sheet) - **Source:** portswigger.net/research - **Date:** 2024-09-03T14:52:12.000Z - **Summary:** URL validation bypasses are the root cause of numerous vulnerabilities including many instances of SSRF, CORS misconfiguration, and open redirection. These work by using ambiguous URLs to trigger URL - **Tags:** #security --- ## [Gotta cache 'em all: bending the rules of web cache exploitation](https://portswigger.net/research/gotta-cache-em-all) - **Source:** pentester.land · **Author:** Martin Doyhenard (@tincho_508) - **Date:** 2024-08-08 - **Summary:** Target Program: - - **Tags:** #Web cache poisoning #Web cache deception --- ## [Splitting the email atom: exploiting parsers to bypass access controls](https://portswigger.net/research/splitting-the-email-atom) - **Source:** pentester.land · **Author:** Gareth Heyes (@garethheyes) - **Date:** 2024-08-07 - **Summary:** Target Program: - - **Tags:** #Web cache poisoning #Web cache deception --- ## [Listen to the whispers: web timing attacks that actually work](https://portswigger.net/research/listen-to-the-whispers-web-timing-attacks-that-actually-work) - **Source:** pentester.land · **Author:** James Kettle (@albinowax) - **Date:** 2024-08-07 - **Summary:** Target Program: - - **Tags:** #Timing attack #SSRF #WAF bypass #Reverse proxy misconfiguration --- ## [Fickle PDFs: exploiting browser rendering discrepancies](https://portswigger.net/research/fickle-pdfs-exploiting-browser-rendering-discrepancies) - **Source:** pentester.land · **Author:** Zakhar Fedotkin / d4d (@d4d89704243) - **Date:** 2024-07-09 - **Summary:** Target Program: - - **Tags:** #Phishing --- ## [A hacking hat-trick: previewing three PortSwigger Research publications coming to DEF CON & Black Hat USA](https://portswigger.net/research/a-hacking-hat-trick-previewing-three-portswigger-research-publications-coming-to-def-con-amp-black-hat-usa) - **Source:** portswigger.net/research - **Date:** 2024-07-02T12:57:08.000Z - **Summary:** We're delighted to announce three major research releases from PortSwigger Research will be published at both Black Hat USA and DEF CON 32. In this post, we'll offer a quick teaser of each talk, info - **Tags:** #security --- ## [onwebkitplaybacktargetavailabilitychanged?! New exotic events in the XSS cheat sheet](https://portswigger.net/research/new-exotic-events-in-the-xss-cheat-sheet) - **Source:** portswigger.net/research - **Date:** 2024-06-11T14:58:29.000Z - **Summary:** The power of our XSS cheat sheet is we get fantastic contributions from the web security community and this update is no exception. We had valuable contributions from Mozilla to remove events that no - **Tags:** #security --- ## [Refining your HTTP perspective, with bambdas](https://portswigger.net/research/adjusting-your-http-perspective-with-bambdas) - **Source:** portswigger.net/research - **Date:** 2024-05-29T13:31:49.000Z - **Summary:** When you open a HTTP request or response, what do you instinctively look for? Suspicious parameter names? CORS headers? Some clue as to the request's origin or underlying purpose? A single HTTP messag - **Tags:** #security --- ## [Introducing SignSaboteur: forge signed web tokens with ease](https://portswigger.net/research/introducing-signsaboteur-forge-signed-web-tokens-with-ease) - **Source:** portswigger.net/research - **Date:** 2024-05-22T12:37:00.000Z - **Summary:** Signed web tokens are widely used for stateless authentication and authorization throughout the web. The most popular format is JSON Web Tokens (JWT) which we've already covered in depth, but beyond t - **Tags:** #security --- ## [Making desync attacks easy with TRACE](https://portswigger.net/research/trace-desync-attack) - **Source:** pentester.land · **Author:** Martin Doyhenard (@tincho_508) - **Date:** 2024-03-19 - **Summary:** Target Program: - - **Tags:** #Desync attack #HTTP request smuggling #Web cache poisoning --- ## [Using form hijacking to bypass CSP](https://portswigger.net/research/using-form-hijacking-to-bypass-csp) - **Source:** portswigger.net/research - **Date:** 2024-03-05T14:55:00.000Z - **Summary:** In this post we'll show you how to bypass CSP by using an often overlooked technique that can enable password theft in a seemingly secure configuration. What is form hijacking? Form hijacking isn't re - **Tags:** #security --- ## [Top 10 web hacking techniques of 2023](https://portswigger.net/research/top-10-web-hacking-techniques-of-2023) - **Source:** portswigger.net/research - **Date:** 2024-02-19T14:31:12.000Z - **Summary:** Welcome to the Top 10 Web Hacking Techniques of 2023, the 17th edition of our annual community-powered effort to identify the most innovative must-read web security research published in the last year - **Tags:** #security --- ## [Hiding payloads in Java source code strings](https://portswigger.net/research/hiding-payloads-in-java-source-code-strings) - **Source:** portswigger.net/research - **Date:** 2024-01-23T15:00:00.000Z - **Summary:** In this post we'll show you how Java handles unicode escapes in source code strings in a way you might find surprising - and how you can abuse them to conceal payloads. We recently released a powerful - **Tags:** #security --- ## [Top 10 web hacking techniques of 2023 - nominations open](https://portswigger.net/research/top-10-web-hacking-techniques-of-2023-nominations-open) - **Source:** portswigger.net/research - **Date:** 2024-01-09T14:33:50.000Z - **Summary:** Update: The results are in! Check out the final top ten here or scroll down to view all nominations Over the last year, numerous security researchers have shared their discoveries with the community t - **Tags:** #security --- ## [Finding that one weird endpoint, with Bambdas](https://portswigger.net/research/finding-that-one-weird-endpoint-with-bambdas) - **Source:** portswigger.net/research - **Date:** 2023-12-12T14:11:17.000Z - **Summary:** Security research involves a lot of failure. It's a perpetual balancing act between taking small steps with a predictable but boring outcome, and trying out wild concepts that are so crazy they might - **Tags:** #security --- ## [Blind CSS Exfiltration: exfiltrate unknown web pages](https://portswigger.net/research/blind-css-exfiltration) - **Source:** pentester.land · **Author:** Gareth Heyes (@garethheyes) - **Date:** 2023-12-05 - **Summary:** Target Program: - - **Tags:** #Blind CSS exfiltration #Blind HTML injection --- ## [The single-packet attack: making remote race-conditions 'local'](https://portswigger.net/research/the-single-packet-attack-making-remote-race-conditions-local) - **Source:** portswigger.net/research - **Date:** 2023-10-18T12:54:01.000Z - **Summary:** The single-packet attack is a new technique for triggering web race conditions. It works by completing multiple HTTP/2 requests with a single TCP packet, which effectively eliminates network jitter an - **Tags:** #security --- ## [How to build custom scanners for web security research automation](https://portswigger.net/research/how-to-build-custom-scanners-for-web-security-research-automation) - **Source:** pentester.land · **Author:** James Kettle (@albinowax) - **Date:** 2023-10-03 - **Summary:** Target Program: - - **Tags:** #Race condition --- ## [Smashing the state machine: the true potential of web race conditions](https://portswigger.net/research/smashing-the-state-machine) - **Source:** pentester.land · **Author:** James Kettle (@albinowax) - **Date:** 2023-08-09 - **Summary:** Target Program: Devise, GitLab - **Tags:** #Race condition --- ## [High Signal Detection and Exploitation of Ivanti's Pulse Connect Secure Auth Bypass & RCE](https://blog.assetnote.io/2024/01/19/ivanti-pulse-connect-secure-auth-bypass-rce/) - **Source:** blog.assetnote.io - **Date:** 2024-01-18T13:00:00.000Z - **Tags:** #security --- ## [Citrix Bleed: Leaking Session Tokens with CVE-2023-4966](https://blog.assetnote.io/2023/10/24/citrixbleed-CVE-2023-4966/) - **Source:** blog.assetnote.io - **Date:** 2023-10-23T21:35:11.000Z - **Tags:** #CVE-2023-4966 --- ## [RCE in Progress WS_FTP Ad Hoc via IIS HTTP Modules (CVE-2023-40044)](https://blog.assetnote.io/2023/10/04/rce-progress-ws-ftp/) - **Source:** blog.assetnote.io - **Date:** 2023-10-03T21:33:19.000Z - **Tags:** #CVE-2023-40044 --- ## [Leaking File Contents with a Blind File Oracle in Flarum](https://blog.assetnote.io/2023/08/28/leaking-file-contents-with-a-blind-file-oracle-in-flarum/) - **Source:** pentester.land · **Author:** Adam Kues (@hash_kitten) - **Date:** 2023-08-28 - **Summary:** Target Program: Flarum - **Tags:** #PHP filter chain #Arbitrary file read #LFI #Security code review --- ## [Advisory: Flarum LFI - CVE-2023-40033](https://blog.assetnote.io/2023/08/28/advisory-flarum-lfi/) - **Source:** blog.assetnote.io - **Date:** 2023-08-27T21:00:00.000Z - **Summary:** Summary An attacker with a basic user forum account can specify a malicious avatar URL that discloses the contents of arbitrary local files on the file system. Impact An attacker can read the contents of any local file. An attacker can also conduct blind SSRF attacks. Affected Software The following versions are affected by this vulnerability: flarum/framework = 1.8.0. Flarum has released an advisory here. The vulnerability was assigned CVE-2023-40033. Blog Post The blog post detailing the steps - **Tags:** #CVE-2023-40033 --- ## [Finding and Exploiting Citrix NetScaler Buffer Overflow (CVE-2023-3519) (Part 3)](https://blog.assetnote.io/2023/08/09/exploiting-citrix-netscaler-cve-2023-3519/) - **Source:** pentester.land · **Author:** Dylan Pindur - **Date:** 2023-08-09 - **Summary:** Target Program: Citrix Systems (NetScaler) - **Tags:** #Buffer Overflow #Memory corruption #CVE-2023-3519 --- ## [Analysis of CVE-2023-3519 in Citrix ADC and NetScaler Gateway (Part 2)](https://blog.assetnote.io/2023/07/24/citrix-rce-part-2-cve-2023-3519/) - **Source:** blog.assetnote.io - **Date:** 2023-07-24T09:15:03.000Z - **Summary:** In our last post we uncovered a vulnerability inside Citrix ADC and NetScaler Gateway that was in the patch fix for CVE-2023-3519. It seems that this vulnerability, while also critical, is not the one that is being exploited in the wild by threat actors. We continued our analysis and discovered an endpoint which allowed for remote code execution without the need of any special configurations such as SAML being enabled. This vulnerability matches more closely with the description of the CVE, Citr - **Tags:** #CVE-2023-3519 --- ## [Chaining our way to Pre-Auth RCE in Metabase (CVE-2023-38646)](https://blog.assetnote.io/2023/07/22/pre-auth-rce-metabase/) - **Source:** pentester.land · **Author:** Shubham Shah (@infosec_au), Maxwell Garrett (@TheGrandPew) - **Date:** 2023-07-22 - **Summary:** Target Program: Metabase - **Tags:** #RCE #SQL injection #Security code review #CVE-2023-38646 --- ## [Advisory: Metabase Pre-Auth RCE (CVE-2023-38646)](https://blog.assetnote.io/2023/07/22/advisory-metabase-rce/) - **Source:** blog.assetnote.io - **Date:** 2023-07-21T14:00:00.000Z - **Summary:** Summary An unauthenticated attacker can obtain the setup token for an instance and use it to achieve remote code execution via an endpoint that allows you to validate a H2 database connection. When validating the database, the H2 JDBC driver allows for the attacker to achieve RCE. Impact An attacker can execute arbitrary Java code on the system, leading to arbitrary command execution. Affected Software Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers t - **Tags:** #CVE-2023-38646 --- ## [Analysis of CVE-2023-3519 in Citrix ADC and NetScaler Gateway](https://blog.assetnote.io/2023/07/21/citrix-CVE-2023-3519-analysis/) - **Source:** pentester.land · **Author:** Dylan Pindur, Shubham Shah (@infosec_au) - **Date:** 2023-07-24 - **Summary:** Target Program: Citrix Systems - **Tags:** #RCE #Code injection #SAML #Security code review #CVE-2023-3519 --- ## [EtCesDeveloper/etces.github.io](https://github.com/EtCesDeveloper/etces.github.io) - **Source:** github.com · **Author:** EtCesDeveloper - **Date:** 2026-07-27T13:41:01Z - **Summary:** Personal notes, CTF writeups and pentesting checklists. - **Tags:** #ctf-writeups #cybersecurity #hackthebox #oscp #penetration-testing #tryhackme --- ## [zer0ne-hub/zer0ne-blog](https://github.com/zer0ne-hub/zer0ne-blog) - **Source:** GitHub Repos · **Author:** zer0ne-hub - **Date:** 2026-09-21T20:33:57Z - **Summary:** Another cybersecurity blog - **Tags:** #blog #ctf #ctf-writeups #cyberseclabs #cybersecurity #edemessi #florian #hacking --- ## [arieahXxshrek/secwexen.github.io](https://github.com/arieahXxshrek/secwexen.github.io) - **Source:** GitHub Repos · **Author:** arieahXxshrek - **Date:** 2026-10-14T07:03:05Z - **Summary:** 🛠️ Explore my cybersecurity repository for research, tools, and articles on offensive security and reverse engineering. - **Tags:** #ctf-writeups #cybersecurity #ethical-hacking #exploit-development #github-pages #malware-analysis #network-security #offensive-security --- ## [rashmiranjanp/frida-reversing-lab](https://github.com/rashmiranjanp/frida-reversing-lab) - **Source:** GitHub Repos · **Author:** rashmiranjanp - **Date:** 2026-10-12T04:36:13Z - **Summary:** 🧪 Explore mobile security with Frida Reversing Lab, a toolkit for analyzing and manipulating Android apps to overcome obfuscation and security barriers. - **Tags:** #android-pentesting #android-security #bugbounty-tool #cryptography #ctf #ctf-writeups #dynamic-instrumentation #encryption-decryption --- ## [Oluwanifemithe/ctf-writeups](https://github.com/Oluwanifemithe/ctf-writeups) - **Source:** GitHub Repos · **Author:** Oluwanifemithe - **Date:** 2026-10-13T06:47:34Z - **Summary:** 🚩 Explore CTF writeups and solutions for various cybersecurity challenges across multiple categories, enhancing your skills and knowledge in the field. - **Tags:** #balsn #binary-exploitation #cryptohack #ctf-events #ctf-solutions #ctf-tools #ctf-writeups #cybersecurity --- ## [jorgewgouveia/Cybersecurity-Conferences](https://github.com/jorgewgouveia/Cybersecurity-Conferences) - **Source:** GitHub Repos · **Author:** jorgewgouveia - **Date:** 2026-10-14T07:00:53Z - **Summary:** 🌐 Discover cybersecurity conferences in 2026, easily contributing to a global list. Stay informed and connected in the ever-evolving cybersecurity landscape. - **Tags:** #blackhat #conference-talk #conference-website #conferences #cryptography #ctf-writeups #cyber #defcon --- ## [ayushcsh/advent-of-hacks](https://github.com/ayushcsh/advent-of-hacks) - **Source:** GitHub Repos · **Author:** ayushcsh - **Date:** 2026-10-14T06:57:58Z - **Summary:** 🛡️ Discover and join free cybersecurity events each December to enhance your hacking skills, learn, and compete for exciting prizes. - **Tags:** #advent-of-code #algorithm-challenges #christmas #ctf-challenges #ctf-events #ctf-writeups #cybersecurity #cybersecurity-education --- ## [yuzu697/PROYECTO_Pwn3d](https://github.com/yuzu697/PROYECTO_Pwn3d) - **Source:** GitHub Repos · **Author:** yuzu697 - **Date:** 2026-10-13T06:29:07Z - **Summary:** Plataforma web de CTFs para aprender hacking ético. Incluye retos, login en Python, backend en Java, PostgreSQL, y permite subir writeups y máquinas virtuales. - **Tags:** #ctf #ctf-challenges #ctf-solutions #ctf-writeups #java #page #page-hacker #pages --- ## [jktrn/enscribe.dev](https://github.com/jktrn/enscribe.dev) - **Source:** GitHub Repos · **Author:** jktrn - **Date:** 2026-10-29T02:56:50Z - **Summary:** My personal website, built with Astro, CSS, and love. - **Tags:** #astro #blog #css #ctf-challenges #ctf-writeups #landing #personal-blog #personal-site --- ## [jameskaois/ctf-writeups](https://github.com/jameskaois/ctf-writeups) - **Source:** GitHub Repos · **Author:** jameskaois - **Date:** 2026-10-07T03:15:56Z - **Summary:** CTF write-ups, solutions, and scripts for learning ethical hacking. - **Tags:** #capture-the-flag #ctf #ctf-solutions #ctf-writeups --- ## [nightowl0077/nice-challenge](https://github.com/nightowl0077/nice-challenge) - **Source:** github.com · **Author:** nightowl0077 - **Date:** 2026-07-27T01:49:20Z - **Summary:** A series of walkthroughs and explanations for NICE Challenge Project cybersecurity challenges. - **Tags:** #autopsy #blue-team #ctf #ctf-writeup #ctf-writeups #cybersecurity #cybersecurity-education #dfir #digital-forensics #forensics #incident-response #nice-challenge #nice-challenge-project #security #sleuthkit #soc-analyst #the-sleuth-kit #walkthrough #walkthroughs #writeups --- ## [Denarzai/Denarzai.github.io](https://github.com/Denarzai/Denarzai.github.io) - **Source:** GitHub Repos · **Author:** Denarzai - **Date:** 2026-07-28T23:48:38Z - **Summary:** Personal cybersecurity blog — OverTheWire Bandit walkthroughs, TryHackMe notes, CS50 reflections, and security concept posts. - **Tags:** #blog #ctf-writeups #cybersecurity #jekyll #overthewire-bandit #security-writeups #tryhackme --- ## [Maat-Cyber/Maat-Cyber-World](https://github.com/Maat-Cyber/Maat-Cyber-World) - **Source:** GitHub Repos · **Author:** Maat-Cyber - **Date:** 2026-08-11T22:59:59Z - **Summary:** Collection of useful scripts and Writeups for CTFs made by me 😊 ⬇️Want a better exprience: view it in my gitbooks website ⬇️ - **Tags:** #ctf #ctf-challenges #ctf-tools #ctf-writeups #cybersecurity #cybersecurity-education #guides #hackthebox --- ## [gh11159/ctf-writeups](https://github.com/gh11159/ctf-writeups) - **Source:** github.com · **Author:** gh11159 - **Date:** 2026-07-26T18:16:53Z - **Summary:** OffSec lab and CTF writeups covering enumeration, exploitation, and privilege escalation. - **Tags:** #ctf-writeups #cybersecurity #offsec #penetration-testing --- ## [knox159/ctf-writeups](https://github.com/knox159/ctf-writeups) - **Source:** github.com · **Author:** knox159 - **Date:** 2026-07-26T17:54:42Z - **Summary:** OffSec lab and CTF writeups covering enumeration, exploitation, and privilege escalation. - **Tags:** #ctf-writeups #cybersecurity #offsec #penetration-testing --- ## [arvdch/arvdch.github.io](https://github.com/arvdch/arvdch.github.io) - **Source:** github.com · **Author:** arvdch - **Date:** 2026-07-26T17:20:42Z - **Summary:** my blog: - **Tags:** #about #blog #ctf #ctf-writeups #jekyll #portfolio #portfolio-website #projects --- ## [RameenMughal/TryHackMeWriteups](https://github.com/RameenMughal/TryHackMeWriteups) - **Source:** GitHub Repos · **Author:** RameenMughal - **Date:** 2026-10-24T19:39:07Z - **Summary:** List of free Try Hack Me Rooms with Notes and Writeups for CTFs categorized with Linux, Web Exploitation, Digital Forensics and more for worldwide Cyber Enthusiasts. - **Tags:** #cryptography #ctf-writeups #cybersecurity #forensics #linux #malware-analysis #networking #penetration-testing --- ## [DavideCaldirola/CTF-Writeups](https://github.com/DavideCaldirola/CTF-Writeups) - **Source:** GitHub Repos · **Author:** DavideCaldirola - **Date:** 2026-08-17T18:49:19Z - **Summary:** My CTFs Writeups - **Tags:** #ctf #ctf-challenges #ctf-solutions #ctf-writeups #ctfs --- ## [sckull/sckull.github.io](https://github.com/sckull/sckull.github.io) - **Source:** GitHub Repos · **Author:** sckull - **Date:** 2026-10-25T02:52:39Z - **Summary:** Writeups for TryHackMe and HackTheBox. - **Tags:** #ctf-challenges #ctf-writeups #cybersecuritylabs #espanol #hackthebox #tryhackme --- ## [Tomaselbert2000/TryHackMe-Write-Ups](https://github.com/Tomaselbert2000/TryHackMe-Write-Ups) - **Source:** GitHub Repos · **Author:** Tomaselbert2000 - **Date:** 2026-09-16T14:25:54Z - **Summary:** Recopilación de guías y resolución de máquinas y CTFs - **Tags:** #ctf #ctf-writeups #cybersecurity #ethical-hacking #hacking #tryhackme --- ## [solenefig-lab/Cyber-Ops-Logbook](https://github.com/solenefig-lab/Cyber-Ops-Logbook) - **Source:** GitHub Repos · **Author:** solenefig-lab - **Date:** 2026-09-26T22:22:26Z - **Summary:** French cybersecurity investigations bridging offensive security and Governance, Risk & Compliance (GRC). Technical write-ups covering web, Linux, network security, cryptography and defensive recommendations. Cybersecurity patterns & GRC interpretation - Risk Pattern Overview included - **Tags:** #bash #cryptography #ctf-writeups #cwe #cybersecurity #defensive-security #french-language #grc --- ## [Inv4riant/tryhackme-writeups](https://github.com/Inv4riant/tryhackme-writeups) - **Source:** github.com · **Author:** Inv4riant - **Date:** 2026-07-25T21:59:25Z - **Summary:** Notes and writeups from my progress on TryHackMe. - **Tags:** #ctf-writeups #tryhackme #walkthrough --- ## [qiarhadempta/PicoCTF-Write-Up](https://github.com/qiarhadempta/PicoCTF-Write-Up) - **Source:** GitHub Repos · **Author:** qiarhadempta - **Date:** 2026-08-19T16:17:35Z - **Summary:** PicoCTF write-up that covers up some type of challenges such as: cryptography, forensic, web exploit, reverse engineering, and more! - **Tags:** #cryptography #ctf-writeups #forensics #reverse-engineering #websecurity --- ## [purplestormctf/Writeups](https://github.com/purplestormctf/Writeups) - **Source:** GitHub Repos · **Author:** purplestormctf - **Date:** 2026-10-24T18:07:46Z - **Summary:** purplestorm writeup collection - **Tags:** #capture-the-flag #ctf #ctf-writeups #hack-the-box #htb #htb-writeups #ronin66 #vulnlab --- ## [Egio7/Egio7](https://github.com/Egio7/Egio7) - **Source:** GitHub Repos · **Author:** Egio7 - **Date:** 2026-10-26T14:43:17Z - **Summary:** Cybersecurity portfolio — HTB machine writeups, CVE research, and pentest notes. CJCA certified | CPTS in progress. - **Tags:** #ctf #ctf-writeups #cve #cybersecurity #hackthebox #hackthebox-machine #hackthebox-writeups #htb-writeups --- ## [usevebu3783/awesome-mcp-security](https://github.com/usevebu3783/awesome-mcp-security) - **Source:** GitHub Repos · **Author:** usevebu3783 - **Date:** 2026-10-14T07:16:59Z - **Summary:** Scan and analyze MCP servers to assess AI agent security risks and provide clear safety scores updated daily. - **Tags:** #ai-agents #awesome #bugbounty #bugbountytips #cybers #cybersecurity #exploit #llm --- ## [HieuCoder2025/write0](https://github.com/HieuCoder2025/write0) - **Source:** GitHub Repos · **Author:** HieuCoder2025 - **Date:** 2026-10-13T06:47:55Z - **Summary:** 📝 Create in a distraction-free markdown environment with write0, a lightweight, client-side tool designed for focused writing on the web. - **Tags:** #beta #bugbounty-blogs #bugbounty-writeups #bugbounty-yahoo #bugbountytips #bughunting #bughunting-writeups #distraction-free --- ## [Dallihunter/root-me-web-writeups](https://github.com/Dallihunter/root-me-web-writeups) - **Source:** GitHub Repos · **Author:** Dallihunter - **Date:** 2026-07-05T09:23:34Z - **Summary:** Web security practice through Root-Me challenges, with detailed write-ups. - **Tags:** #api-security #authorization #broken-access-control #ch88 #ctf #idor #owasp-top-10 #pentesting --- ## [blackvoidx/writeup-finder](https://github.com/blackvoidx/writeup-finder) - **Source:** GitHub Repos · **Author:** blackvoidx - **Date:** 2026-10-17T04:57:41Z - **Summary:** A tool to find and save recent writeups from specified URLs, with optional Telegram notifications. - **Tags:** #cyber-security #golang #hashnode #hashnode-blog #medium #medium-writeups #pentesterland #postgresql --- ## [AttAditya/app-sec-write-ups](https://github.com/AttAditya/app-sec-write-ups) - **Source:** GitHub Repos · **Author:** AttAditya - **Date:** 2026-06-29T18:33:59Z - **Summary:** Write-ups for various application security challenges and vulnerabilities - **Tags:** #application-security #coursework #security-writeups #write --- ## [farSec/HTB-WriteUps](https://github.com/farSec/HTB-WriteUps) - **Source:** GitHub Repos · **Author:** farSec - **Date:** 2026-05-29T18:27:58Z - **Summary:** Structured Hack The Box writeups focused on methodology, enumeration, exploitation, privilege escalation, and lessons learned. - **Tags:** #ctf #enumeration #hackthebox #linux #penetration-testing #privilage-escalation #security-writeups #windows --- ## [R0cKy04/ctf-writeups](https://github.com/R0cKy04/ctf-writeups) - **Source:** GitHub Repos · **Author:** R0cKy04 - **Date:** 2026-04-28T08:01:40Z - **Summary:** Dokumentacja z ukończonych pokoi, maszyn, zawodów o tematyce Cyberbezpieczeństwa. - **Tags:** #blue-team #ctf #ctf-writeups #cybersecurity #cybersecurity-education #ethical-hacking #hackthebox #red-team --- ## [Puliczek/awesome-mcp-security](https://github.com/Puliczek/awesome-mcp-security) - **Source:** GitHub Repos · **Author:** Puliczek - **Date:** 2026-10-11T02:56:16Z - **Summary:** 🔥🔒 Awesome MCP (Model Context Protocol) Security 🖥️ - **Tags:** #awesome-list #bugbounty #bugbountytips #cybers #exploit #mcp #mcp-client #mcp-server --- ## [CYB3R-BO1/cyb3r-bo1.github.io](https://github.com/CYB3R-BO1/cyb3r-bo1.github.io) - **Source:** GitHub Repos · **Author:** CYB3R-BO1 - **Date:** 2026-09-09T04:12:01Z - **Summary:** Security Research blog of CYB3R_BO1 - **Tags:** #blog #cyber-security #cybersecurity #security #security-writeups --- ## [albertzsigovits/writeups](https://github.com/albertzsigovits/writeups) - **Source:** GitHub Repos · **Author:** albertzsigovits - **Date:** 2025-10-06T09:09:36Z - **Summary:** Reviews and tests of security products - **Tags:** #security-review #security-reviews #security-writeup #security-writeups --- ## [kh4sh3i/bug-bounty-writeups](https://github.com/kh4sh3i/bug-bounty-writeups) - **Source:** GitHub Repos · **Author:** kh4sh3i - **Date:** 2026-10-21T17:25:17Z - **Summary:** A curated list of available Bug Bounty & Disclosure Programs and Write-ups. - **Tags:** #bugbounty #bugbounty-reports #bugbounty-writeups #bugbountytips #bugbountytricks #security-writeups #writeups --- ## [devanshbatham/Awesome-Bugbounty-Writeups](https://github.com/devanshbatham/Awesome-Bugbounty-Writeups) - **Source:** GitHub Repos · **Author:** devanshbatham - **Date:** 2026-10-29T00:06:40Z - **Summary:** A curated list of bugbounty writeups (Bug type wise) , inspired from https://github.com/ngalongc/bug-bounty-reference - **Tags:** #bugbounty #bugbounty-blogs #bugbounty-facebook #bugbounty-writeups #bugbounty-yahoo #bugbountytips #bughunting #bughunting-methodology --- ## [Puliczek/awesome-list-of-secrets-in-environment-variables](https://github.com/Puliczek/awesome-list-of-secrets-in-environment-variables) - **Source:** GitHub Repos · **Author:** Puliczek - **Date:** 2026-10-28T15:35:11Z - **Summary:** 🦄🔒 Awesome list of secrets in environment variables 🖥️ - **Tags:** #blue-team #bugbounttips #bugbounty #cve-2021-44228 #cybersecurity #exploit #log4j #pentesting --- ## [CVE-2022-0337 System environment variables leak on Google Chrome, Microsoft Edge and Opera](https://github.com/Puliczek/CVE-2022-0337-PoC-Google-Chrome-Microsoft-Edge-Opera) - **Source:** pentester.land · **Author:** Maciej Pulikowski (@pulik_io) · 💰 **Bounty:** 10,000 - **Date:** 2022-03-19 - **Summary:** Target Program: Google, Microsoft, Opera - **Tags:** #Browser hacking #CVE-2022-0337 --- ## [Puliczek/CVE-2021-44228-PoC-log4j-bypass-words](https://github.com/Puliczek/CVE-2021-44228-PoC-log4j-bypass-words) - **Source:** GitHub Repos · **Author:** Puliczek - **Date:** 2026-10-17T02:30:47Z - **Summary:** 🐱‍💻 ✂️ 🤬 CVE-2021-44228 - LOG4J Java exploit - WAF bypass tricks - **Tags:** #bugbounttips #bugbounty #bugbounty-writeups #cve #cve-2021-44228 #cve-2021-45046 #cve-2021-45105 #cybersecurity #CVE-2021-44228 --- ## [Puliczek/CVE-2021-21123-PoC-Google-Chrome](https://github.com/Puliczek/CVE-2021-21123-PoC-Google-Chrome) - **Source:** GitHub Repos · **Author:** Puliczek - **Date:** 2026-09-18T09:59:56Z - **Summary:** 🐱‍💻 👍 Google Chrome - File System Access API - vulnerabilities reported by Maciej Pulikowski | Total Bug Bounty Reward: $5.000 | CVE-2021-21123 and 5 more... - **Tags:** #bugbounty #bugbounty-writeups #bugbountytips #cve #cybersecurity #exploit #hacking #payload #CVE-2021-21123 --- ## [HTB: Fries](https://0xdf.gitlab.io/2026/07/25/htb-fries.html) - **Source:** 0xdf.gitlab.io - **Date:** 2026-07-25T13:45:00.000Z - **Tags:** #security --- ## [HTB: Logging](https://0xdf.gitlab.io/2026/07/18/htb-logging.html) - **Source:** 0xdf.gitlab.io - **Date:** 2026-07-18T13:45:00.000Z - **Tags:** #security --- ## [HTB: Orion](https://0xdf.gitlab.io/2026/07/14/htb-orion.html) - **Source:** 0xdf.gitlab.io - **Date:** 2026-07-14T09:00:00.000Z - **Tags:** #security --- ## [HTB: CCTV](https://0xdf.gitlab.io/2026/07/11/htb-cctv.html) - **Source:** 0xdf.gitlab.io - **Date:** 2026-07-11T13:45:00.000Z - **Tags:** #security --- ## [HTB: Abducted](https://0xdf.gitlab.io/2026/07/07/htb-abducted.html) - **Source:** 0xdf.gitlab.io - **Date:** 2026-07-07T09:00:00.000Z - **Tags:** #security --- ## [HTB: DevArea](https://0xdf.gitlab.io/2026/07/04/htb-devarea.html) - **Source:** 0xdf.gitlab.io - **Date:** 2026-07-04T13:45:00.000Z - **Tags:** #security --- ## [HTB: WingData](https://0xdf.gitlab.io/2026/06/27/htb-wingdata.html) - **Source:** 0xdf.gitlab.io - **Date:** 2026-06-27T13:45:00.000Z - **Tags:** #security --- ## [HTB: NanoCorp](https://0xdf.gitlab.io/2026/06/20/htb-nanocorp.html) - **Source:** 0xdf.gitlab.io - **Date:** 2026-06-20T13:45:00.000Z - **Tags:** #security --- ## [HTB: VariaType](https://0xdf.gitlab.io/2026/06/13/htb-variatype.html) - **Source:** 0xdf.gitlab.io - **Date:** 2026-06-13T13:45:00.000Z - **Tags:** #security --- ## [HTB: Facts](https://0xdf.gitlab.io/2026/06/06/htb-facts.html) - **Source:** 0xdf.gitlab.io - **Date:** 2026-06-06T13:45:00.000Z - **Tags:** #security --- ## [AI Glossary](https://0xdf.gitlab.io/cheatsheets/ai) - **Source:** 0xdf.gitlab.io - **Date:** 2026-06-04T09:00:00.000Z - **Tags:** #security --- ## [HTB: Interpreter](https://0xdf.gitlab.io/2026/05/30/htb-interpreter.html) - **Source:** 0xdf.gitlab.io - **Date:** 2026-05-30T13:45:00.000Z - **Tags:** #security --- ## [HTB: MonitorsFour](https://0xdf.gitlab.io/2026/05/23/htb-monitorsfour.html) - **Source:** 0xdf.gitlab.io - **Date:** 2026-05-23T13:45:00.000Z - **Tags:** #security --- ## [HTB: Pterodactyl](https://0xdf.gitlab.io/2026/05/16/htb-pterodactyl.html) - **Source:** 0xdf.gitlab.io - **Date:** 2026-05-16T13:45:00.000Z - **Tags:** #security --- ## [HTB: Overwatch](https://0xdf.gitlab.io/2026/05/09/htb-overwatch.html) - **Source:** 0xdf.gitlab.io - **Date:** 2026-05-09T13:45:00.000Z - **Tags:** #security --- ## [HTB: Sorcery](https://0xdf.gitlab.io/2026/04/25/htb-sorcery.html) - **Source:** 0xdf.gitlab.io - **Date:** 2026-04-25T13:45:00.000Z - **Tags:** #security --- ## [HTB: AirTouch](https://0xdf.gitlab.io/2026/04/18/htb-airtouch.html) - **Source:** 0xdf.gitlab.io - **Date:** 2026-04-18T13:45:00.000Z - **Tags:** #security --- ## [HTB: Eighteen](https://0xdf.gitlab.io/2026/04/11/htb-eighteen.html) - **Source:** 0xdf.gitlab.io - **Date:** 2026-04-11T13:45:00.000Z - **Tags:** #security --- ## [HTB: DarkZero](https://0xdf.gitlab.io/2026/04/04/htb-darkzero.html) - **Source:** 0xdf.gitlab.io - **Date:** 2026-04-04T13:45:00.000Z - **Tags:** #security --- ## [HTB: Snapped](https://0xdf.gitlab.io/2026/04/01/htb-snapped.html) - **Source:** 0xdf.gitlab.io - **Date:** 2026-04-01T09:00:00.000Z - **Tags:** #security --- ## [HTB: Principal](https://0xdf.gitlab.io/2026/03/30/htb-principal.html) - **Source:** 0xdf.gitlab.io - **Date:** 2026-03-30T09:00:00.000Z - **Tags:** #security --- ## [HTB: Browsed](https://0xdf.gitlab.io/2026/03/28/htb-browsed.html) - **Source:** 0xdf.gitlab.io - **Date:** 2026-03-28T13:45:00.000Z - **Tags:** #security --- ## [HTB: Conversor](https://0xdf.gitlab.io/2026/03/21/htb-conversor.html) - **Source:** 0xdf.gitlab.io - **Date:** 2026-03-21T13:45:00.000Z - **Tags:** #security --- ## [HTB: Gavel](https://0xdf.gitlab.io/2026/03/14/htb-gavel.html) - **Source:** 0xdf.gitlab.io - **Date:** 2026-03-14T09:00:00.000Z - **Tags:** #security --- ## [HTB: Expressway](https://0xdf.gitlab.io/2026/03/07/htb-expressway.html) - **Source:** 0xdf.gitlab.io - **Date:** 2026-03-07T14:45:00.000Z - **Tags:** #security --- ## [HTB: Barrier](https://0xdf.gitlab.io/2026/03/03/htb-barrier.html) - **Source:** 0xdf.gitlab.io - **Date:** 2026-03-03T10:00:00.000Z - **Tags:** #security --- ## [HTB: Guardian](https://0xdf.gitlab.io/2026/02/28/htb-guardian.html) - **Source:** 0xdf.gitlab.io - **Date:** 2026-02-28T14:45:00.000Z - **Tags:** #security --- ## [HTB: Bruno](https://0xdf.gitlab.io/2026/02/24/htb-bruno.html) - **Source:** 0xdf.gitlab.io - **Date:** 2026-02-24T10:00:00.000Z - **Tags:** #security --- ## [HTB: Giveback](https://0xdf.gitlab.io/2026/02/21/htb-giveback.html) - **Source:** 0xdf.gitlab.io - **Date:** 2026-02-21T14:45:00.000Z - **Tags:** #security --- ## [HTB: Soulmate](https://0xdf.gitlab.io/2026/02/14/htb-soulmate.html) - **Source:** 0xdf.gitlab.io - **Date:** 2026-02-14T14:45:00.000Z - **Tags:** #security --- ## [HTB: Slonik](https://0xdf.gitlab.io/2026/02/12/htb-slonik.html) - **Source:** 0xdf.gitlab.io - **Date:** 2026-02-12T10:00:00.000Z - **Tags:** #security --- ## [HTB: Breach](https://0xdf.gitlab.io/2026/02/10/htb-breach.html) - **Source:** 0xdf.gitlab.io - **Date:** 2026-02-10T10:00:00.000Z - **Tags:** #security --- ## [HTB: Signed](https://0xdf.gitlab.io/2026/02/07/htb-signed.html) - **Source:** 0xdf.gitlab.io - **Date:** 2026-02-07T14:45:00.000Z - **Tags:** #security --- ## [HTB: Bamboo](https://0xdf.gitlab.io/2026/02/03/htb-bamboo.html) - **Source:** 0xdf.gitlab.io - **Date:** 2026-02-03T10:00:00.000Z - **Tags:** #security --- ## [HTB: CodeTwo](https://0xdf.gitlab.io/2026/01/31/htb-codetwo.html) - **Source:** 0xdf.gitlab.io - **Date:** 2026-01-31T14:45:00.000Z - **Tags:** #security --- ## [Barbhack 2025 CTF](https://0xdf.gitlab.io/2026/01/29/barbhack-2025-ctf.html) - **Source:** 0xdf.gitlab.io - **Date:** 2026-01-29T10:00:00.000Z - **Tags:** #security --- ## [HTB: JobTwo](https://0xdf.gitlab.io/2026/01/27/htb-jobtwo.html) - **Source:** 0xdf.gitlab.io - **Date:** 2026-01-27T09:00:00.000Z - **Tags:** #security --- ## [HTB: Job](https://0xdf.gitlab.io/2026/01/26/htb-job.html) - **Source:** 0xdf.gitlab.io - **Date:** 2026-01-26T10:00:00.000Z - **Tags:** #security --- ## [HTB: Imagery](https://0xdf.gitlab.io/2026/01/24/htb-imagery.html) - **Source:** 0xdf.gitlab.io - **Date:** 2026-01-24T14:45:00.000Z - **Tags:** #security --- ## [HTB: HackNet](https://0xdf.gitlab.io/2026/01/17/htb-hacknet.html) - **Source:** 0xdf.gitlab.io - **Date:** 2026-01-17T14:45:00.000Z - **Tags:** #security --- ## [HTB: Previous](https://0xdf.gitlab.io/2026/01/10/htb-previous.html) - **Source:** 0xdf.gitlab.io - **Date:** 2026-01-10T14:45:00.000Z - **Tags:** #security --- ## [SANS Holiday Hack Challenge 2025: Revenge of the Gnome(s)](https://0xdf.gitlab.io/holidayhack2025/) - **Source:** 0xdf.gitlab.io - **Date:** 2026-01-05T23:00:00.000Z - **Tags:** #security --- ## [Flagvent 2025](https://0xdf.gitlab.io/flagvent2025/) - **Source:** 0xdf.gitlab.io - **Date:** 2025-12-31T22:00:00.000Z - **Tags:** #security --- ## [HTB: WhiteRabbit](https://0xdf.gitlab.io/2025/12/13/htb-whiterabbit.html) - **Source:** 0xdf.gitlab.io - **Date:** 2025-12-13T14:45:00.000Z - **Tags:** #security --- ## [HTB: Editor](https://0xdf.gitlab.io/2025/12/06/htb-editor.html) - **Source:** 0xdf.gitlab.io - **Date:** 2025-12-06T14:45:00.000Z - **Tags:** #security --- ## [HTB: Era](https://0xdf.gitlab.io/2025/11/29/htb-era.html) - **Source:** 0xdf.gitlab.io - **Date:** 2025-11-29T10:00:00.000Z - **Tags:** #security --- ## [HTB: Mirage](https://0xdf.gitlab.io/2025/11/22/htb-mirage.html) - **Source:** 0xdf.gitlab.io - **Date:** 2025-11-22T14:45:00.000Z - **Tags:** #security --- ## [HTB: Outbound](https://0xdf.gitlab.io/2025/11/15/htb-outbound.html) - **Source:** 0xdf.gitlab.io - **Date:** 2025-11-15T14:45:00.000Z - **Tags:** #security --- ## [HTB: RustyKey](https://0xdf.gitlab.io/2025/11/08/htb-rustykey.html) - **Source:** 0xdf.gitlab.io - **Date:** 2025-11-08T10:00:00.000Z - **Tags:** #security --- ## [HTB: Dump](https://0xdf.gitlab.io/2025/11/04/htb-dump.html) - **Source:** 0xdf.gitlab.io - **Date:** 2025-11-04T10:00:00.000Z - **Tags:** #security --- ## [Oh My Rogue Agent](https://projectdiscovery.io/blog/oh-my-rogue-agent) - **Source:** blog.projectdiscovery.io - **Date:** 2026-07-22T20:37:22.000Z - **Summary:** Yesterday, Hugging Face came out saying they'd detected an AI autonomous-agent-powered cyberattack and that they had to use open-source models to actually investigate and remediate it. Later we heard from OpenAI that their agent was responsible; it happened during an ExploitGym eval, and the agent just drifted off the goal. It escaped the sandbox, reached OpenAI Research Environment, got access to internet, and hacked Hugging Face production environment trying to find the solution for the benchm - **Tags:** #Industry #Research #Neo #AI --- ## [Introducing Internal Network Scanning: see your network the way an attacker inside it would](https://projectdiscovery.io/blog/introducing-internal-network-scanning-see-your-network-the-way-an-attacker-inside-it-would) - **Source:** blog.projectdiscovery.io - **Date:** 2026-07-21T21:48:40.000Z - **Summary:** Most breaches don't begin with a zero-day but with something ordinary like a forgotten server, an unmanaged network device, a service reachable across a segment that was supposed to be isolated. Internal scanning was supposed to catch exactly that but most scanners match a host's banner and version against a CVE list and flag everything potentially affected, so the few reachable exposures sit lost among thousands that were never exploitable. That noise is expensive now that the window to respon - **Tags:** #Vulnerability Management #Scanners --- ## [Community Spotlight: Rishi (@rxerium)](https://projectdiscovery.io/blog/community-spotlight-rishi-rxerium) - **Source:** blog.projectdiscovery.io - **Date:** 2026-07-13T06:12:18.000Z - **Summary:** “Open source isn’t about perfection; it’s about putting an idea forward and improving it together as a community.” Rishi (@rxerium) If you’ve spent any time in the Nuclei Templates repository, you’ve almost certainly run something Rishi engineered. With over 500 templates merged, picked up by the likes of the UK’s National Cyber Security Center (NCSC), California Cybersecurity Integration Center, CERT Polska, Spain’s national security agency, and many others, he’s one of the most prolific con - **Tags:** #security --- ## [The Vulnerability Curve Bent With the AI Curve](https://projectdiscovery.io/blog/the-vulnerability-curve-bent-with-the-ai-curve) - **Source:** blog.projectdiscovery.io - **Date:** 2026-06-18T18:32:03.000Z - **Summary:** How CVE volume, known-exploited counts and time-to-exploit all changed shape across the LLM build-out and why defenders are now on the wrong side of the clock. In 2018 the world published about 18,000 CVEs and the average vulnerability took roughly two months to get exploited after it went public. By 2025 the world was publishing nearly 50,000 CVEs a year and the average vulnerability was being exploited before it was disclosed. Those two facts are the whole story. The number of vulnerabilitie - **Tags:** #security --- ## [Continuous PR Security Review](https://projectdiscovery.io/blog/continuous-pr-security-review) - **Source:** blog.projectdiscovery.io - **Date:** 2026-06-15T16:26:15.000Z - **Summary:** The security findings that end up in incident post-mortems rarely looked dangerous in the PR that introduced them. Not because anyone was careless but because there's nothing in the change that looks wrong. The code does exactly what it says but the problem is in how the app behaves once it's running. A new endpoint ships without a permission check but every other route in the file handles permissions correctly, so nothing about it stands out. Or a response comes back carrying more of a user's - **Tags:** #Neo #Application Security --- ## [How Neo's Agent Architecture Evolved: From One Agent → Plan, Execute & Verify](https://projectdiscovery.io/blog/neo-agent-architecture) - **Source:** blog.projectdiscovery.io - **Date:** 2026-06-01T18:28:00.000Z - **Summary:** Our first engineering post covered prompt caching, the infrastructure change that made long-running agentic tasks economically viable. That post assumed a multi-step, multi-agent system already existed. It did not exist on day one. When we started building Neo, the product was a single agent with a sandbox and a large toolset. Today, a typical task runs through optional planning, an Execution agent that delegates to parallel specialized subagents, and a verification loop that can re-run w - **Tags:** #Neo #Engineering --- ## [Red-Teaming Cloud Infrastructure with Neo](https://projectdiscovery.io/blog/red-teaming-cloud-infrastructure-with-neo) - **Source:** blog.projectdiscovery.io - **Date:** 2026-05-21T12:18:50.000Z - **Summary:** Most AI security tooling shipped over the last year focuses on one of two workflows, code review at PR time or zero-day research in open-source software. Models in PR pipelines now flag insecure patterns at every commit and autonomous research runs have produced more zero-days across open-source projects than the patch teams behind them can realistically triage. We've been running Neo on both of those workflows at ProjectDiscovery for a while now, surfacing zero-days in production software and t - **Tags:** #Neo --- ## [Nuclei Templates - April 2026](https://projectdiscovery.io/blog/nuclei-templates-april-2026) - **Source:** blog.projectdiscovery.io - **Date:** 2026-05-12T11:26:09.000Z - **Summary:** Two releases shipped this cycle - v10.4.2 (April 15) and v10.4.3 (May 5) - delivering deep KEV coverage, a major push into AI/LLM attack surface, fresh Perforce visibility, and broad quality improvements across the template library. 🚀 April Stats Release New Templates CVEs Added First-time Contributors v10.4.2 121 61 15 v10.4.3 105 62 12 Total 226 123 27 * 226 new templates shipped across both releases * 123 CVEs covered, including ~10 actively exploited vulnerabilities - **Tags:** #Nuclei & Templates --- ## [The Trust Gap Behind the AI Coding Boom: What 200 Security Practitioners Just Told Us](https://projectdiscovery.io/blog/the-trust-gap-behind-the-ai-coding-boom-what-200-security-practitioners-just-told-us) - **Source:** blog.projectdiscovery.io - **Date:** 2026-04-28T18:05:58.000Z - **Summary:** New research from ProjectDiscovery surfaces an uncomfortable truth: Engineering has accelerated, and Security has been left to absorb the impact, mostly by hand. If you work in application security right now, you already know the shape of the problem. Pull requests are landing faster than they used to. The diffs are bigger. The author on the commit is increasingly your engineering team's AI assistant, not the engineer themselves. And somewhere downstream, you and a small team are expected to ke - **Tags:** #Research #Application Security --- ## [Benchmarking Neo's Black-Box DAST Capabilities](https://projectdiscovery.io/blog/neo-black-box-dast-capabilities) - **Source:** blog.projectdiscovery.io - **Date:** 2026-04-27T17:11:00.000Z - **Summary:** Since the launch of Neo, we've been steadily expanding what it can do. Neo has found 33+ real CVEs across open-source projects, performed well on white-box security testing where source code is available, and generally proven itself as a capable security engineer when it has context to work with. What we hadn't shared yet is how Neo does when it's operating purely as a black-box DAST agent no source code, no architecture context, just a URL. The prompt Neo gets is a minimal prompt with no guida - **Tags:** #Neo #DAST --- ## [Neo v. DIY: The gap between a single finding and a mature security program](https://projectdiscovery.io/blog/neo-vs-diy) - **Source:** blog.projectdiscovery.io - **Date:** 2026-04-17T19:05:29.000Z - **Summary:** In our latest webinar, our Founding Solutions Engineer, Davis Franklin, addressed the massive gap between finding a vulnerability with an LLM and running a mature security program. That gap is what Neo is built to close. With the release of Opus 4.6 and the announcement of Mythos, the question we hear constantly has gotten louder: Can I just build this with Claude Code? The short answer is yes. You can spin up a working PoC in about half an hour, find a real vulnerability, and feel genuinely co - **Tags:** #Neo #Webinar --- ## [How We Cut LLM Costs by 59% With Prompt Caching](https://projectdiscovery.io/blog/how-we-cut-llm-cost-with-prompt-caching) - **Source:** blog.projectdiscovery.io - **Date:** 2026-04-10T02:42:06.000Z - **Summary:** At ProjectDiscovery, we've been building Neo, an autonomous security testing platform that runs multi-agent, multi-step workflows, routinely executing 20-40+ LLM steps per task. Vulnerability assessments, code reviews, and security audits at scale, enabling continuous testing across the entire development lifecycle. When we launched, our LLM costs were staggering. A single complex task with Opus 4.5 could consume 60 million tokens. Then we implemented prompt caching. Here's what changed: - **Tags:** #Neo #Engineering --- ## [Beyond the Model: Neo Hunts, Exploits, and Proves 22 Zero-Days.](https://projectdiscovery.io/blog/everyone-is-finding-vulns-the-hard-part-is-proving-them) - **Source:** blog.projectdiscovery.io - **Date:** 2026-03-20T16:14:10.000Z - **Summary:** LLMs are a genuine leap forward for vulnerability discovery. Anthropic reported 500+ zero-days from Opus 4.6 and OpenAI's Codex Security discovered 14 CVEs across projects like OpenSSH and GnuTLS. If you've experimented with LLMs for security testing, you've probably been impressed too. The practical reality for a security team deploying AI is messier than the headlines or early POC results suggest. Noise compounds fast. Anthropic brought in external security researchers to help validate the vo - **Tags:** #Neo #Vulnerability Research --- ## [Inside the benchmark: app architectures, walkthroughs of findings, and what each scanner actually caught](https://projectdiscovery.io/blog/inside-the-benchmark-pp-architectures-finding-walkthroughs-and-what-each-scanner-actually-caught) - **Source:** blog.projectdiscovery.io - **Date:** 2026-03-11T16:59:28.000Z - **Summary:** This is Part 2 of our vibe coding security benchmark study. In Part 1, we compared how LLM-based security tools like ProjectDiscovery's Neo and Claude Code performed against traditional SAST and DAST scanners on AI-generated code. We found that LLM-based tools like Neo and Claude Code detected many high-value findings that traditional scanners missed. Between Neo and Claude Code, Neo produced more true positives and fewer false positives because it could validate hypotheses against a running app - **Tags:** #Neo #Vulnerability Research --- ## [How Neo found an SSRF vulnerability in Faraday, and why it matters for every team that ships code](https://projectdiscovery.io/blog/how-neo-found-an-ssrf-vulnerability-in-faraday-and-why-it-matters-for-every-team-that-ships-code) - **Source:** blog.projectdiscovery.io - **Date:** 2026-03-03T17:05:32.000Z - **Summary:** Executive Summary Neo found a Server-Side Request Forgery (SSRF) vulnerability in Faraday, a widely used HTTP client library in the Ruby ecosystem. This is Neo’s first credited CVE discovery. Neo is ProjectDiscovery’s AI security copilot for tasks like code review and vulnerability discovery. For this finding, Neo reviewed a widely used open source dependency and, without human guidance, surfaced a subtle URL-handling edge case, validated it in runtime, and produced a clear write-up that maint - **Tags:** #Vulnerability Research #Neo --- ## [AI code review has come a long way, but it can’t catch everything](https://projectdiscovery.io/blog/ai-code-review-vs-neo) - **Source:** blog.projectdiscovery.io - **Date:** 2026-02-26T22:23:42.000Z - **Summary:** AI code review can reason about intent, but real incidents often stem from business logic flaws that only show up in runtime. Our benchmark reveals where code-only review falls short. - **Tags:** #Neo #Vulnerability Research --- ## [Announcing the ProjectDiscovery OSS Bounty Program](https://projectdiscovery.io/blog/announcing-the-projectdiscovery-oss-bounty-program) - **Source:** blog.projectdiscovery.io - **Date:** 2026-02-02T14:17:38.000Z - **Summary:** Update: OSS Bounty Program Closed The ProjectDiscovery OSS Bounty Program is currently closed. We launched the program to reward meaningful open-source contributions, but over time we saw a growing volume of low-quality and heavily AI-generated submissions that created more review overhead than value for maintainers. For now, we’ve decided to shut down the program. We’re grateful to everyone who contributed thoughtful, high-quality work while it was active. Regular open-source contributions - **Tags:** ##announcement #Community #Bug Bounty ##opensource --- ## [New Report: State of AppSec 2026 | Security at Engineering Speed](https://projectdiscovery.io/blog/new-report-state-of-appsec-2026-security-at-engineering-speed) - **Source:** blog.projectdiscovery.io - **Date:** 2026-01-28T00:46:03.000Z - **Summary:** In 2026, most organizations aren’t shipping “applications” so much as they’re shipping continuous change; across APIs and services, infrastructure and configuration, identity and permissions, feature flags, and AI-assisted code. - **Tags:** #Application Security --- ## [Surfacing the real attack surface: Advances in asset discovery](https://projectdiscovery.io/blog/surfacing-the-real-attack-surface-advances-in-asset-discovery) - **Source:** blog.projectdiscovery.io - **Date:** 2026-01-15T13:01:42.000Z - **Summary:** Introduction Accurate external asset discovery remains a moving target for security teams at scale. What’s actually exposed is hard to pin down, regardless of how many inventories or spreadsheets an organization maintains. Release cycles move faster, new domains and endpoints are added constantly, and the attack surface continues to shift, leaving static processes and visibility tools struggling to keep up. Traditional discovery tools are effective at identifying well-known or easily indexed a - **Tags:** #Attack Surface Management --- ## [Year in Review: The Vulnerabilities That Defined 2025](https://projectdiscovery.io/blog/year-in-review-the-vulnerabilities-that-defined-2025) - **Source:** blog.projectdiscovery.io - **Date:** 2025-12-18T21:29:01.000Z - **Summary:** A Year of Real-World Exploitation If you work in security, you probably remember React2Shell. Shortly after public disclosure, scanning activity increased, and exploitation attempts began to surface. That sequence showed up repeatedly across several of 2025’s most impactful vulnerabilities. Advisories were still circulating while attackers were already testing and operationalizing exploits. This wasn’t true for the thousands of CVEs published quietly throughout the year. But for a smaller set - **Tags:** #security --- ## [gmh5225/awesome-game-security](https://github.com/gmh5225/awesome-game-security) - **Source:** GitHub Repos · **Author:** gmh5225 - **Date:** 2026-10-29T09:40:02Z - **Summary:** awesome game security [Welcome to PR] - **Tags:** #android #anti #anticheat #antidebug #awesome #blockchain #cheat #debug --- ## [hsamnguyen/lastest-update-bounty](https://github.com/hsamnguyen/lastest-update-bounty) - **Source:** GitHub Repos · **Author:** hsamnguyen - **Date:** 2026-10-29T09:02:06Z - **Summary:** GitHub security writeups repository - **Tags:** #security --- ## [kdairatchi/writeups](https://github.com/kdairatchi/writeups) - **Source:** GitHub Repos · **Author:** kdairatchi - **Date:** 2026-10-29T09:49:11Z - **Summary:** This repository updates latest Bug Bounty medium writeups every 10 minutes, https://readmedium.com/Medium_URL, https://archive.ph/Medium_URL, https://freedium.cfd/Medium_URL - **Tags:** #security --- ## [afuckingco/awesome-fuckit](https://github.com/afuckingco/awesome-fuckit) - **Source:** github.com - **Date:** 2026-07-27T15:08:39Z - **Summary:** Knowledge & starter hub for developers - **Tags:** #security --- ## [marksowell/stars](https://github.com/marksowell/stars) - **Source:** GitHub Repos · **Author:** marksowell - **Date:** 2026-10-29T09:40:09Z - **Summary:** A curated list of my GitHub stars! - **Tags:** #security --- ## [marksowell/my-stars](https://github.com/marksowell/my-stars) - **Source:** GitHub Repos · **Author:** marksowell - **Date:** 2026-10-29T09:39:12Z - **Summary:** A curated list of my GitHub stars by stargazed - **Tags:** #starred --- ## [Zaidzyy/HackPit](https://github.com/Zaidzyy/HackPit) - **Source:** GitHub Repos · **Author:** Zaidzyy - **Date:** 2026-08-05T16:34:25Z - **Summary:** GitHub security writeups repository - **Tags:** #security --- ## [Raterfy/rss-to-discord](https://github.com/Raterfy/rss-to-discord) - **Source:** GitHub Repos · **Author:** Raterfy - **Date:** 2026-08-05T14:03:33Z - **Summary:** GitHub security writeups repository - **Tags:** #security --- ## [26zl/cybersec-toolkit](https://github.com/26zl/cybersec-toolkit) - **Source:** GitHub Repos · **Author:** 26zl - **Date:** 2026-10-14T07:47:57Z - **Summary:** One command installs 670+ security tools on Debian/Ubuntu/Kali, Fedora, Arch, openSUSE and Termux. Its authorization-gated MCP server runs them in a disposable Kata Containers VM sandbox for Claude Code, Codex, Gemini CLI, OpenCode and other MCP clients. 872 agent skills for CTF, pentesting, bug bounty, DFIR and red/blue teams. - **Tags:** #agent-skills #ai-agent #blue-team #bug-bounty #claude-code #ctf-tools #cybersecurity #dfir --- ## [GhostX0X/security-writeups](https://github.com/GhostX0X/security-writeups) - **Source:** github.com · **Author:** GhostX0X - **Date:** 2026-08-05T13:41:45Z - **Tags:** #security --- ## [rix4uni/medium-writeups](https://github.com/rix4uni/medium-writeups) - **Source:** GitHub Repos · **Author:** rix4uni - **Date:** 2026-10-27T05:41:06Z - **Summary:** This repository updates latest Bug Bounty medium writeups every 10 minutes, https://readmedium.com/Medium_URL, https://archive.ph/Medium_URL, https://freedium.cfd/Medium_URL - **Tags:** #bug-bounty #bugbounty #bugbountytips #hacking #infosec #osint #osint-resources #osint-tool --- ## [Sivsankardas/cyber-case-files](https://github.com/Sivsankardas/cyber-case-files) - **Source:** github.com - **Date:** 2026-07-27T14:00:04Z - **Tags:** #security --- ## [Bd-Mutant7/Bd-Mutant7](https://github.com/Bd-Mutant7/Bd-Mutant7) - **Source:** GitHub Repos · **Author:** Bd-Mutant7 - **Date:** 2026-08-21T03:13:04Z - **Summary:** Config files for my GitHub profile. - **Tags:** #config #github-config --- ## [un5eeny0t/Cyber-Write-Up-Fetcher](https://github.com/un5eeny0t/Cyber-Write-Up-Fetcher) - **Source:** GitHub Repos · **Author:** un5eeny0t - **Date:** 2026-10-29T07:03:41Z - **Summary:** Feed about Cybersecurity💻 - **Tags:** #security --- ## [bastet-ai/skillz-wiki](https://github.com/bastet-ai/skillz-wiki) - **Source:** GitHub Repos · **Author:** bastet-ai - **Date:** 2026-10-27T08:28:04Z - **Summary:** Bastet TTPs for bug bounty hunting - **Tags:** #security --- ## [lindah177/reconpy](https://github.com/lindah177/reconpy) - **Source:** github.com · **Author:** lindah177 - **Date:** 2026-07-27T13:09:40Z - **Summary:** A command-line Python tool that automates the recon phase of a pentest. - **Tags:** #security --- ## [nomi-sec/PoC-in-GitHub](https://github.com/nomi-sec/PoC-in-GitHub) - **Source:** GitHub Repos · **Author:** nomi-sec - **Date:** 2026-10-29T09:50:14Z - **Summary:** 📡 PoC auto collect from GitHub. ⚠️ Be careful Malware. - **Tags:** #cve #exploit #poc #security #vulnerability --- ## [adshao/flounder](https://github.com/adshao/flounder) - **Source:** GitHub Repos · **Author:** adshao - **Date:** 2026-10-05T20:23:43Z - **Summary:** Autonomous white-hat security auditor for AI-driven code review, bug bounty research, exploit construction, and execution-grounded verification. - **Tags:** #audit #autonomous-agents #bug-bounty #code-audit #evm #exploit-development #security #security-audit --- ## [defronixpro/Defronix-Cybersecurity-Roadmap](https://github.com/defronixpro/Defronix-Cybersecurity-Roadmap) - **Source:** GitHub Repos · **Author:** defronixpro - **Date:** 2026-10-28T08:24:51Z - **Summary:** Welcome Hackers, this is your go-to resource for learning cybersecurity stuff everyday :) - **Tags:** #cybersecurity #defronix #roadmap --- ## [shubham-dev00012/vulnshop](https://github.com/shubham-dev00012/vulnshop) - **Source:** github.com · **Author:** shubham-dev00012 - **Date:** 2026-07-27T12:19:09Z - **Summary:** "Intentionally vulnerable Flask app with security writeup" - **Tags:** #security --- ## [alieneconomist/saas-the-book-of-secret-knowledge](https://github.com/alieneconomist/saas-the-book-of-secret-knowledge) - **Source:** github.com - **Date:** 2026-07-27T11:57:29Z - **Tags:** #security --- ## [adityaax/unique-bugs-chains-and-bypasses](https://github.com/adityaax/unique-bugs-chains-and-bypasses) - **Source:** GitHub Repos · **Author:** adityaax - **Date:** 2026-10-26T07:37:24Z - **Summary:** A living archive of unique vulnerabilities, bypasses & chains reported by researchers. - **Tags:** #bug-bounty #bugs #bypass #chain-bugs #hacking #penetration-testing #unique-bugs #unique-bugs-chains-and-bypasses --- ## [Hemmy1417/Rampart](https://github.com/Hemmy1417/Rampart) - **Source:** github.com - **Date:** 2026-07-27T11:23:19Z - **Tags:** #security --- ## [Malikdishan416/Bug-bounty-writeups](https://github.com/Malikdishan416/Bug-bounty-writeups) - **Source:** GitHub Repos · **Author:** Malikdishan416 - **Date:** 2026-08-18T03:55:58Z - **Summary:** Structured practice: PortSwigger lab writeups only - **Tags:** #security --- ## [hamamelidaecontainerful242/Wa3r-OffSec-Kit](https://github.com/hamamelidaecontainerful242/Wa3r-OffSec-Kit) - **Source:** GitHub Repos · **Author:** hamamelidaecontainerful242 - **Date:** 2026-10-12T09:51:52Z - **Summary:** Deliver practical offensive security techniques, workflows, and case studies based on real-world web and cloud exploitation experience. - **Tags:** #api #classification #data-analysis #datamanipulation #framework #free #language #machine-learning --- ## [0bs1dian-dev/CTF_PenTest_Reports](https://github.com/0bs1dian-dev/CTF_PenTest_Reports) - **Source:** github.com · **Author:** 0bs1dian-dev - **Date:** 2026-07-27T15:20:20Z - **Summary:** Portfolio of my Pen-Test reports on various CTF machines - **Tags:** #security --- ## [NoelNac-HackEthical/hugo-writeups](https://github.com/NoelNac-HackEthical/hugo-writeups) - **Source:** GitHub Repos · **Author:** NoelNac-HackEthical - **Date:** 2026-09-24T08:21:51Z - **Summary:** Sources du site writeups.hackethical.be — writeups Hack The Box en français - **Tags:** #hackthebox-ctf-writeups-cybersecurity-hugo-linux --- ## [ZygraXe/Security-Portfolio](https://github.com/ZygraXe/Security-Portfolio) - **Source:** github.com · **Author:** ZygraXe - **Date:** 2026-07-27T14:41:20Z - **Tags:** #security --- ## [0xDeadcell/exploit-development-roadmap](https://github.com/0xDeadcell/exploit-development-roadmap) - **Source:** github.com - **Date:** 2026-07-27T14:15:21Z - **Tags:** #security --- ## [212-del/THM](https://github.com/212-del/THM) - **Source:** github.com - **Date:** 2026-07-27T14:12:23Z - **Summary:** This is repo where you will find lookups of different rooms of tryhackme. - **Tags:** #security --- ## [GodderE2D/GodderE2D](https://github.com/GodderE2D/GodderE2D) - **Source:** GitHub Repos · **Author:** GodderE2D - **Date:** 2026-10-25T06:15:22Z - **Summary:** Welcome to my GitHub profile! - **Tags:** #security --- ## [Encod3d-Sec/ClaudeBrain](https://github.com/Encod3d-Sec/ClaudeBrain) - **Source:** github.com · **Author:** Encod3d-Sec - **Date:** 2026-07-27T13:44:50Z - **Summary:** Karpathy LLM based claude harness for PenetrationTesting / Bugbounty using obsidian - **Tags:** #security --- ## [Sudeep72/100-days-cybersecurity](https://github.com/Sudeep72/100-days-cybersecurity) - **Source:** github.com · **Author:** Sudeep72 - **Date:** 2026-07-27T13:44:13Z - **Tags:** #security --- ## [blueorionn/juice-shop-ctf](https://github.com/blueorionn/juice-shop-ctf) - **Source:** github.com · **Author:** blueorionn - **Date:** 2026-07-27T13:40:07Z - **Summary:** This repository contains solutions and walkthroughs for the OWASP Juice Shop vulnerable application. - **Tags:** #ctf #juice-shop #owasp --- ## [Noxiidus/Noxiidus](https://github.com/Noxiidus/Noxiidus) - **Source:** github.com - **Date:** 2026-07-27T13:32:15Z - **Tags:** #security --- ## [coleisaac44/rootglyph-web-security-hub](https://github.com/coleisaac44/rootglyph-web-security-hub) - **Source:** GitHub Repos · **Author:** coleisaac44 - **Date:** 2026-08-13T04:11:20Z - **Summary:** R00tGlyph v2.0 is a browser-based CTF and security training platform focused on hands-on learning, with challenge-led practice, team collaboration, and a more structured learning path. - **Tags:** #security --- ## [mytechnotalent/Reverse-Engineering](https://github.com/mytechnotalent/Reverse-Engineering) - **Source:** GitHub Repos · **Author:** mytechnotalent - **Date:** 2026-08-28T14:10:22Z - **Summary:** A FREE comprehensive reverse engineering tutorial covering x86, x64, 32-bit/64-bit ARM, 8-bit AVR and 32-bit RISC-V architectures. - **Tags:** #arm #assembly #assembly-language #assembly-language-programming #avr #c #c-plus-plus #cyber-security --- ## [ZakhwanAnuar/zakhwananuar.github.io](https://github.com/ZakhwanAnuar/zakhwananuar.github.io) - **Source:** github.com - **Date:** 2026-07-27T13:14:21Z - **Tags:** #security --- ## [anurag-rvnkr1/Security-Knowledge-Base](https://github.com/anurag-rvnkr1/Security-Knowledge-Base) - **Source:** GitHub Repos · **Author:** anurag-rvnkr1 - **Date:** 2026-10-06T10:08:50Z - **Summary:** Most students upload scattered notes; recruiters are much more impressed by a structured knowledge base that demonstrates consistent learning and technical communication. - **Tags:** #security --- ## [nisa897/Thm-Writeups](https://github.com/nisa897/Thm-Writeups) - **Source:** github.com · **Author:** nisa897 - **Date:** 2026-07-27T13:04:46Z - **Summary:** My TryHackMe room walkthroughs, CTF solutions, and cybersecurity lab notes. - **Tags:** #security --- ## [lewisjava/soc-portfolio](https://github.com/lewisjava/soc-portfolio) - **Source:** github.com - **Date:** 2026-07-27T12:57:22Z - **Summary:** Portfolio site - **Tags:** #security --- ## [Chat2AnyLLM/awesome-claude-skills](https://github.com/Chat2AnyLLM/awesome-claude-skills) - **Source:** GitHub Repos · **Author:** Chat2AnyLLM - **Date:** 2026-10-28T07:40:14Z - **Summary:** A curated list of awesome claude skills - **Tags:** #claude #claude-code #skills --- ## [Incentives01/wallbreaker](https://github.com/Incentives01/wallbreaker) - **Source:** github.com - **Date:** 2026-07-27T12:44:04Z - **Tags:** #security --- ## [the911fund/skill-of-skills](https://github.com/the911fund/skill-of-skills) - **Source:** GitHub Repos · **Author:** the911fund - **Date:** 2026-10-29T09:25:09Z - **Summary:** The quality-ranked discovery engine for AI coding skills, plugins and MCP servers across Claude Code, Codex, Cursor, Windsurf, Cline and more. - **Tags:** #agent-skills #ai-agents #ai-tools #automation #claude-code #claude-skills #codex #discovery-engine --- ## [GautamSB/OWASP-Juice-Shop-Web-Security-Lab](https://github.com/GautamSB/OWASP-Juice-Shop-Web-Security-Lab) - **Source:** github.com - **Date:** 2026-07-27T15:24:05Z - **Summary:** A practical web application security assessment lab using Burp Suite Community Edition and OWASP Juice Shop to analyze HTTP requests, responses, cookies, sessions, and application behavior. - **Tags:** #security --- ## [TonyB1973/-ManufacturingFlowDesigner](https://github.com/TonyB1973/-ManufacturingFlowDesigner) - **Source:** github.com - **Date:** 2026-07-27T15:23:06Z - **Summary:** ManufacturingFlowDesigner - **Tags:** #security --- ## [TX-9AI/options_trader_v3](https://github.com/TX-9AI/options_trader_v3) - **Source:** github.com - **Date:** 2026-07-27T15:22:43Z - **Summary:** Autonomous Regime Aware Trading Bot with Telegram Notifications - **Tags:** #security --- ## [RafaelAlbaWebify/veridra](https://github.com/RafaelAlbaWebify/veridra) - **Source:** GitHub Repos · **Author:** RafaelAlbaWebify - **Date:** 2026-10-02T09:41:13Z - **Summary:** Automated website assessment for visibility, AI discoverability, trust signals, technical health, and public security posture. - **Tags:** #security --- ## [a781780889-rgb/civil-suite-pm](https://github.com/a781780889-rgb/civil-suite-pm) - **Source:** github.com - **Date:** 2026-07-27T15:21:32Z - **Tags:** #security --- ## [oshjain/brisk-aitesting](https://github.com/oshjain/brisk-aitesting) - **Source:** github.com - **Date:** 2026-07-27T15:21:11Z - **Summary:** tell ai what to test in your product or saas - **Tags:** #security --- ## [limuran117-coder/Scenic-Area-Marketing-CN](https://github.com/limuran117-coder/Scenic-Area-Marketing-CN) - **Source:** GitHub Repos · **Author:** limuran117-coder - **Date:** 2026-10-26T08:45:54Z - **Summary:** AI-Powered Omnichannel Marketing & Operation System for Scenic Areas | Data-Driven • Knowledge Curation • Process Automation - **Tags:** #ai-agent #douyin #playwright #scenic-area-marketing #tourism-analytics #xiaohongshu --- ## [BoykoNeov/armor_pen](https://github.com/BoykoNeov/armor_pen) - **Source:** github.com - **Date:** 2026-07-27T15:20:36Z - **Summary:** 2D offline terminal-ballistics simulation (MLS-MPM solver + Godot viewer). Educational/game-grade, public-domain physics. - **Tags:** #security --- ## [khushigulati191-ui/cybershieldAI](https://github.com/khushigulati191-ui/cybershieldAI) - **Source:** github.com - **Date:** 2026-07-27T15:20:29Z - **Summary:** Website and App Security and Privacy Analyzer - **Tags:** #security --- ## [zapplyjobs/New-Grad-Jobs-2027](https://github.com/zapplyjobs/New-Grad-Jobs-2027) - **Source:** GitHub Repos · **Author:** zapplyjobs - **Date:** 2026-10-26T08:48:24Z - **Summary:** 2027 entry-level jobs in tech, finance, healthcare & more — new grad US roles across software, business, operations & beyond - **Tags:** #2027 #applications #college #early-career #fulltime #hiring #intern #interviews --- ## [CamLee27/owasp-juice-shop-ethical-hacking-lab](https://github.com/CamLee27/owasp-juice-shop-ethical-hacking-lab) - **Source:** github.com - **Date:** 2026-07-27T15:19:21Z - **Summary:** Time-boxed ethical hacking course assessment of OWASP Juice Shop covering prompt manipulation, cross-site scripting, injection attempts, directory discovery, and traffic-flood testing. - **Tags:** #college-project #cybersecurity #ethical-hacking #hacking #kali-linux #owasp-juice-shop #security-testing #web-security #xss --- ## [praetorian-inc/vespasian](https://github.com/praetorian-inc/vespasian) - **Source:** github.com - **Date:** 2026-07-27T15:19:21Z - **Summary:** API discovery tool that maps attack surfaces from captured traffic and generates specs for REST, GraphQL, SOAP, and WebSocket APIs - **Tags:** #api-discovery #api-enumeration #api-security #api-specification #application-security #attack-surface #burp-suite #capability #golang #graphql #headless-browser #openapi #openapi-generator #penetration-testing #security-tools #soap #traffic-analysis #wsdl --- ## [premwizard/AI-Job-Finder](https://github.com/premwizard/AI-Job-Finder) - **Source:** github.com - **Date:** 2026-07-27T15:18:57Z - **Summary:** An automated job finder and career management platform that searches for AI/ML/Software Engineering roles across various job boards (Wellfound, Greenhouse, Lever) and provides intelligent AI-powered resume and profile tools. - **Tags:** #security --- ## [Lumbridge/UnifyEMPI](https://github.com/Lumbridge/UnifyEMPI) - **Source:** github.com - **Date:** 2026-07-27T15:18:49Z - **Summary:** UnifyEMPI: high-performance, multi-tenant enterprise master patient index for FHIR R4 and HL7v2, with explainable matching, governed review and pluggable storage. - **Tags:** #blazor #csharp #dotnet #dotnet-10 #fhir #fhir-r4 #gcp #google-cloud #healthcare #healthcare-interoperability #hl7v2 #master-patient-index #mpi #nhs #openid-connect #patient-matching --- ## [sanjaygaire/brukal](https://github.com/sanjaygaire/brukal) - **Source:** github.com - **Date:** 2026-07-27T15:18:17Z - **Summary:** A Trust-Governed Multi-Agent Pentest Architecture - **Tags:** #security --- ## [mac3d0/mac3d0](https://github.com/mac3d0/mac3d0) - **Source:** github.com - **Date:** 2026-07-27T15:18:08Z - **Summary:** Rafael Macedo, offensive security e pentest. Brecha, Rio de Janeiro. - **Tags:** #github-config #profile-readme --- ## [HORKimhab/awesome-cybersecurity-resources](https://github.com/HORKimhab/awesome-cybersecurity-resources) - **Source:** GitHub Repos · **Author:** HORKimhab - **Date:** 2026-08-29T09:10:11Z - **Summary:** Awesome Cybersecurity Resources - **Tags:** #security --- ## [gadievron/raptor](https://github.com/gadievron/raptor) - **Source:** github.com - **Date:** 2026-07-27T15:17:39Z - **Summary:** Raptor turns Claude Code into a general-purpose AI offensive/defensive security agent. By using Claude.md and creating rules, sub-agents, and skills, and orchestrating security tool usage, we configure the agent for adversarial thinking, and perform research or attack/defense operations. - **Tags:** #security --- ## [aaravmahajanofficial/forensic-ledger-guardian](https://github.com/aaravmahajanofficial/forensic-ledger-guardian) - **Source:** GitHub Repos · **Author:** aaravmahajanofficial - **Date:** 2026-10-14T08:37:16Z - **Summary:** Capstone Project 2026 - **Tags:** #security --- ## [madugundunanda-ui/Sentinel](https://github.com/madugundunanda-ui/Sentinel) - **Source:** github.com - **Date:** 2026-07-27T15:17:18Z - **Tags:** #security --- ## [434308421/github-stars](https://github.com/434308421/github-stars) - **Source:** github.com - **Date:** 2026-07-27T15:16:36Z - **Summary:** github-stars - **Tags:** #security --- ## [Stux6-BlackArch/BlackArch-Linux](https://github.com/Stux6-BlackArch/BlackArch-Linux) - **Source:** github.com - **Date:** 2026-07-27T15:16:31Z - **Summary:** Custom BlackArch ISO & environment configurations featuring built-in I2P tunneling, isolated testing network profiles, and kernel-level pentest tooling. - **Tags:** #archlinux #blackarch #blackarch-linux #blackarch-linux-features #blackarch-linux-setup #blackarch-packages #blackarch-setup #i2p #i2p-client #i2p-network #i2p-router --- ## [surya-koritala/AIagentOS](https://github.com/surya-koritala/AIagentOS) - **Source:** github.com - **Date:** 2026-07-27T15:16:23Z - **Summary:** An operating system kernel for AI agents — process management, scheduling, isolation, IPC, and security. Like Linux, but for autonomous AI agents. - **Tags:** #agent-runtime #ai-agents #kernel #llm #multi-agent #operating-system #rust --- ## [ViCrack/scoop-bucket](https://github.com/ViCrack/scoop-bucket) - **Source:** GitHub Repos · **Author:** ViCrack - **Date:** 2026-10-27T08:01:47Z - **Summary:** The free bucket for Scoop - **Tags:** #package-manager #scoop #scoop-apps #scoop-bucket #scoop-buckets --- ## [Automattic/jetpack](https://github.com/Automattic/jetpack) - **Source:** GitHub Repos · **Author:** Automattic - **Date:** 2026-10-29T09:48:38Z - **Summary:** Security, performance, marketing, and design tools — Jetpack is made by WordPress experts to make WP sites safer and faster, and help you grow your traffic. - **Tags:** #hacktoberfest #js #php #plugin #react #wordpress #wordpress-plugin --- ## [marcelscruz/public-apis](https://github.com/marcelscruz/public-apis) - **Source:** GitHub Repos · **Author:** marcelscruz - **Date:** 2026-10-22T07:39:55Z - **Summary:** A collaborative list of public APIs for developers - **Tags:** #apis #awesome #awesome-list #hacktoberfest #lists #open-source #public-api #public-apis --- ## [SpiralCloudOmega/DevTeam6](https://github.com/SpiralCloudOmega/DevTeam6) - **Source:** GitHub Repos · **Author:** SpiralCloudOmega - **Date:** 2026-10-29T09:13:00Z - **Summary:** AI Dev Studio - **Tags:** #security --- ## [archestra-ai/archestra](https://github.com/archestra-ai/archestra) - **Source:** GitHub Repos · **Author:** archestra-ai - **Date:** 2026-10-29T09:43:56Z - **Summary:** Enterprise AI Platform with guardrails, MCP registry, gateway & orchestrator - **Tags:** #a2a #a2a-mcp #acp #agent #ai #chatgpt #chatgpt-api #claude --- ## [johe123qwe/github-trending](https://github.com/johe123qwe/github-trending) - **Source:** github.com - **Date:** 2026-07-27T14:42:39Z - **Summary:** 定时抓取 Github Trending - **Tags:** #security --- ## [thedaviddias/llms-txt-hub](https://github.com/thedaviddias/llms-txt-hub) - **Source:** github.com - **Date:** 2026-07-27T14:40:20Z - **Summary:** 🤖 The largest directory for AI-ready documentation and tools implementing the proposed llms.txt standard - **Tags:** #cursor #cursor-ai #directory #llms #llms-txt #llmstxt #nextjs #robots-txt #supabase #supabase-auth #taiwindcss --- ## [sifted-network/sifted-awesome-ai-agents](https://github.com/sifted-network/sifted-awesome-ai-agents) - **Source:** github.com - **Date:** 2026-07-27T14:39:11Z - **Summary:** 🔥 Auto-updated A curated list of the most starred AI agent-related repositories on GitHub. - **Tags:** #ai #aiagents #llm --- ## [yks0000/starred-repo-toc](https://github.com/yks0000/starred-repo-toc) - **Source:** github.com - **Date:** 2026-07-27T14:31:13Z - **Summary:** Generates Markdown table for all Starred Repositories by a GitHub user. - **Tags:** #starred #starred-repositories --- ## [eXLu51ve-gjj/eXLu51ve-gjj](https://github.com/eXLu51ve-gjj/eXLu51ve-gjj) - **Source:** github.com - **Date:** 2026-07-27T14:29:49Z - **Tags:** #security --- ## [Scottcjn/rustchain-bounties](https://github.com/Scottcjn/rustchain-bounties) - **Source:** GitHub Repos · **Author:** Scottcjn - **Date:** 2026-08-28T14:58:03Z - **Summary:** Earn RTC crypto by contributing to the RustChain ecosystem. Bounties from 1-150 RTC. Star, code, write tutorials, find bugs. - **Tags:** #ai-agents #blockchain #bounties #bug-bounty #community #contributions #cryptocurrency #earn-crypto --- ## [XD3an/awesome-cybersecurity-all-in-one](https://github.com/XD3an/awesome-cybersecurity-all-in-one) - **Source:** github.com · **Author:** XD3an - **Date:** 2026-08-05T14:19:30Z - **Summary:** A comprehensive collection of cybersecurity resources, tools, frameworks, and educational materials. This repository serves as a one-stop resource for security professionals, researchers, penetration testers, and anyone interested in cybersecurity. - **Tags:** #security --- ## [0xsyr0/Awesome-Cybersecurity-Handbooks](https://github.com/0xsyr0/Awesome-Cybersecurity-Handbooks) - **Source:** GitHub Repos · **Author:** 0xsyr0 - **Date:** 2026-10-22T07:38:06Z - **Summary:** A huge chunk of my personal notes since I started playing CTFs and working as a Red Teamer. - **Tags:** #blue-teaming #capture-the-flag #ctf #cybersecurity #defensive-security #handbooks #infosec #offensive --- ## [superiorlu/AITreasureBox](https://github.com/superiorlu/AITreasureBox) - **Source:** GitHub Repos · **Author:** superiorlu - **Date:** 2026-10-27T08:45:45Z - **Summary:** 🤖 Automatically collected AI repos, tools, websites, papers & tutorials. 实用AI百宝箱 💎 - **Tags:** #agentic #agi #ai #ai-gents #ai-prompts #ai-tools #alpaca #awesome-list --- ## [karim-abdul-rehan/karim-abdul-rehan](https://github.com/karim-abdul-rehan/karim-abdul-rehan) - **Source:** github.com - **Date:** 2026-07-27T13:12:02Z - **Summary:** About Karim Abdul Rehan - **Tags:** #security --- ## [ahmet/awesome-web3](https://github.com/ahmet/awesome-web3) - **Source:** github.com - **Date:** 2026-07-27T12:57:56Z - **Summary:** A curated list of awesome Web3 resources, libraries, tools and more. - **Tags:** #awesome #awesome-list #blockchain #ethereum #smart-contracts #solidity #web3 --- ## [bat123121567890-cmd/rustchain-bounties](https://github.com/bat123121567890-cmd/rustchain-bounties) - **Source:** GitHub Repos · **Author:** bat123121567890-cmd - **Date:** 2026-08-05T17:14:24Z - **Summary:** Fork of Scottcjn/rustchain-bounties - **Tags:** #security --- ## [HackTricks-wiki/hacktricks](https://github.com/HackTricks-wiki/hacktricks) - **Source:** GitHub Repos · **Author:** HackTricks-wiki - **Date:** 2026-08-09T04:23:01Z - **Summary:** Welcome to the page where you will find each trick/technique/whatever I have learnt in CTFs, real life apps, and reading researches and news. - **Tags:** #hacking #hacktricks #peass #pentesting --- ## [jbshouca/Cybersecurity](https://github.com/jbshouca/Cybersecurity) - **Source:** github.com · **Author:** jbshouca - **Date:** 2026-07-27T15:23:18Z - **Summary:** Holistic cybersecurity repository for career preparation. Including but not limited to concepts such as Linux Fundamentals, Networking Basics, Python, Windows Administration, and Firewalls. - **Tags:** #security --- ## [StrongWind1/NFSWolf](https://github.com/StrongWind1/NFSWolf) - **Source:** GitHub Repos · **Author:** StrongWind1 - **Date:** 2026-08-14T04:52:11Z - **Summary:** Fast native NFS security toolkit - recon, enumeration, exploitation, and interactive shell over NFSv2/v3/v4 - **Tags:** #exploitation #nfs #nfsv3 #nfsv4 #penetration-testing #red-team #rust #scanner --- ## [FirstEverTech/Universal-Intel-Chipset-Updater](https://github.com/FirstEverTech/Universal-Intel-Chipset-Updater) - **Source:** GitHub Repos · **Author:** FirstEverTech - **Date:** 2026-08-22T03:49:57Z - **Summary:** Security-focused tool for automatic Intel chipset INF detection and installation. SHA-256 verified, Intel Authenticode validated, System Restore Point protected. Reviewed across 3 audit cycles by 6 AI systems. - **Tags:** #automatic #automation #chipset #driver-updater #hardware #inf #inf-installer #intel --- ## [Shashi552/pentester-bot](https://github.com/Shashi552/pentester-bot) - **Source:** GitHub Repos · **Author:** Shashi552 - **Date:** 2026-08-31T09:40:42Z - **Summary:** GitHub security writeups repository - **Tags:** #security --- ## [jaalso/cybersecurity-portfolio](https://github.com/jaalso/cybersecurity-portfolio) - **Source:** github.com · **Author:** jaalso - **Date:** 2026-07-27T15:44:21Z - **Summary:** Cyber Portafolio · Ethical Hacking · Red Team · Blue Team · Thread Hunting · Web Security · Python · Memory Forensics - **Tags:** #blue-team #cybersecurity #ethical-hacking #kali-linux #metasploit #pentesting #red-team --- ## [Rodryguezs/havij-120-cli-utility](https://github.com/Rodryguezs/havij-120-cli-utility) - **Source:** GitHub Repos · **Author:** Rodryguezs - **Date:** 2026-09-11T07:53:47Z - **Summary:** Havij 2026 Injection Kit: Advanced SQLi Security Suite - **Tags:** #havij #havij-download #havij-install #havij-key #havij-software #havij-trial --- ## [glenjr009/cybersecurity-internship](https://github.com/glenjr009/cybersecurity-internship) - **Source:** github.com · **Author:** glenjr009 - **Date:** 2026-07-27T15:40:06Z - **Summary:** Daily documentation, hands-on labs, assignments, and technical notes from my 1-month Cybersecurity Internship at Thunder Cipher. - **Tags:** #security --- ## [cyb3rxp/awesome-soc](https://github.com/cyb3rxp/awesome-soc) - **Source:** GitHub Repos · **Author:** cyb3rxp - **Date:** 2026-10-19T08:46:59Z - **Summary:** A curated knowledge base to build, run and mature a SOC (including CSIRT). - **Tags:** #architecture #cert #csirt #cybersecurity #detection-engineering #dfir #incident-response #mitre-attack --- ## [muhammadsarfrazchandia/quillshield-audit-engine](https://github.com/muhammadsarfrazchandia/quillshield-audit-engine) - **Source:** GitHub Repos · **Author:** muhammadsarfrazchandia - **Date:** 2026-09-18T08:09:11Z - **Summary:** QuillShield AI v2026: Smart Contract Audit Automation & Exploit Simulation - **Tags:** #claude-plugin #defi-security #skills #solidity-audit --- ## [Publisher: TryHackMe CTF Walkthrough](https://infosecwriteups.com/publisher-tryhackme-ctf-walkthrough-cc97c9506153?source=rss----7b722bfd1b8d---4) - **Source:** infosecwriteups.com · **Author:** Huzaifa Malik - **Date:** 2026-07-29T07:33:15.000Z - **Tags:** #ctf-writeup #penetration-testing #web-security #tryhackme #privilege-escalation --- ## [TryHackMe: Room 404 Walkthrough (Hacker’s Holiday Challenge)](https://infosecwriteups.com/tryhackme-room-404-walkthrough-hackers-holiday-challenge-f4f9a2b530e8?source=rss----7b722bfd1b8d---4) - **Source:** infosecwriteups.com · **Author:** Hibullahi AbdulAzeez - **Date:** 2026-07-29T07:32:27.000Z - **Tags:** #ctf-walkthrough #tryhackme-walkthrough #room-404 #tryhackme #webchallenge --- ## [How I Found a High-Severity Directory Traversal in Flask-Admin](https://infosecwriteups.com/how-i-found-a-high-severity-directory-traversal-in-flask-admin-d3b99b4bec1d?source=rss----7b722bfd1b8d---4) - **Source:** infosecwriteups.com · **Author:** Aruvasaga chithan A - **Date:** 2026-07-29T07:32:08.000Z - **Tags:** #cybersecurity #flask #web-security #ethical-hacking #infosec --- ## [The Most Overlooked Vulnerability — Http request Smuggling](https://infosecwriteups.com/the-most-overlooked-vulnerability-http-request-smuggling-0eeec415a0fb?source=rss----7b722bfd1b8d---4) - **Source:** infosecwriteups.com · **Author:** Kuldeep Choudhary - **Date:** 2026-07-29T07:29:25.000Z - **Tags:** #cyberattack #exploitation #vulnerability #http-request-smuggling #cybersecurity --- ## [Snowflake SQL Injection via Compile-Time Constant Folding with SYSTEM$WAIT](https://infosecwriteups.com/snowflake-sql-injection-via-compile-time-constant-folding-with-system-wait-81374a58e089?source=rss----7b722bfd1b8d---4) - **Source:** infosecwriteups.com · **Author:** Alvin Ferdiansyah - **Date:** 2026-07-29T07:28:59.000Z - **Tags:** #snowflake #bug-bounty #bug-bounty-writeup #bug-bounty-tips #sql-injection --- ## [How I Hacked a Video Game Vault and Found the Hidden Flag](https://infosecwriteups.com/how-i-hacked-a-video-game-vault-and-found-the-hidden-flag-924fc1a47053?source=rss----7b722bfd1b8d---4) - **Source:** infosecwriteups.com · **Author:** Lucifer0xf - **Date:** 2026-07-29T07:28:36.000Z - **Summary:** A beginner-friendly walkthrough of the TryHackMe “Grand Larceny Auto” reverse-engineering challenge Continue reading on InfoSec Write-ups » - **Tags:** #tryhackme #osint #ctf #cybersecurity #ethical-hacking --- ## [Static Malware Analysis of Suspicious Windows PE Samples: A Blue Team Investigation](https://infosecwriteups.com/static-malware-analysis-of-suspicious-windows-pe-samples-a-blue-team-investigation-6c1e1b178513?source=rss----7b722bfd1b8d---4) - **Source:** infosecwriteups.com · **Author:** Allen Ace - **Date:** 2026-07-29T07:17:10.000Z - **Tags:** #dfir #blue-team #malware-analysis #threat-intelligence #cybersecurity --- ## [Account Takeover Across Multiple Programs via Featurebase Integration](https://infosecwriteups.com/account-takeover-across-multiple-programs-via-featurebase-integration-32214666123e?source=rss----7b722bfd1b8d---4) - **Source:** infosecwriteups.com · **Author:** JEETPAL - **Date:** 2026-07-29T07:16:59.000Z - **Tags:** #bug-bounty-writeup #bug-bounty #bugbounty-writeup #bug-bounty-tips #account-takeover --- ## [How I found an IDOR in Google Classroom on Day 3 of my Hunting?](https://infosecwriteups.com/how-i-found-an-idor-in-google-classroom-on-day-3-of-my-hunting-abffd039406c?source=rss----7b722bfd1b8d---4) - **Source:** infosecwriteups.com · **Author:** Marrij Ali Khan - **Date:** 2026-07-28T08:56:56.000Z - **Tags:** #bug-bounty-writeup #bug-bounty #google #idor #infosec-write-ups --- ## [TryHackMe(RootMe)- Write-Up](https://infosecwriteups.com/author-krish-gupta-f5b8bf96f1ba?source=rss----7b722bfd1b8d---4) - **Source:** infosecwriteups.com · **Author:** Krish Gupta - **Date:** 2026-07-28T07:56:04.000Z - **Tags:** #tryhackme-rootme #websecurity-testing #suid-bit #tryhackme-walkthrough #cybersecurity --- ## [Towel on the Sunbed — TryHackMe Walkthrough | Race Condition Exploitation](https://medium.com/@es0557533/race-condition-claiming-the-same-sunbed-more-than-once-b429a093ce05?source=rss------bugbounty_writeup-5) - **Source:** medium.com/tag/bugbounty-writeup · **Author:** Isv0x1 - **Date:** 2026-08-04T18:41:33.000Z - **Summary:** Link : TryHackMe | Towel on the Sunbed Continue reading on Medium » - **Tags:** #web-exploitation #bugbounty-writeup #ctf #infosec #business-logic --- ## [DorkinatorAI: a calmer way to start recon using AI](https://osintteam.blog/dorkinatorai-a-calmer-way-to-start-recon-using-ai-42db2b4e956c?source=rss------bugbounty_writeup-5) - **Source:** medium.com/tag/bugbounty-writeup · **Author:** Devansh Patel - **Date:** 2026-08-02T22:05:11.000Z - **Summary:** A practical introduction to building a repeatable search-query workflow for bug bounty and security testing. Continue reading on OSINT Team » - **Tags:** #bug-bounty-hunter #bug-bounty-tips #cybersecurity #bugbounty-writeup #bug-bounty --- ## [Bypassing Account Sign-up Restrictions with a Unicode Character](https://dukrov.medium.com/bypassing-account-sign-up-restrictions-with-a-unicode-character-760d9fb6a313?source=rss------bugbounty_writeup-5) - **Source:** medium.com/tag/bugbounty-writeup · **Author:** ͏ ͏Dukrov - **Date:** 2026-07-31T19:14:40.000Z - **Summary:** It’s been a while since I put a writeup up here, so I’m dusting off one of my favorites. The target was a user-management / identity… Continue reading on Medium » - **Tags:** #bug-bounty #bugbounty-writeup #bugbounty-tips --- ## [Zero-click Admin Takeover via Unguarded login_email](https://dukrov.medium.com/zero-click-admin-takeover-via-unguarded-login-email-ab9bcc411641?source=rss------bugbounty_writeup-5) - **Source:** medium.com/tag/bugbounty-writeup · **Author:** ͏ ͏Dukrov - **Date:** 2026-07-31T19:12:34.000Z - **Summary:** Been meaning to write this one up since December. It’s a HR platform, name left out, and the bug is one of those ones where you can tell… Continue reading on Medium » - **Tags:** #bug-bounty #bugbounty-writeup --- ## [Found a Security Vulnerability? Here’s How to Report It (with R-Disclosure)](https://osintteam.blog/found-a-security-vulnerability-heres-how-to-report-it-with-r-disclosure-0495439009cf?source=rss------bugbounty_writeup-5) - **Source:** medium.com/tag/bugbounty-writeup · **Author:** RivuDon - **Date:** 2026-07-31T06:27:14.000Z - **Summary:** Learn how to report and use this time-saving tool. Continue reading on OSINT Team » - **Tags:** #osint #bugbounty-writeup #bug-bounty #infosec #bug-bounty-tips --- ## [Security Researcher | Cybersecurity Student | Ethical Hacking | Network Security](https://medium.com/@malkoo7179/security-researcher-cybersecurity-student-ethical-hacking-network-security-fc428961f2ef?source=rss------bugbounty_writeup-5) - **Source:** medium.com/tag/bugbounty-writeup · **Author:** Malaika Nasir - **Date:** 2026-07-30T11:51:51.000Z - **Summary:** I am Malaika Nasir, a cybersecurity student and security researcher passionate about ethical hacking, network security, Linux, and… Continue reading on Medium » - **Tags:** #information-security #cybersecurity #bugbounty-writeup #security-researchers #bug-bounty --- ## [Account Takeover Across Multiple Programs via Featurebase Integration](https://infosecwriteups.com/account-takeover-across-multiple-programs-via-featurebase-integration-32214666123e?source=rss------bugbounty_writeup-5) - **Source:** medium.com/tag/bugbounty-writeup · **Author:** JEETPAL - **Date:** 2026-07-29T05:23:30.000Z - **Summary:** In this blog, I am going to share an account takeover vulnerability in a third-party provider widely used by many bug bounty programs. Continue reading on InfoSec Write-ups » - **Tags:** #bug-bounty-writeup #bug-bounty #bugbounty-writeup #bug-bounty-tips #account-takeover --- ## [I Spent Weeks Looking for the Perfect Hacking OS. I Was Asking the Wrong Question.](https://m4dp1r4t3.medium.com/i-spent-weeks-looking-for-the-perfect-hacking-os-i-was-asking-the-wrong-question-d900f9580bed?source=rss------penetration_testing-5) - **Source:** medium.com/tag/penetration-testing · **Author:** M4dP1r4t3 - **Date:** 2026-08-05T15:58:28.000Z - **Summary:** When I first got into cybersecurity, I had one question stuck in my head: Continue reading on Medium » - **Tags:** #kali-linux #ethical-hacking #penetration-testing #cybersecurity #linux --- ## [Types of Web Application Security Testing: A Beginner’s Guide to WAPT](https://medium.com/@sahoosantu911/types-of-web-application-security-testing-a-beginners-guide-to-wapt-37ee3f25e978?source=rss------penetration_testing-5) - **Source:** medium.com/tag/penetration-testing · **Author:** SANTOSH SAHOO - **Date:** 2026-08-05T14:42:37.000Z - **Summary:** Web applications are the backbone of modern businesses, handling everything from online banking and e-commerce to healthcare and… Continue reading on Medium » - **Tags:** #owasp #ethical-hacking #cybersecurity #web-security #penetration-testing --- ## [MR ROBOT CTF | TRYHACKME](https://medium.com/@tabrizabuzarov/mr-robot-ctf-tryhackme-36c29edbae54?source=rss------penetration_testing-5) - **Source:** medium.com/tag/penetration-testing · **Author:** Tabrizabuzarov - **Date:** 2026-08-05T13:38:22.000Z - **Summary:** Cənab Robotun otağının məqsədi 3 gizli açar tapmaqdır. Başlayaq ! Continue reading on Medium » - **Tags:** #penetration-testing --- ## [Free Cybersecurity Resources That Actually Helped Me Start My Career](https://medium.com/@munnaza.cyber/free-cybersecurity-resources-that-actually-helped-me-start-my-career-715b21c5d411?source=rss------penetration_testing-5) - **Source:** medium.com/tag/penetration-testing · **Author:** Munaza Cyber - **Date:** 2026-08-05T13:16:17.000Z - **Summary:** There was a time, when I believed cybersecurity was only for people with IT degrees or expensive certifications, powerful computers, and… Continue reading on Medium » - **Tags:** #cybersecurity #penetration-testing #ctf #resources #information-security --- ## [From Source Code to Exploit: Understanding CVE-2026–67206](https://anirbala98.medium.com/from-source-code-to-exploit-understanding-cve-2026-67206-0ad3ae08bc78?source=rss------penetration_testing-5) - **Source:** medium.com/tag/penetration-testing · **Author:** Balachandar Gowrisankar - **Date:** 2026-08-05T12:03:13.000Z - **Summary:** While sifting through recently released CVEs to hone my skills in security research and exploit development, I came across a high severity… Continue reading on Medium » - **Tags:** #vulnerability-research #cybersecurity #penetration-testing #rce-vulnerability --- ## [My TryHackMe WEB1 Experience: A Practical Web Security Certification Review](https://rohitchaudhary045.medium.com/my-tryhackme-web1-experience-a-practical-web-security-certification-review-844074d77446?source=rss------penetration_testing-5) - **Source:** medium.com/tag/penetration-testing · **Author:** Rohit Chaudhary - **Date:** 2026-08-05T11:48:43.000Z - **Summary:** Hello everyone! Continue reading on Medium » - **Tags:** #web-applications #penetration-testing #web-1 #thm-certification #tryhackme --- ## [Net Sec Challenge (TryHackMe)— CTF](https://oluwakamiye.medium.com/net-sec-challenge-tryhackme-ctf-da1fdd9bacb8?source=rss------penetration_testing-5) - **Source:** medium.com/tag/penetration-testing · **Author:** Oluwakamiye Adeyemo - **Date:** 2026-08-05T11:31:26.000Z - **Summary:** The Net Sec Challenge room on TryHackMe is an exciting challenge that tested my skills in utilising core cybersecurity tools like Nmap… Continue reading on Medium » - **Tags:** #ctf #hacking #tryhackme #cybersecurity #penetration-testing --- ## [Strengthen Your Digital Security With Smarter Vulnerability Assessment](https://medium.com/@eyeqdotnet704/strengthen-your-digital-security-with-smarter-vulnerability-assessment-779be2584ca5?source=rss------penetration_testing-5) - **Source:** medium.com/tag/penetration-testing · **Author:** Eyeqdotnet - **Date:** 2026-08-05T11:08:27.000Z - **Summary:** As cyber threats become more advanced, businesses need a reliable way to identify weaknesses before attackers discover them. Penetration… Continue reading on Medium » - **Tags:** #penetration-testing --- ## [My CRTP Journey: Preparation and Exam Experience (July 2026)](https://medium.com/@devansh.gupta985/my-crtp-journey-preparation-and-exam-experience-july-2026-12a2586afb9a?source=rss------penetration_testing-5) - **Source:** medium.com/tag/penetration-testing · **Author:** Devansh Gupta - **Date:** 2026-08-05T11:06:01.000Z - **Summary:** Introduction Continue reading on Medium » - **Tags:** #penetration-testing #crt-p #active-directory #ethical-hacking #cybersecurity --- ## [Server-side Template Injection (tryhackme room)](https://medium.com/@muhammadjubairsec/server-side-template-injection-tryhackme-room-30d49b225497?source=rss------penetration_testing-5) - **Source:** medium.com/tag/penetration-testing · **Author:** Muhammad Jubair Hossain - **Date:** 2026-08-05T10:52:38.000Z - **Summary:** Lab Setup Continue reading on Medium » - **Tags:** #penetration-testing #ssti-exploitation #web-application-security #ssti --- ## [️ TryHackMe CryptoCabana: Detailed Write-up | Hacker Holidays | Azure | Storage | Key Vault | 2026](https://medium.com/@sushmaaragidda/%EF%B8%8F-tryhackme-cryptocabana-detailed-write-up-hacker-holidays-azure-storage-key-vault-2026-1af591963a97?source=rss------ctf_writeup-5) - **Source:** medium.com/tag/ctf-writeup · **Author:** Sushma - **Date:** 2026-08-05T14:37:39.000Z - **Summary:** Continue reading on Medium » - **Tags:** #tryhackme-walkthrough #ctf-writeup #cloud-security #cybersecurity #tryhackme --- ## [Cohort on HackTheBox — By BitR1FT](https://medium.com/@bitr1ft/cohort-on-hackthebox-by-bitr1ft-898eeea37858?source=rss------ctf_writeup-5) - **Source:** medium.com/tag/ctf-writeup · **Author:** BitR1ft - **Date:** 2026-08-05T14:32:56.000Z - **Summary:** Exploiting SSRF filter bypasses, discovering internal vhosts, and chaining Marimo RCE with a PackageKit TOCTOU race condition. Continue reading on Medium » - **Tags:** #bitr1ft #hackthebox #cybersecurity #cohorts #ctf-writeup --- ## [Variatype on HackTheBox — By BitR1FT](https://medium.com/@bitr1ft/variatype-on-hackthebox-by-bitr1ft-f0bf5a2a9378?source=rss------ctf_writeup-5) - **Source:** medium.com/tag/ctf-writeup · **Author:** BitR1ft - **Date:** 2026-08-05T14:27:50.000Z - **Summary:** From Git exposure and fontTools path traversal to FontForge injection and Setuptools exploitation. Continue reading on Medium » - **Tags:** #variatype #bitr1ft #ctf-writeup #hackthebox #cybersecurity --- ## [writeup “Glory of the garden” Cylab challenge](https://medium.com/@maul.habibi2310/writeup-glory-of-the-garden-cylab-challenge-bc4b47348e78?source=rss------ctf_writeup-5) - **Source:** medium.com/tag/ctf-writeup · **Author:** AchmadFrinzHabibi - **Date:** 2026-08-05T13:12:47.000Z - **Summary:** by Frinz (Habibi) Continue reading on Medium » - **Tags:** #forensics #picoctf #ctf-writeup #capture-the-flag --- ## [Byte Lotus — Poolside: How I Ruined a Resort's Entire Day](https://medium.com/@kishwordulal44/byte-lotus-poolside-how-i-ruined-a-resorts-entire-day-1cb5fd2ed408?source=rss------ctf_writeup-5) - **Source:** medium.com/tag/ctf-writeup · **Author:** Kishwordulal - **Date:** 2026-08-05T12:39:41.000Z - **Summary:** NoSQL Injection → EJS SSTI → Node Inspector → Raw Disk → “WHO GAVE THIS SERVICE ACCOUNT DISK ACCESS?” Continue reading on Medium » - **Tags:** #byte-lotus #ctf-walkthrough #ctf-writeup --- ## [Hacker Holiday — Day 6 — Do Not Disturb](https://mr-r3b00t500.medium.com/hacker-holiday-day-6-do-not-disturb-ccca2dfe8960?source=rss------ctf_writeup-5) - **Source:** medium.com/tag/ctf-writeup · **Author:** mr-r3b00t500 - **Date:** 2026-08-05T12:07:45.000Z - **Summary:** 🛎️ Concierge Briefing Continue reading on Medium » - **Tags:** #tryhackme-writeup #tryhackme-walkthrough #ctf-writeup #tryhackme #ctf --- ## [Proving Grounds Medjed Walkthrough by me:)](https://medium.com/@sevda_kh/proving-grounds-medjed-walkthrough-by-me-2a176253128d?source=rss------ctf_writeup-5) - **Source:** medium.com/tag/ctf-writeup · **Author:** Sevda - **Date:** 2026-08-05T11:32:18.000Z - **Summary:** Hello everyone! Today, we’ll be walking through my solution for the Proving Grounds — Medjed lab. Continue reading on Medium » - **Tags:** #medjed #ctf-writeup #ctf #ctf-walkthrough --- ## [TryHackMe Writeup — Corridor](https://medium.com/@fuad.khan713/tryhackme-writeup-corridor-c7fe253dc15a?source=rss------ctf_writeup-5) - **Source:** medium.com/tag/ctf-writeup · **Author:** Fuad Khan - **Date:** 2026-08-05T09:09:46.000Z - **Summary:** In the TryHackMe “Corridor” challenge, players navigate a series of doors to uncover potential IDOR vulnerabilities hidden within… Continue reading on Medium » - **Tags:** #tryhackme-writeup #ctf-writeup --- ## [The OAuth token that outlived three employees](https://eva-georgieva.medium.com/the-oauth-token-that-outlived-three-employees-123fcf58b7c0?source=rss------infosec-5) - **Source:** medium.com/tag/infosec · **Author:** h@shtalk - **Date:** 2026-08-05T13:31:01.000Z - **Summary:** A short horror story about a credential nobody killed, and the offboarding gap almost every organization has Continue reading on Medium » - **Tags:** #infosec #cybersecurity #oauth #security --- ## [Introducing Ghost Engine v3.2: An Automated Bug Bounty Recon Suite](https://medium.com/@muhammed_shifan_kamalsha_tk/introducing-ghost-engine-v3-2-an-automated-bug-bounty-recon-suite-9900fe246fd4?source=rss------infosec-5) - **Source:** medium.com/tag/infosec · **Author:** Muhammed shifan kamalsha tk - **Date:** 2026-08-05T09:23:05.000Z - **Summary:** Overview Continue reading on Medium » - **Tags:** #infosec #cybersecurity #bug-bounty #python #ethical-hacking --- ## [Inferno: From HTTP Basic Auth to Root via an Abandoned Web IDE](https://medium.com/@cristopher.gilbert27/inferno-from-http-basic-auth-to-root-via-an-abandoned-web-ide-f7d06974a6e8?source=rss------infosec-5) - **Source:** medium.com/tag/infosec · **Author:** Enryuuu - **Date:** 2026-08-05T03:21:11.000Z - **Summary:** This write-up documents my approach to solving the Inferno room on TryHackMe, a medium difficulty challenge built around Dante’s Inferno… Continue reading on Medium » - **Tags:** #ctf #cybersecurity #tryhackme #infosec #ctf-writeup --- ## [TryHackMe Hacker’s Holiday 2026: Day 7 — Do Not Disturb](https://medium.com/@jo0e.sec/tryhackme-hackers-holiday-2026-day-7-do-not-disturb-2d08b777da9e?source=rss------infosec-5) - **Source:** medium.com/tag/infosec · **Author:** Jo0e - **Date:** 2026-08-05T02:25:27.000Z - **Summary:** Room: Do Not Disturb Event: Hacker’s Holiday Category: Boot2Root Continue reading on Medium » - **Tags:** #cybersecurity #infosec #tryhackme #web-exploitation #ctf-writeup --- ## [TryHackMe Hacker’s Holiday 2026: Day 6 — Overheard at Breakfast](https://medium.com/@jo0e.sec/tryhackme-hackers-holiday-2026-day-6-overheard-at-breakfast-4dd67701eb7d?source=rss------infosec-5) - **Source:** medium.com/tag/infosec · **Author:** Jo0e - **Date:** 2026-08-05T02:24:08.000Z - **Summary:** Room: Overheard at Breakfast Event: Hacker’s Holiday Category: OSINT | Social Media | Hashing Continue reading on Medium » - **Tags:** #tryhackme #infosec #cybersecurity #osint #ctf-writeup --- ## [The Post-Privacy Internet: How to Be Untrackable in 2026](https://medium.com/@neonmaxima/the-post-privacy-internet-how-to-be-untrackable-in-2026-40d2f958f07a?source=rss------infosec-5) - **Source:** medium.com/tag/infosec · **Author:** Aeon Flex, Elriel Assoc. 2133 [NEON MAXIMA] - **Date:** 2026-08-05T01:17:27.000Z - **Summary:** Privacy is dead. We just keep refreshing the obituary hoping for a correction. Continue reading on Medium » - **Tags:** #privacy #information-security #infosec #cybersecurity #dystopia --- ## [Vulnerability Data Enrichment for CVE Records: 266 CNAs on the Enrichment Recognition List for…](https://medium.com/@cve_program/vulnerability-data-enrichment-for-cve-records-266-cnas-on-the-enrichment-recognition-list-for-ec57768b5cff?source=rss------infosec-5) - **Source:** medium.com/tag/infosec · **Author:** CVE Program Blog - **Date:** 2026-08-05T00:13:19.000Z - **Summary:** The “CNA Enrichment Recognition List” for August 3, 2026, is now available with 266 CNAs listed. Published monthly on the CVE website, the… Continue reading on Medium » - **Tags:** #software-development #cybersecurity #infosec #vulnerability #cyber-security-awareness --- ## [CryptoCabana Walkthrough: Exploiting Implicit Trust in Azure](https://medium.com/@es0557533/cryptocabana-walkthrough-exploiting-implicit-trust-in-azure-5f7ce96a77c9?source=rss------infosec-5) - **Source:** medium.com/tag/infosec · **Author:** Isv0x1 - **Date:** 2026-08-05T00:07:47.000Z - **Summary:** link : TryHackMe | CryptoCabana Continue reading on Medium » - **Tags:** #cloud-computing #penetration-testing #tryhackme #infosec --- ## [Win32 Callback Detouring Injection](https://medium.com/@s12deff/win32-callback-detouring-injection-722fbf805f3f?source=rss------infosec-5) - **Source:** medium.com/tag/infosec · **Author:** S12 - 0x12Dark Development - **Date:** 2026-08-04T21:45:18.000Z - **Summary:** Welcome to this new Medium post, in this one we will see an interesting continuation of one of the previous posts where we were talking… Continue reading on Medium » - **Tags:** #infosec #malware #pentesting #hacking #cybersecurity --- ## [How I Finished 17th at MetaCTF Six Challenges, Six Flags, and What They Taught Me](https://medium.com/@bombadeinnocent92/how-i-finished-17th-at-metactf-six-challenges-six-flags-and-what-they-taught-me-ee4859d9a4cb?source=rss------infosec-5) - **Source:** medium.com/tag/infosec · **Author:** Bleu I Bombade - **Date:** 2026-08-04T21:30:48.000Z - **Summary:** Six deliberately broken systems, one weekend, and the quiet discipline of never submitting a flag I couldn’t prove. Continue reading on Medium » - **Tags:** #infosec #ctf #capture-the-flag #ethical-hacking #cybersecurity --- ## [HTB: Kobold](https://0xdf.gitlab.io/2026/08/01/htb-kobold.html) - **Source:** 0xdf.gitlab.io - **Date:** 2026-08-01T13:45:00.000Z - **Tags:** #security --- ## [Watching Agents Work: A Behavioral Audit of Offensive-Security LLM Runs](https://projectdiscovery.io/blog/watching-agents-work-a-behavioral-audit-of-offensive-security-llm-runs) - **Source:** blog.projectdiscovery.io - **Date:** 2026-08-03T16:34:21.000Z - **Summary:** What closed and open models actually do when you tell them to hack a website Summary The cybersecurity capability of a model is currently measured by a solve rate, a percentage, and that number tells you almost nothing worth knowing. It doesn't tell you how the model behaved. It doesn't tell you what it is actually capable of, or where it is lacking, or how far it still is from doing the job end to end. And when you put an agent next to a human practitioner, the entire comparison collapses in - **Tags:** #Research #AI --- ## [dheeraj-jayaswal/Bug-Bounty-Hunting-Companion](https://github.com/dheeraj-jayaswal/Bug-Bounty-Hunting-Companion) - **Source:** GitHub Repos · **Author:** dheeraj-jayaswal - **Date:** 2026-09-27T17:04:49Z - **Summary:** A real-world bug bounty hunting companion built from hands-on experience—covering recon, exploitation, tools, and practical attack methodologies. - **Tags:** #bug-bounty #bug-bounty-writeups #checklist #ethical-hacking #hackerone #hacking #infosec #penetration-testing --- ## [harivishnu9345-creator/-bandit-over-the-wire-solution-writeups-1-33](https://github.com/harivishnu9345-creator/-bandit-over-the-wire-solution-writeups-1-33) - **Source:** GitHub Repos · **Author:** harivishnu9345-creator - **Date:** 2026-08-05T16:18:48Z - **Summary:** GitHub security writeups repository - **Tags:** #bandit #bandit-algorithm #bandit-learning #bandits #ctf #ctf-challenges #ctf-platform #ctf-solutions --- ## [Velatryx/CTF-Writeups](https://github.com/Velatryx/CTF-Writeups) - **Source:** GitHub Repos · **Author:** Velatryx - **Date:** 2026-10-01T07:56:26Z - **Summary:** 🚩 All my writeups of CTF's - **Tags:** #ctf #ctf-writeups #cybersecurity #red-team --- ## [MoriartyPuth-Labs/D3CTF-Writeups](https://github.com/MoriartyPuth-Labs/D3CTF-Writeups) - **Source:** GitHub Repos · **Author:** MoriartyPuth-Labs - **Date:** 2026-08-05T14:51:21Z - **Summary:** D^3 CTF 2026 Writeups - **Tags:** #cryptography #ctf #ctf-writeups #misc #pwn #reverse-engineering #web-exploitation --- ## [Aquellis/CTF_Writeups](https://github.com/Aquellis/CTF_Writeups) - **Source:** GitHub Repos · **Author:** Aquellis - **Date:** 2026-10-06T21:30:25Z - **Summary:** Writeups of completed CTF challenges - **Tags:** #ctf-writeups #hackthebox-writeups #imaginary-ctf #tryhackme-writeups --- ## [feng-zhe/enjoyCTF](https://github.com/feng-zhe/enjoyCTF) - **Source:** GitHub Repos · **Author:** feng-zhe - **Date:** 2026-08-28T05:18:17Z - **Summary:** the small tools used by CTF - **Tags:** #ctf-tools #ctf-writeups --- ## [menotliam/CTF-Writeups](https://github.com/menotliam/CTF-Writeups) - **Source:** GitHub Repos · **Author:** menotliam - **Date:** 2026-08-05T02:00:15Z - **Summary:** This repository serves as a centralized documentation hub for my Capture The Flag (CTF) write-ups, vulnerability research, and security architecture case studies. - **Tags:** #ctf-writeups #cybersecurity #defensive-security --- ## [conan0s4/CTF-WriteUps](https://github.com/conan0s4/CTF-WriteUps) - **Source:** GitHub Repos · **Author:** conan0s4 - **Date:** 2026-08-22T05:51:40Z - **Summary:** My personal Lab and CTF write-ups, written by me for educational and documentation purposes. - **Tags:** #ctf-writeups #cybersecurity #documentation #labs #writeups --- ## [mito753/Kernel-Exploit-Dojo](https://github.com/mito753/Kernel-Exploit-Dojo) - **Source:** GitHub Repos · **Author:** mito753 - **Date:** 2026-10-21T08:22:16Z - **Summary:** CTF kernel exploitation notes, PoCs, exploits, and writeups. - **Tags:** #ctf #ctf-writeups #dirty-pipe #ebpf #kernel-exploitation #kernel-pwn #kernel-rop #kpti --- ## [deut-erium/WriteUps](https://github.com/deut-erium/WriteUps) - **Source:** GitHub Repos · **Author:** deut-erium - **Date:** 2026-08-05T00:50:36Z - **Summary:** Repository for writeups of ctf challenges - **Tags:** #blog #crypto #cryptography #ctf #ctf-solutions #ctf-writeups #cybersecurity #python --- ## [kelly-f-m/htb-thm-writeups](https://github.com/kelly-f-m/htb-thm-writeups) - **Source:** GitHub Repos · **Author:** kelly-f-m - **Date:** 2026-08-13T21:33:10Z - **Summary:** Write-ups dos laboratórios das plataformas HackTheBox & TryHackMe. - **Tags:** #ctf-writeups #hacking #labs #writeups --- ## [Sudharsan409/cybersecurity-portfolio](https://github.com/Sudharsan409/cybersecurity-portfolio) - **Source:** GitHub Repos · **Author:** Sudharsan409 - **Date:** 2026-08-21T14:43:13Z - **Summary:** Cybersecurity engineering portfolio demonstrating offensive security, SIEM detection engineering, security automation, cloud security, and CTF-driven research. - **Tags:** #ai-security #ai-security-tool #cloud-security #ctf #ctf-challenges #ctf-solutions #ctf-writeups #cybersecurity --- ## [shelvy1337/Cybersecurity-Writeups](https://github.com/shelvy1337/Cybersecurity-Writeups) - **Source:** GitHub Repos · **Author:** shelvy1337 - **Date:** 2026-08-10T07:00:53Z - **Summary:** Bilingual cybersecurity writeups for TryHackMe, HackTheBox and CTF labs. Notes in Polish and English with commands, screenshots and defensive takeaways. - **Tags:** #ai-security #bilingual #boot2root #cloud-security #ctf #ctf-writeups #cybersecurity #english --- ## [0xIDA/binarypilot](https://github.com/0xIDA/binarypilot) - **Source:** GitHub Repos · **Author:** 0xIDA - **Date:** 2026-09-14T15:15:18Z - **Summary:** Autonomous CTF solver — HackTheBox + FlagYard, agent-based - **Tags:** #ai #ai-agent #ai-agents #ai-tools #ctf #ctf-challenges #ctf-platform #ctf-solutions --- ## [pentest-bi0s/Mobile-CTFs](https://github.com/pentest-bi0s/Mobile-CTFs) - **Source:** GitHub Repos · **Author:** pentest-bi0s - **Date:** 2026-08-25T10:01:34Z - **Summary:** A collection of mobile (Android & iOS) CTF challenges and write-ups from 2025 onwards. - **Tags:** #android #ctf #ctf-challenges #ctf-solutions #ctf-writeups #ios #mobile --- ## [devanshupathak9/ctf-writeups](https://github.com/devanshupathak9/ctf-writeups) - **Source:** GitHub Repos · **Author:** devanshupathak9 - **Date:** 2026-08-04T13:21:28Z - **Summary:** CTF write-ups and solutions covering web, pwn, reverse engineering, crypto, forensics, OSINT, and binary exploitation challenges from HTB, AdWorld, and CTF competitions. - **Tags:** #binary-exploitation #capture-the-flag #cryptography #ctf #ctf-writeups #cybersecurity #cybersecurity-tools #ethical-hacking --- ## [n3erajan/ctf-writeups](https://github.com/n3erajan/ctf-writeups) - **Source:** GitHub Repos · **Author:** n3erajan - **Date:** 2026-08-30T07:40:16Z - **Summary:** CTF writeups covering my full methodology - recon to root. - **Tags:** #ctf-writeups #cybersecurity #ethical-hacking #pentesting #tryhackme --- ## [tofan0810/LITCTF-2026-Writeups](https://github.com/tofan0810/LITCTF-2026-Writeups) - **Source:** GitHub Repos · **Author:** tofan0810 - **Date:** 2026-08-04T04:06:50Z - **Summary:** Collection of LIT CTF 2026 solutions, scripts, and notes solved by team HCMUS-Lazarus - **Tags:** #ctf #ctf-events #ctf-solutions #ctf-writeups --- ## [jiegec/ctf-writeups](https://github.com/jiegec/ctf-writeups) - **Source:** GitHub Repos · **Author:** jiegec - **Date:** 2026-10-26T02:50:09Z - **Summary:** CTF Writeups - **Tags:** #ctf #ctf-writeups --- ## [pop123-ux/HTB-Lost-in-Hyperspace-Writeup](https://github.com/pop123-ux/HTB-Lost-in-Hyperspace-Writeup) - **Source:** GitHub Repos · **Author:** pop123-ux - **Date:** 2026-09-18T22:06:49Z - **Summary:** A curated and clean writeup of the "Lost in Hyperspace" Hack The Box AI/ML challenge - **Tags:** #ai #aictf #ctf #ctf-writeups #deep-learning #embeddings #embeddingspace #hackthebox --- ## [Rifteo/skills](https://github.com/Rifteo/skills) - **Source:** GitHub Repos · **Author:** Rifteo - **Date:** 2026-08-05T15:41:38Z - **Summary:** The official Rifteo agent skills library - a collection of reusable instruction sets for AI agents covering security testing, audit, and compliance workflows. Supports 53 agents - **Tags:** #ai #ai-agents #ai-skills --- ## [pwnspirit/pwnspirit.github.io](https://github.com/pwnspirit/pwnspirit.github.io) - **Source:** GitHub Repos · **Author:** pwnspirit - **Date:** 2026-08-05T14:57:57Z - **Summary:** This repo contains my writeups about bug bounty and security research. - **Tags:** #security --- ## [lsszz2100/VibeHacking](https://github.com/lsszz2100/VibeHacking) - **Source:** GitHub Repos · **Author:** lsszz2100 - **Date:** 2026-10-11T09:43:14Z - **Summary:** A Collection of Repositories, Videos, Books, and Lecture Materials to Learn Security & Hacking with AI in a Fun Way - **Tags:** #security --- ## [Soles-IA/web3-security-writeups](https://github.com/Soles-IA/web3-security-writeups) - **Source:** github.com · **Author:** Soles-IA - **Date:** 2026-08-05T13:44:12Z - **Summary:** Security research on EVM and Solana protocols. Audit contest writeups, executable PoCs in Foundry and Anchor. - **Tags:** #anchor #audit #foundry #rust #smart-contract-security #solana #solidity #web3 --- ## [Heckerman-0/bugbounty-academy](https://github.com/Heckerman-0/bugbounty-academy) - **Source:** github.com · **Author:** Heckerman-0 - **Date:** 2026-08-05T13:28:59Z - **Summary:** Self‑hosted bug bounty learning platform with vulnerable labs & gamification - **Tags:** #security --- ## [Vikram2003-07/kramcom-ctf](https://github.com/Vikram2003-07/kramcom-ctf) - **Source:** github.com · **Author:** Vikram2003-07 - **Date:** 2026-08-05T16:14:24Z - **Summary:** Mr. Robot themed telecom surveillance CTF (KramCom). 7-stage realistic challenge covering web recon,Credential stuffing & authentication bypass, file upload, SQLi, lateral movement, and privilege escalation on a full LAMP stack. - **Tags:** #security --- ## [iamdhruvtripathi/TryHackMe-Room-Writeups](https://github.com/iamdhruvtripathi/TryHackMe-Room-Writeups) - **Source:** GitHub Repos · **Author:** iamdhruvtripathi - **Date:** 2026-08-15T03:28:13Z - **Summary:** GitHub security writeups repository - **Tags:** #security --- ## [elysium71/cybersecurity-notes](https://github.com/elysium71/cybersecurity-notes) - **Source:** github.com · **Author:** elysium71 - **Date:** 2026-08-05T15:55:03Z - **Summary:** A collection of my cybersecurity learning notes, Hack The Box write-ups, lab documentation, and practical exercises covering penetration testing, networking, Linux, web security, and defensive security concepts - **Tags:** #security --- ## [astroicers/Athena](https://github.com/astroicers/Athena) - **Source:** github.com · **Author:** astroicers - **Date:** 2026-08-05T15:53:37Z - **Summary:** C5ISR + OODA 自主網路作戰平台（open-core）：核心商業授權，SDK / 工具 catalog 開源。 - **Tags:** #ai-security #c4isr #c5isr #command-and-control #cyber-warfare #cybersecurity #decision-making #military-framework #mitre-attack #offensive-security #ooda-loop #penetration-testing #red-team #security-automation #threat-emulation --- ## [saifprof1/ctf-writeups](https://github.com/saifprof1/ctf-writeups) - **Source:** GitHub Repos · **Author:** saifprof1 - **Date:** 2026-08-12T04:55:17Z - **Summary:** Writeups and walkthroughs of CTF challenges covering Digital Forensics, OSINT, Cryptography, Reverse Engineering, Web Security, and Network Analysis. - **Tags:** #security --- ## [mwlik/v8-resources](https://github.com/mwlik/v8-resources) - **Source:** github.com · **Author:** mwlik - **Date:** 2026-08-05T15:21:54Z - **Summary:** A bunch of V8 resources (with a security focus) - **Tags:** #browser-exploitation #v8 --- ## [vanderstark/ctf-lab-docker-compose](https://github.com/vanderstark/ctf-lab-docker-compose) - **Source:** github.com · **Author:** vanderstark - **Date:** 2026-08-05T15:18:21Z - **Summary:** Personal CTF/pentest learning lab via Docker Compose - DVWA, Juice Shop, Metasploitable2, WebGoat, and Kali attacker box for local practice only - **Tags:** #security --- ## [cracknull-git/Pentesting-Notes](https://github.com/cracknull-git/Pentesting-Notes) - **Source:** github.com · **Author:** cracknull-git - **Date:** 2026-08-05T16:13:08Z - **Summary:** Structured penetration testing notes and cybersecurity learning resources including Linux commands, enumeration, vulnerability scanning, exploitation, and reporting. - **Tags:** #security --- ## [MertcanKayirici/SQLMap-MasterAcademy](https://github.com/MertcanKayirici/SQLMap-MasterAcademy) - **Source:** github.com · **Author:** MertcanKayirici - **Date:** 2026-08-05T16:05:29Z - **Summary:** A comprehensive open-source SQLMap learning repository featuring structured documentation, SQL Injection fundamentals, HTTP & Burp Suite integration, hands-on labs, quizzes, penetration testing workflows, reference guides, and an AI-powered learning assistant. - **Tags:** #application-security #cybersecurity #database #documentation #hands-on-labs #infosec #learning-resources #master-academy #mssql #mysql #owasp #postgresql #sql-injection #sqlite #sqlmap #web-security --- ## [ayushsingh257/Vulnova](https://github.com/ayushsingh257/Vulnova) - **Source:** GitHub Repos · **Author:** ayushsingh257 - **Date:** 2026-08-09T04:25:24Z - **Summary:** Enterprise AI-powered Application Security Platform for intelligent security assessment, vulnerability management, and secure software engineering. - **Tags:** #security --- ## [Ayushi272/android-penetration-testing](https://github.com/Ayushi272/android-penetration-testing) - **Source:** github.com · **Author:** Ayushi272 - **Date:** 2026-08-05T16:03:08Z - **Summary:** Android Application Security Assessment using OWASP Mobile Top 5 - **Tags:** #security --- ## [priyanshu-rawa/Cybersecurity-Handbook](https://github.com/priyanshu-rawa/Cybersecurity-Handbook) - **Source:** GitHub Repos · **Author:** priyanshu-rawa - **Date:** 2026-08-05T17:50:40Z - **Summary:** A community‑driven cybersecurity knowledge base with 400+ notes, mind‑maps, and cheat‑sheets – built from first principles. Ideal for students, SOC analysts, and pentesters. - **Tags:** #ai #ai-security #community-driven #cybersecurity #exploit #exploitation #free-source #hacker --- ## [g3rzi/awesome-security-research](https://github.com/g3rzi/awesome-security-research) - **Source:** GitHub Repos · **Author:** g3rzi - **Date:** 2026-10-22T12:46:26Z - **Summary:** 😎 A curated list of the awesome resources about the security research - **Tags:** #awesome #awesome-list #curated #exploit-development #security-research #vulnerability-research --- ## [OWASP/Nettacker](https://github.com/OWASP/Nettacker) - **Source:** github.com · **Author:** OWASP - **Date:** 2026-08-05T14:31:05Z - **Summary:** Automated Penetration Testing Framework - Open-Source Vulnerability Scanner - Vulnerability Management - **Tags:** #automation #bruteforce #cve #hacking-tools #information-gathering #network-security #owasp #penetration-testing #penetration-testing-framework #pentesting #pentesting-tools #portscanner #python #recon #scanner #security #security-tools #vulnerability-management #vulnerability-scanner #vulnerability-scanners --- ## [Choosing a Secure VPN Service: A Guide from the Front Lines](https://medium.com/@b0dj0x/choosing-a-secure-vpn-service-a-guide-from-the-front-lines-77c85e076de0?source=rss------bug_bounty-5) - **Source:** medium.com/tag/bug-bounty · **Author:** b0dj0x - **Date:** 2026-08-05T14:14:25.000Z - **Summary:** Choosing a Secure VPN Service: A Guide from the Front Lines Continue reading on Medium » - **Tags:** #vpn #cybersecurity #bug-bounty #security #anonymous --- ## [I Found Basic XSS + Open Redirect in a Hidden Endpoint (And Got $100 For It)](https://0x3rab.medium.com/i-found-basic-xss-open-redirect-in-a-hidden-endpoint-and-got-100-for-it-3bf5a968d58f?source=rss------bug_bounty-5) - **Source:** medium.com/tag/bug-bounty · **Author:** Roshdy Zain - **Date:** 2026-08-05T13:26:43.000Z - **Summary:** Alright so two nights ago I was just messing with this app. Nothing serious, just testing the login flow, trying to break it you know. I… Continue reading on Medium » - **Tags:** #cybersecurity #bug-bounty --- ## [API Recon — Mapping Every Hidden Endpoint](https://kd-200.medium.com/api-recon-mapping-every-hidden-endpoint-dc09936cc596?source=rss------bug_bounty-5) - **Source:** medium.com/tag/bug-bounty · **Author:** Nitin yadav - **Date:** 2026-08-05T11:31:01.000Z - **Summary:** What’s up everyone! Nitin here 👋 Continue reading on Medium » - **Tags:** #bug-bounty #cybersecurity #ethical-hacking #reconnaissance #web-security --- ## [How a 19-Year-Old Made $2,500 in 10 Minutes (And Why Most Bug Bounty Advice Is Garbage)](https://medium.com/@mohiitlamba/how-a-19-year-old-made-2-500-in-10-minutes-and-why-most-bug-bounty-advice-is-garbage-73df8711c330?source=rss------bug_bounty-5) - **Source:** medium.com/tag/bug-bounty · **Author:** Mohit - **Date:** 2026-08-05T10:52:29.000Z - **Summary:** Forget zero-days. Forget writing 500-line Python scripts. Here’s the blunt reality of web security after 7 years in incident response. Continue reading on Medium » - **Tags:** #web-development #technology #bug-bounty #cybersecurity #ethical-hacking --- ## [How I Got My NASA Hall of Fame: A Unique Twist on Google Dorking](https://vanshrathorebughunter.medium.com/how-i-got-my-nasa-hall-of-fame-a-unique-twist-on-google-dorking-a954193b317f?source=rss------bug_bounty-5) - **Source:** medium.com/tag/bug-bounty · **Author:** Vanshrathore - **Date:** 2026-08-05T10:09:19.000Z - **Summary:** LinkedIn:- https://www.linkedin.com/in/vansh-rathore-cybersecurity/ Continue reading on Medium » - **Tags:** #bug-bounty #penetration-testing #bug-bounty-writeup #money #bug-bounty-tips --- ## [Introducing Ghost Engine v3.2: An Automated Bug Bounty Recon Suite](https://medium.com/@muhammed_shifan_kamalsha_tk/introducing-ghost-engine-v3-2-an-automated-bug-bounty-recon-suite-9900fe246fd4?source=rss------bug_bounty-5) - **Source:** medium.com/tag/bug-bounty · **Author:** Muhammed shifan kamalsha tk - **Date:** 2026-08-05T09:23:05.000Z - **Summary:** Overview Continue reading on Medium » - **Tags:** #infosec #cybersecurity #bug-bounty #python #ethical-hacking --- ## [Bounty for an Out-of-Scope Vulnerability](https://medium.com/@hemand390hemanth/bounty-for-an-out-of-scope-vulnerability-96dd0a6ba536?source=rss------bug_bounty-5) - **Source:** medium.com/tag/bug-bounty · **Author:** Hemandhemanth - **Date:** 2026-08-05T09:07:47.000Z - **Summary:** Why API Security Matters More Than Ever Continue reading on Medium » - **Tags:** #technology #hacking #bug-bounty #cybersecurity #ethical-hacking --- ## [Chaining a Session Leak and Broken Access Control in Revive Adserver 6.0.7 Program Hackerone](https://medium.com/@kenjisubagja/chaining-a-session-leak-and-broken-access-control-in-revive-adserver-6-0-7-program-hackerone-156e5cf97826?source=rss------bug_bounty-5) - **Source:** medium.com/tag/bug-bounty · **Author:** Kenjisubagja - **Date:** 2026-08-05T06:50:47.000Z - **Summary:** How a failed XML-RPC login opened the door to cross-agency unauthorized associations. Continue reading on Medium » - **Tags:** #bug-bounty-tips #bug-bounty-writeup #bug-bounty --- ## [BloodHound Series — Part 5: Detection, Defense & Blue Team Perspective (Final)](https://medium.com/bug-bounty-hunting-a-comprehensive-guide-in/bloodhound-series-part-5-detection-defense-blue-team-perspective-final-ba96c5bd2982?source=rss------bug_bounty-5) - **Source:** medium.com/tag/bug-bounty · **Author:** ghostyjoe - **Date:** 2026-08-05T05:46:44.000Z - **Summary:** ghostyjoe™ Continue reading on Bug Bounty Hunting: A Comprehensive Guide in English and french » - **Tags:** #cybersecurity #linux #bug-bounty #security #hacking --- ## [A Beginner’s Guide to Faster Web Reconnaissance](https://medium.com/@bughuntingtips/a-beginners-guide-to-faster-web-reconnaissance-77951045e9ac?source=rss------bug_bounty-5) - **Source:** medium.com/tag/bug-bounty · **Author:** Monika - **Date:** 2026-08-05T04:41:35.000Z - **Summary:** Learn how I use Cariddi to automate web crawling, discover hidden endpoints, and organize reconnaissance for bug bounty hunting. Continue reading on Medium » - **Tags:** #ethical-hacking #penetration-testing #technology #cybersecurity #bug-bounty --- ## [A 0-click exploit chain for the Pixel 10: When a Door Closes, a Window Opens](https://projectzero.google/2026/05/pixel-10-exploit.html) - **Source:** googleprojectzero.blogspot.com · **Author:** Seth Jenkins - **Date:** 2026-05-13T07:00:00.000Z - **Summary:** We recently published an exploit chain for the Google Pixel 9 that demonstrated it was possible to go from a zero-click context to root on Android in just two exploits. The Dolby 0-click vulnerability existed across all of Android, until it was patched in January 2026. While we had an exploit chain for the Pixel 9, we wanted to see if it was possible to write a similar exploit chain for Pixel 10. Updating the Dolby Exploit Altering our exploit for CVE-2025-54957 was fairly straightforward. The m - **Tags:** #CVE-2025-54957 --- ## [On the Effectiveness of Mutational Grammar Fuzzing](https://projectzero.google/2026/03/mutational-grammar-fuzzing.html) - **Source:** googleprojectzero.blogspot.com · **Author:** Ivan Fratric - **Date:** 2026-03-05T08:00:00.000Z - **Summary:** Mutational grammar fuzzing is a fuzzing technique in which the fuzzer uses a predefined grammar that describes the structure of the samples. When a sample gets mutated, the mutations happen in such a way that any resulting samples still adhere to the grammar rules, thus the structure of the samples gets maintained by the mutation process. In case of coverage-guided grammar fuzzing, if the resulting sample (after the mutation) triggers previously unseen code coverage, this sample is saved to the - **Tags:** #security --- ## [A Deep Dive into the GetProcessHandleFromHwnd API](https://projectzero.google/2026/02/gphfh-deep-dive.html) - **Source:** googleprojectzero.blogspot.com · **Author:** James Forshaw - **Date:** 2026-02-26T08:00:00.000Z - **Summary:** In my previous blog post I mentioned the GetProcessHandleFromHwnd API. This was an API I didn’t know existed until I found a publicly disclosed UAC bypass using the Quick Assist UI Access application. This API looked interesting so I thought I should take a closer look. I typically start by reading the documentation for an API I don’t know about, assuming it’s documented at all. It can give you an idea of how long the API has existed as well as its security properties. The documentation’s remark - **Tags:** #security --- ## [Bypassing Administrator Protection by Abusing UI Access](https://projectzero.google/2026/02/windows-administrator-protection.html) - **Source:** googleprojectzero.blogspot.com · **Author:** James Forshaw - **Date:** 2026-02-12T08:00:00.000Z - **Summary:** In my last blog post I introduced the new Windows feature, Administrator Protection and how it aimed to create a secure boundary for UAC where one didn’t exist. I described one of the ways I was able to bypass the feature before it was released. In total I found 9 bypasses during my research that have now all been fixed. In this blog post I wanted to describe the root cause of 5 of those 9 issues, specifically the implementation of UI Access, how this has been a long standing problem with UAC th - **Tags:** #security --- ## [Breaking the Sound Barrier, Part II: Exploiting CVE-2024-54529](https://projectzero.google/2026/01/sound-barrier-2.html) - **Source:** googleprojectzero.blogspot.com · **Author:** Dillon Franke, Google Information Security Engineering, 20% time on Project Zero - **Date:** 2026-01-30T08:00:00.000Z - **Summary:** In the first part of this series, I detailed my journey into macOS security research, which led to the discovery of a type confusion vulnerability (CVE-2024-54529) and a double-free vulnerability (CVE-2025-31235) in the coreaudiod system daemon through a process I call knowledge-driven fuzzing. While the first post focused on the process of finding the vulnerabilities, this post dives into the intricate process of exploiting the type confusion vulnerability. I’ll explain the technical details of - **Tags:** #CVE-2024-54529 #CVE-2025-31235 --- ## [Bypassing Windows Administrator Protection](https://projectzero.google/2026/26/windows-administrator-protection.html) - **Source:** googleprojectzero.blogspot.com · **Author:** James Forshaw - **Date:** 2026-01-26T08:00:00.000Z - **Summary:** A headline feature introduced in the latest release of Windows 11, 25H2 is Administrator Protection. The goal of this feature is to replace User Account Control (UAC) with a more robust and importantly, securable system to allow a local user to access administrator privileges only when necessary. This blog post will give a brief overview of the new feature, how it works and how it’s different from UAC. I’ll then describe some of the security research I undertook while it was in the insider previ - **Tags:** #security --- ## [A 0-click exploit chain for the Pixel 9 Part 3: Where do we go from here?](https://projectzero.google/2026/01/pixel-0-click-part-3.html) - **Source:** googleprojectzero.blogspot.com · **Author:** Natalie Silvanovich - **Date:** 2026-01-14T18:01:00.000Z - **Summary:** While our previous two blog posts provided technical recommendations for increasing the effort required by attackers to develop 0-click exploit chains, our experience finding, reporting and exploiting these vulnerabilities highlighted some broader issues in the Android ecosystem. This post describes the problems we encountered and recommendations for improvement. Audio Attack Surface The Dolby UDC is part of the 0-click attack surface of most Android devices because of audio transcription in the - **Tags:** #security --- ## [A 0-click exploit chain for the Pixel 9 Part 2: Cracking the Sandbox with a Big Wave](https://projectzero.google/2026/01/pixel-0-click-part-2.html) - **Source:** googleprojectzero.blogspot.com · **Author:** Seth Jenkins - **Date:** 2026-01-14T09:00:00.000Z - **Summary:** With the advent of a potential Dolby Unified Decoder RCE exploit, it seemed prudent to see what kind of Linux kernel drivers might be accessible from the resulting userland context, the mediacodec context. As per the AOSP documentation, the mediacodec SELinux context is intended to be a constrained (a.k.a sandboxed) context where non-secure software decoders are utilized. Nevertheless, using my DriverCartographer tool, I discovered an interesting device driver, /dev/bigwave that was accessible f - **Tags:** #security --- ## [A 0-click exploit chain for the Pixel 9 Part 1: Decoding Dolby](https://projectzero.google/2026/01/pixel-0-click-part-1.html) - **Source:** googleprojectzero.blogspot.com · **Author:** Natalie Silvanovich - **Date:** 2026-01-14T17:59:00.000Z - **Summary:** Over the past few years, several AI-powered features have been added to mobile phones that allow users to better search and understand their messages. One effect of this change is increased 0-click attack surface, as efficient analysis often requires message media to be decoded before the message is opened by the user. One such feature is audio transcription. Incoming SMS and RCS audio attachments received by Google Messages are now automatically decoded with no user interaction. As a result, au - **Tags:** #security --- ## [Welcome to the new Project Zero Blog](https://projectzero.google/2025/12/welcome.html) - **Source:** googleprojectzero.blogspot.com · **Author:** Natalie Silvanovich - **Date:** 2025-12-16T10:00:00.000Z - **Summary:** While on Project Zero, we aim for our research to be leading-edge, our blog design was … not so much. We welcome readers to our shiny new blog! For the occasion, we asked members of Project Zero to dust off old blog posts that never quite saw the light of day. And while we wish we could say the techniques they cover are no longer relevant, there is still a lot of work that needs to be done to protect users against zero days. Our new blog will continue to shine a light on the capabilities of atta - **Tags:** #security --- ## [A few notes on AWS Nitro Enclaves: KMS integration](https://blog.trailofbits.com/2026/08/05/a-few-notes-on-aws-nitro-enclaves-kms-integration/) - **Source:** blog.trailofbits.com - **Date:** 2026-08-05T11:00:00.000Z - **Summary:** Nitro Enclaves and Key Management Service (KMS) feel like a natural fit: since the KMS can verify attestation documents generated by the enclaves, developers can offload key management tasks from their applications to the AWS-managed service. But integrating an external service with your trusted enclaves comes with new threats, even if that service comes from the same provider. In this blog post—the third in our series on Nitro Enclaves, following our posts on attack surface and images and attes - **Tags:** #security --- ## [Building secure Uniswap v4 hooks](https://blog.trailofbits.com/2026/07/30/building-secure-uniswap-v4-hooks/) - **Source:** blog.trailofbits.com - **Date:** 2026-07-30T11:00:00.000Z - **Summary:** Uniswap v4 hooks let developers add custom behavior to pools, including dynamic fees, custom accounting, and external integrations. This flexibility moves some security responsibilities into application and hook code. The Cork and Bunni exploits are two app-level incidents that show what can go wrong in that code. Together, they account for more than $20M in losses. Neither incident stemmed from a flaw in the Uniswap v4 core protocol or the PoolManager; both arose from application-specific autho - **Tags:** #security --- ## [How we use /goal to find bugs in Patch the Planet](https://blog.trailofbits.com/2026/07/28/how-we-use-goal-to-find-bugs-in-patch-the-planet/) - **Source:** blog.trailofbits.com - **Date:** 2026-07-28T11:00:00.000Z - **Summary:** Codex’s /goal feature amplifies bug hunting, but getting good results requires the right prompt, the right scope, and the right number of outcomes per run. For Patch the Planet, our joint initiative with OpenAI to find and fix bugs in open-source software, we pointed Codex at some of the most widely used, heavily audited codebases in the world, like Rust, curl, and zlib. One tool came up again and again in our internal bug-report channels: /goal, which hands Codex an open-ended objective and let - **Tags:** #security --- ## [Rust-proof your code with our new Testing Handbook chapter](https://blog.trailofbits.com/2026/07/13/rust-proof-your-code-with-our-new-testing-handbook-chapter/) - **Source:** blog.trailofbits.com - **Date:** 2026-07-13T11:00:00.000Z - **Summary:** We’ve added a new chapter to our Testing Handbook: a comprehensive guide to security testing Rust programs. This chapter covers the tools and techniques we use at Trail of Bits to validate the security of Rust programs and systems. fn main() {(|f:&dyn Fn(u128)->Box+'static>|f(*[&( 0x7B736D70683F73u128>63)as usize]) .for_each(|c|print!("{c}")))(Box::leak(Box::new(|n: u128|Box::new(std::iter::successors(Some(n),|&n|Some(n>>8) ).take_while(|&n|n>0).map(|n|((n as u8)^0x1F)as char))as _)))} What’s in - **Tags:** #security --- ## [Mutation testing comes to DAML](https://blog.trailofbits.com/2026/07/08/mutation-testing-comes-to-daml/) - **Source:** blog.trailofbits.com - **Date:** 2026-07-08T11:00:00.000Z - **Summary:** In April we released Mewt, our open-source mutation-testing engine that finds the gaps in your test suite. Today we’re expanding it with support for DAML, the language Canton Network applications are written in. Mewt now reads DAML, generates several classes of mutants (including two built for DAML’s authorization primitives), and runs them through your existing test suite to count how many mutants survive. If you want to try it, simply install Mewt from the repository, point a mewt.toml at your - **Tags:** #security --- ## [GPT-5.5-Cyber built a zlib fuzzing lab in a day](https://blog.trailofbits.com/2026/07/02/field-reports-from-patch-the-planet/) - **Source:** blog.trailofbits.com - **Date:** 2026-07-02T11:00:00.000Z - **Summary:** We’re running Patch the Planet, an ongoing collaboration with OpenAI that pairs Trail of Bits engineers directly with more than 30 open-source projects. Its goal is to front-run a serious problem facing open-source maintainers: highly capable models like GPT-5.5-Cyber will soon create a firehose of bug reports, and OSS maintainers are already spread thin. Our plan is to point OpenAI’s latest models at real codebases, find the security bugs first, work with maintainers to patch them, and find way - **Tags:** #security --- ## [Shipping post-quantum cryptography to Python](https://blog.trailofbits.com/2026/06/30/shipping-post-quantum-cryptography-to-python/) - **Source:** blog.trailofbits.com - **Date:** 2026-06-30T11:00:00.000Z - **Summary:** Post-quantum cryptography is now one pip-install away for the entire Python ecosystem. With funding from the Sovereign Tech Agency, we implemented support for ML-KEM, the NIST-standard key-establishment primitive, and ML-DSA, the NIST-standard digital-signature primitive, in pyca/cryptography. On June 22, 2026, the White House ordered the U.S. government to accelerate its transition to post-quantum cryptography. The order says large-scale quantum computers, especially in adversarial hands, will - **Tags:** #security --- ## [Introducing Patch the Planet](https://blog.trailofbits.com/2026/06/22/introducing-patch-the-planet/) - **Source:** blog.trailofbits.com - **Date:** 2026-06-22T16:50:00.000Z - **Summary:** What happens when you clear dozens of Trail of Bits engineers’ schedules, pair them with every open-source maintainer they can contact, and unleash the latest frontier models like GPT-5.5-Cyber on critical open-source targets? Thanks to our partnership with OpenAI and its Daybreak initiative, we can report that the impact is hundreds of discovered bugs, 64 pull requests, and 51 issues filed across 19 projects (with many more still undergoing coordinated disclosure). That was just the first week - **Tags:** #security --- ## [Factoring "short-sleeve" RSA keys with polynomials](https://blog.trailofbits.com/2026/06/12/factoring-short-sleeve-rsa-keys-with-polynomials/) - **Source:** blog.trailofbits.com - **Date:** 2026-06-12T11:00:00.000Z - **Summary:** What happens when the bits of an RSA private key are heavily biased toward 0 instead of being randomly generated? The public key’s bits could be biased enough for us to detect these incorrectly generated keys in the wild. Together with Hanno Böck of the badkeys project, we found hundreds of unique keys that not only have this property, but can be quickly factored. We also found the bug that led to many of these keys and analyzed historical data to track the issue over time. Surprisingly, the pat - **Tags:** #security --- ## [The sorry state of skill distribution](https://blog.trailofbits.com/2026/06/03/the-sorry-state-of-skill-distribution/) - **Source:** blog.trailofbits.com - **Date:** 2026-06-03T11:00:00.000Z - **Summary:** Public skill marketplaces are being flooded with malicious skills that steal credentials, exfiltrate data, and hijack agents. In response, a segment of the security industry released skill scanners, a new family of tools designed to detect malicious skills before they’re installed. But we tested them, and they don’t work. We recently bypassed ClawHub’s malicious skill detector, Cisco’s agent skill scanner, and all three of the scanners integrated into skills.sh. These were not advanced attacks: - **Tags:** #security --- ## [Bringing full YAML anchor support to zizmor](https://blog.trailofbits.com/2026/05/22/we-hardened-zizmors-github-actions-static-analyzer/) - **Source:** blog.trailofbits.com - **Date:** 2026-05-22T11:00:00.000Z - **Summary:** In March 2026, attackers exploited a pull_request_target misconfiguration in the aquasecurity/trivy-action GitHub Action to exfiltrate organization and repository secrets, then used those credentials to backdoor LiteLLM on PyPI (see Trivy’s post-mortem for the full timeline). zizmor is a static analyzer that GitHub Actions users run to catch exactly these misconfigurations before they ship. When GitHub Actions added support for YAML anchors in September 2025, a small but high-value slice of the - **Tags:** #security --- ## [gosentry brings LibAFL-grade fuzzing to Go's native interface](https://blog.trailofbits.com/2026/05/12/go-fuzzing-was-missing-half-the-toolkit.-we-forked-the-toolchain-to-fix-it./) - **Source:** blog.trailofbits.com - **Date:** 2026-05-12T11:00:00.000Z - **Summary:** Go’s native fuzzing is useful, but it stands far behind state-of-the-art tooling that the Rust, C, and C++ ecosystems offer with LibAFL and AFL++. Path constraints are hard to solve. Structured inputs usually need handmade parsing. It doesn’t even detect several common bug classes, such as integer overflows, goroutine leaks, data races, and execution timeouts. So to make it better, we built gosentry, a fuzzing-oriented fork of the Go toolchain that keeps the standard testing.F workflow while usi - **Tags:** #security --- ## [Escalating a Windows driver registry bug to a kernel write primitive](https://blog.trailofbits.com/2026/05/05/c/c-checklist-challenges-solved/) - **Source:** blog.trailofbits.com - **Date:** 2026-05-05T11:00:00.000Z - **Summary:** We recently added a C/C++ security checklist to the Testing Handbook and challenged readers to spot the bugs in two code samples: a deceptively simple Linux ping program and a Windows driver registry handler. If you found the inet_ntoa global buffer gotcha or the missing RTL_QUERY_REGISTRY_TYPECHECK flag, nice work. If not, here’s a full walkthrough of both challenges, plus a deep dive into how the Windows registry type confusion escalates from a local denial of service to a kernel write primiti - **Tags:** #security --- ## [Extending Ruzzy with LibAFL](https://blog.trailofbits.com/2026/04/29/extending-ruzzy-with-libafl/) - **Source:** blog.trailofbits.com - **Date:** 2026-04-29T11:00:00.000Z - **Summary:** LibAFL is all the rage in the fuzzing community these days, especially with LLVM’s libFuzzer being placed in maintenance mode. Written in Rust, LibAFL claims improved performance, modularity, state-of-the-art fuzzing techniques, and libFuzzer compatibility. For these reasons, I set out to add LibAFL support to Ruzzy, our coverage-guided fuzzer for pure Ruby code and Ruby C extensions. This gives Ruby developers and security researchers access to a more advanced and actively maintained fuzzing en - **Tags:** #security --- ## [Trailmark turns code into graphs](https://blog.trailofbits.com/2026/04/23/trailmark-turns-code-into-graphs/) - **Source:** blog.trailofbits.com - **Date:** 2026-04-23T12:00:00.000Z - **Summary:** We’re open-sourcing Trailmark, a library that parses source code into a queryable call graph of functions, classes, call relationships, and semantic metadata, then exposes that graph through a Python API that Claude skills can call directly. Install it now: uv pip install trailmark “Defenders think in lists. Attackers think in graphs. As long as this is true, attackers win.” John Lambert’s widely cited observation about network security applies just as well to AI-assisted software analysis. When - **Tags:** #security --- ## [We beat Google’s zero-knowledge proof of quantum cryptanalysis](https://blog.trailofbits.com/2026/04/17/we-beat-googles-zero-knowledge-proof-of-quantum-cryptanalysis/) - **Source:** blog.trailofbits.com - **Date:** 2026-04-17T11:00:00.000Z - **Summary:** Two weeks ago, Google’s Quantum AI group published a zero-knowledge proof of a quantum circuit so optimized, they concluded that first-generation quantum computers will break elliptic curve cryptography keys in as little as 9 minutes. Today, Trail of Bits is publishing our own zero-knowledge proof that significantly improves Google’s on all metrics. Our result is not due to some quantum breakthrough, but rather the exploitation of multiple subtle memory safety and logic vulnerabilities in Google - **Tags:** #security --- ## [Master C and C++ with our new Testing Handbook chapter](https://blog.trailofbits.com/2026/04/09/master-c-and-c-with-our-new-testing-handbook-chapter/) - **Source:** blog.trailofbits.com - **Date:** 2026-04-09T11:00:00.000Z - **Summary:** We added a new chapter to our Testing Handbook: a comprehensive security checklist for C and C++ code. We’ve identified a broad range of common bug classes, known footguns, and API gotchas across C and C++ codebases and organized them into sections covering Linux, Windows, and seccomp. Whereas other handbook chapters focus on static and dynamic analysis, this chapter offers a strong basis for manual code review. LLM enthusiasts rejoice: we’re also developing a Claude skill based on this new chap - **Tags:** #security --- ## [What we learned about TEE security from auditing WhatsApp's Private Inference](https://blog.trailofbits.com/2026/04/07/what-we-learned-about-tee-security-from-auditing-whatsapps-private-inference/) - **Source:** blog.trailofbits.com - **Date:** 2026-04-07T11:00:00.000Z - **Summary:** WhatsApp’s new “Private Inference” feature represents one of the most ambitious attempts to combine end-to-end encryption with AI-powered capabilities, such as message summarization. To make this possible, Meta built a system that processes encrypted user messages inside trusted execution environments (TEEs), secure hardware enclaves designed so that not even Meta can access the plaintext. Our now-public audit, conducted before launch, identified several vulnerabilities that compromised WhatsApp - **Tags:** #security --- ## [Simplifying MBA obfuscation with CoBRA](https://blog.trailofbits.com/2026/04/03/simplifying-mba-obfuscation-with-cobra/) - **Source:** blog.trailofbits.com - **Date:** 2026-04-03T11:00:00.000Z - **Summary:** Mixed Boolean-Arithmetic (MBA) obfuscation disguises simple operations like x + y behind tangles of arithmetic and bitwise operators. Malware authors and software protectors rely on it because no standard simplification technique covers both domains simultaneously; algebraic simplifiers don’t understand bitwise logic, and Boolean minimizers can’t handle arithmetic. We’re releasing CoBRA, an open-source tool that simplifies the full range of MBA expressions used in the wild. Point it at an obfusc - **Tags:** #security --- ## [Mutation testing for the agentic era](https://blog.trailofbits.com/2026/04/01/mutation-testing-for-the-agentic-era/) - **Source:** blog.trailofbits.com - **Date:** 2026-04-01T11:00:00.000Z - **Summary:** Code coverage is one of the most dangerous quality metrics in software testing. Many developers fail to realize that code coverage lies by omission: it measures execution, not verification. Test suites with high coverage can obfuscate the fact that critical functionality is untested as software develops over time. We saw this when mutation testing uncovered a high-severity Arkis protocol vulnerability, overlooked by coverage metrics, that would have allowed attackers to drain funds. Today, we’re - **Tags:** #security --- ## [Wiz at Black Hat 2026: Driving AI Threat Readiness](https://www.wiz.io/blog/wiz-at-black-hat-2026) - **Source:** wiz.io/blog · **Author:** Tal Moriah - **Date:** 2026-08-04T13:06:10.000Z - **Summary:** Announcing new capabilities that help organizations prepare for the AI era by expanding visibility and accelerating response, so security teams can defend at machine speed. - **Tags:** #security --- ## [keyv and cacheable npm Package Hijacked in Supply Chain Attack](https://www.wiz.io/blog/keyv-and-cacheable-npm-supply-chain-attack) - **Source:** wiz.io/blog · **Author:** Merav Bar - **Date:** 2026-08-04T11:25:22.000Z - **Summary:** Wiz Research is actively investigating an ongoing software supply chain attack affecting multiple keyv/cacheable npm packages. - **Tags:** #security --- ## [Introducing the Wiz Sensor for Developer Workstations to Protect Endpoints in the AI Era](https://www.wiz.io/blog/introducing-the-wiz-sensor-for-developer-workstations) - **Source:** wiz.io/blog · **Author:** Shashank Golla - **Date:** 2026-08-03T14:02:36.000Z - **Summary:** As AI expands who builds software, the developer workstation is becoming a new security perimeter. AI and third-party software increasingly operate with access to your most sensitive credentials and cloud environments. - **Tags:** #security --- ## [S3 Clones in the Neoclouds](https://www.wiz.io/blog/s3-clones-in-the-neoclouds) - **Source:** wiz.io/blog · **Author:** Scott Piper - **Date:** 2026-07-31T13:48:07.000Z - **Summary:** S3 compatible services carry many of the same concerns as the original S3 service. This article highlights which assumptions break and what risks remain. - **Tags:** #security --- ## [Rethinking Scanning for the AI Era: Wiz’s Agentic Code Security System](https://www.wiz.io/blog/agentic-code-security) - **Source:** wiz.io/blog · **Author:** Amir Lande Blau - **Date:** 2026-07-30T16:47:57.000Z - **Summary:** Enterprise AI AppSec requires more than powerful models. It requires a system that balances speed, depth, and cost across the software lifecycle. - **Tags:** #security --- ## [CosmosEscape: Taking Over Every Database in Azure Cosmos DB](https://www.wiz.io/blog/cosmosescape-taking-over-every-database-in-azure-cosmos-db) - **Source:** wiz.io/blog · **Author:** Yuval Avrahami - **Date:** 2026-07-30T12:00:01.000Z - **Summary:** A critical vulnerability chain in Azure Cosmos DB enabled full read and write access to every Cosmos DB database. - **Tags:** #security --- ## [Wiz’s First 6 Months as Part of Google](https://www.wiz.io/blog/6-months-google) - **Source:** wiz.io/blog · **Author:** Assaf Rappaport - **Date:** 2026-07-29T14:00:01.000Z - **Summary:** Fast gets even faster: redefining security for the AI era and doubling down on our multicloud commit - **Tags:** #security --- ## [The Wiz Red Agent is Now Generally Available](https://www.wiz.io/blog/wiz-red-agent-is-ga) - **Source:** wiz.io/blog · **Author:** Mika Maymon - **Date:** 2026-07-29T12:50:56.000Z - **Summary:** Continuously uncover complex, exploitable risks to stay ahead in the AI Threat Era with the Red Agent - **Tags:** #security --- ## [The risk hiding behind exposed MCP servers](https://www.wiz.io/blog/the-risk-hiding-behind-exposed-mcp-servers) - **Source:** wiz.io/blog · **Author:** Hila Ramati - **Date:** 2026-07-28T15:58:22.000Z - **Summary:** How unauthenticated Model Context Protocol (MCP) servers are opening doors to sensitive cloud data, IAM, and command execution. - **Tags:** #security --- ## [Accelerating CISA BOD 26-04 Vulnerability and Triage Activities through Wiz](https://www.wiz.io/blog/cisa-bod-26-04-alignment-with-wiz) - **Source:** wiz.io/blog · **Author:** Aviram Ben Kalifa - **Date:** 2026-07-28T11:00:01.000Z - **Summary:** Wiz enables organizations to continuously assess environments against the CISA KEV catalog, automating risk prioritization, rapid remediation, and forensic triage workflows. - **Tags:** #security --- ## [Atlas: Wiz's autonomous AI Agent for vulnerability research, ranked #1 on CyberGym](https://www.wiz.io/blog/atlas-ai-vulnerability-researcher) - **Source:** wiz.io/blog · **Author:** Nir Ohfeld - **Date:** 2026-07-27T14:00:02.000Z - **Summary:** See how Wiz built Atlas, an autonomous AI system for vulnerability research that validates every finding with a real, working exploit. - **Tags:** #security --- ## [Opening the Black Box: Agentless Threat Detection for Virtual Appliances](https://www.wiz.io/blog/agentless-threat-hunting-fortigate) - **Source:** wiz.io/blog · **Author:** Shahar Dorfman - **Date:** 2026-07-22T14:24:50.000Z - **Summary:** Mapping appliances event logs to real-world campaigns: A step-by-step researcher’s guide to continuous agentless monitoring. - **Tags:** #security --- ## [Agentless Threat Detection: Illuminating Cloud Blind Spots](https://www.wiz.io/blog/agentless-visibility-uncovering-cloud-blind-spots) - **Source:** wiz.io/blog · **Author:** Shahar Dorfman - **Date:** 2026-07-21T13:26:13.000Z - **Summary:** How Agentless Workload Detection exposes hidden threats in virtual appliances and modern cloud networks. - **Tags:** #security --- ## [300 WINtegrations Strong: An Open Security Ecosystem Built for the Speed of AI](https://www.wiz.io/blog/wiz-integration-network-reaches-300) - **Source:** wiz.io/blog · **Author:** Daphna Dayan - **Date:** 2026-07-21T12:35:58.000Z - **Summary:** As AI accelerates how organizations build and how attackers operate, a deeply connected security ecosystem is how defenders keep up. - **Tags:** #security --- ## [Exploitation in the Wild of wp2shell](https://www.wiz.io/blog/wp2shell-cve-2026-63030-cve-2026-60137) - **Source:** wiz.io/blog · **Author:** Shahar Dorfman - **Date:** 2026-07-20T18:00:08.000Z - **Summary:** Wiz Research has identified exploitation of "wp2shell", a critical pre-auth RCE vulnerability chain impacting WordPress Core (CVE-2026-63030 & CVE-2026-60137). Attackers are deploying persistent webshells on vulnerable servers. Organizations should prioritize patching or applying WAF mitigations. - **Tags:** #CVE-2026-63030 #CVE-2026-60137 --- ## [The Red Agent POV: The One Boolean That Broke a B2B Platform’s Credit System](https://www.wiz.io/blog/red-agent-pov-business-logic) - **Source:** wiz.io/blog · **Author:** Red Agent - **Date:** 2026-07-15T13:33:42.000Z - **Summary:** Part 3: How the Red Agent bypassed a credit and paywall system by changing a single client-side value from false to true. - **Tags:** #security --- ## [M-Red-Team: AsyncAPI Supply Chain Compromise via GitHub Actions](https://www.wiz.io/blog/m-red-team-asyncapi-supply-chain-compromise-via-github-actions) - **Source:** wiz.io/blog · **Author:** Rami McCarthy - **Date:** 2026-07-14T10:33:36.000Z - **Summary:** Detect and mitigate malicious @asyncapi npm packages linked to the latest npm supply chain attack. - **Tags:** #security --- ## [Why IaC Coverage Belongs on Your Security Dashboard](https://www.wiz.io/blog/iac-coverage-security-dashboard) - **Source:** wiz.io/blog · **Author:** Salman Ladha - **Date:** 2026-07-13T12:34:03.000Z - **Summary:** Rethinking IaC coverage as a funnel that shows how much of your infrastructure is governed, traceable, and ready for remediation at speed - **Tags:** #security --- ## [How ProdSec uses Wiz](https://www.wiz.io/blog/how-prodsec-uses-wiz) - **Source:** wiz.io/blog · **Author:** Zlatko Unger - **Date:** 2026-07-09T16:20:08.000Z - **Summary:** Automation, resilience, and security for the modern age - **Tags:** #security --- ## [Wiz in the Verizon DBIR: How AI Acceleration and Cloud Sprawl Impact Modern Defense](https://www.wiz.io/blog/verizon-dbir-2026-ai-cloud-security) - **Source:** wiz.io/blog · **Author:** Wiz Threat Research - **Date:** 2026-07-09T16:18:49.000Z - **Summary:** Verizon's latest DBIR highlights how attackers are exploiting familiar weaknesses at increasing speed and scale. Here's what Wiz research reveals about vulnerabilities, trust relationships, and AI in modern cloud environments. - **Tags:** #security --- ## [GhostApproval: A Trust Boundary Gap in AI Coding Assistants](https://www.wiz.io/blog/ghostapproval-a-trust-boundary-gap-in-ai-coding-assistants) - **Source:** wiz.io/blog · **Author:** Maor Dokhanian - **Date:** 2026-07-08T14:00:00.000Z - **Summary:** Uncovering a category-level blind spot in modern AI coding assistants, and why the Human-in-the-Loop safety model fails against this classic threat - **Tags:** #security --- ## [Wiz ASM for any environment, any risk, everywhere](https://www.wiz.io/blog/wiz-asm-auto-recon) - **Source:** wiz.io/blog · **Author:** Mika Maymon - **Date:** 2026-07-08T12:19:24.000Z - **Summary:** Protect the modern attack surface with new auto-reconnaissance capabilities, deep internal context, and the Red Agent to find any risk, anywhere. - **Tags:** #security --- ## [FAQs from the Field: Is Wiz a Runtime Security Tool?](https://www.wiz.io/blog/is-wiz-a-runtime-security-tool) - **Source:** wiz.io/blog · **Author:** Shashank Golla - **Date:** 2026-07-06T20:23:50.000Z - **Summary:** It's a common question we hear from prospects: "Does Wiz actually do runtime, or is it just risk prevention?" The short answer is yes, Wiz does runtime. - **Tags:** #security --- ## [Build AI Security Agents with Wiz MCP](https://www.wiz.io/blog/introducing-wiz-mcp) - **Source:** wiz.io/blog · **Author:** Snegha Ramnarayanan - **Date:** 2026-07-02T11:00:00.000Z - **Summary:** Power AI-driven security with trusted security context, Wiz AI Agents, and Wiz AI Skills. - **Tags:** #security --- ## [Breaking Down the White House’s Actions on Post-Quantum Cryptography Readiness](https://www.wiz.io/blog/white-house-post-quantum-cryptography-executive-order) - **Source:** wiz.io/blog · **Author:** Mitch Herckis - **Date:** 2026-07-02T01:48:01.000Z - **Summary:** The U.S. Federal Migration to PQC Just Got Real - **Tags:** #security --- ## [Start Secure in the AI Era: Accelerating AI Threat Readiness with WizOS](https://www.wiz.io/blog/ai-threat-readiness-with-wizos) - **Source:** wiz.io/blog · **Author:** Allison Jackson - **Date:** 2026-06-30T17:50:35.000Z - **Summary:** As the time from vulnerability discovery to exploitation shrinks, building with minimal, secured components is more important than ever. Here is how WizOS helps. - **Tags:** #security --- ## [Bridging the Visibility Gap: A Unified Security Operating Model for Hybrid Cloud Teams](https://www.wiz.io/blog/sensor-wls-for-on-prem) - **Source:** wiz.io/blog · **Author:** Shashank Golla - **Date:** 2026-06-29T13:39:33.000Z - **Summary:** Move beyond chasing vulnerabilities to a unified hybrid risk strategy. The Sensor Workload Scanner is now GA and extends our risk prioritization engine to on-premise environments to identify the critical attack paths across your hybrid cloud. - **Tags:** #security --- ## [The Borderless Attack Surface: Securing Public Sector Hybrid Environments](https://www.wiz.io/blog/wiz-xm-securing-public-sector-hybrid-environments) - **Source:** wiz.io/blog · **Author:** Annam Iyer - **Date:** 2026-06-29T11:00:00.000Z - **Summary:** Aligning Modern CNAPP Telemetry with realistic risk assessments to drive agency efficiency through cross-team collaboration - **Tags:** #security --- ## [The Red Agent POV: Exploiting Broken Object-Level Authorization in an Airline GraphQL API](https://www.wiz.io/blog/red-agent-pov-bola) - **Source:** wiz.io/blog · **Author:** Red Agent - **Date:** 2026-06-29T09:31:40.000Z - **Summary:** Part 2: How the Red Agent bypassed backend resolvers to expose an entire airline booking database in fifteen minutes - **Tags:** #security --- ## [MCP Auto-Execution: From Git Clone to Cloud Compromise in Amazon Q VS Code Extension](https://www.wiz.io/blog/amazon-q-vulnerability) - **Source:** wiz.io/blog · **Author:** Maor Dokhanian - **Date:** 2026-06-26T12:00:01.000Z - **Summary:** By automatically loading MCP servers from workspace files, Amazon Q enabled attackers to execute code and access sensitive cloud environments. - **Tags:** #security --- ## [Uncovering Hidden Attack Paths in Cloud Environments Using Runtime Signals](https://www.wiz.io/blog/runtime-signals-in-security-graph) - **Source:** wiz.io/blog · **Author:** Shashank Golla - **Date:** 2026-06-25T11:59:34.000Z - **Summary:** Wiz now layers runtime signals into the Security Graph, exposing hidden attack paths to give security teams a complete picture of risk. - **Tags:** #security --- ## [How AI Is Rewriting the SecOps Playbook](https://www.wiz.io/blog/ai-rewriting-secops-playbook) - **Source:** wiz.io/blog · **Author:** Arie Zilberstein - **Date:** 2026-06-24T12:18:33.000Z - **Summary:** The threat landscape has changed. Adversaries operate at machine speed, shrinking attacks from days to minutes. Defenders can no longer investigate and respond before damage occurs. In this new era, Security Operations must prioritize speed, automation, and continuous decision-making. - **Tags:** #security --- ## [AI Threat Readiness Pillar 4: Detect and contain threats in real-time](https://www.wiz.io/blog/ai-threat-readiness-pillar-4) - **Source:** wiz.io/blog · **Author:** Shashank Golla - **Date:** 2026-06-23T12:33:11.000Z - **Summary:** Your guide to operationalizing AI-powered threat detection and response with Wiz to stay ahead of AI-driven attackers. - **Tags:** #security --- ## [Cloud-native Security for your Windows environment: Announcing the Wiz Runtime Sensor for Windows](https://www.wiz.io/blog/wiz-runtime-sensor-for-your-windows-environment) - **Source:** wiz.io/blog · **Author:** Shashank Golla - **Date:** 2026-06-22T13:21:47.000Z - **Summary:** Secure your Windows fleet without sacrificing performance. Wiz pairs real-time threat detection with a memory-safe architecture that scales efficiently to protect your essential cloud infrastructure. - **Tags:** #security --- ## [The President’s Executive Actions on AI Have a Lot to Say on Cybersecurity](https://www.wiz.io/blog/ai-executive-order-cybersecurity) - **Source:** wiz.io/blog · **Author:** Mitch Herckis - **Date:** 2026-06-18T12:52:21.000Z - **Summary:** The spotlight has been on frontier models, but the goals are more far reaching -- including supercharging cyber defense and remediating risk at machine speed - **Tags:** #security --- ## [The Red Agent POV: How it Reasoned its Way to SSRF](https://www.wiz.io/blog/red-agent-pov-ssrf) - **Source:** wiz.io/blog · **Author:** Red Agent - **Date:** 2026-06-17T14:33:51.000Z - **Summary:** Part 1: How the Red Agent uncovered a multi-step attack chain allowing SSRF-to-Local-File-Read on a GCP Cloud Run API - **Tags:** #security --- ## [Introducing the Red Agent POV Series](https://www.wiz.io/blog/red-agent-pov-series) - **Source:** wiz.io/blog · **Author:** Red Agent - **Date:** 2026-06-17T14:33:41.000Z - **Summary:** An inside look at how the Red Agent, our AI-Powered Attacker, uncovers complex, exploitable risks in the wild - **Tags:** #security --- ## [Wiz Exposure Management Dashboard: Your CTEM Command Center](https://www.wiz.io/blog/exposure-management-dashboard) - **Source:** wiz.io/blog · **Author:** Eyal Golombek - **Date:** 2026-06-16T10:53:02.000Z - **Summary:** New exposure management dashboard helps organizations align with CTEM to stay ahead in an era of AI exploiting vulnerabilities faster than ever - **Tags:** #security --- ## [Navigating the New Federal Logging Mandate | OMB Memorandum M-26-14](https://www.wiz.io/blog/navigating-the-new-federal-logging-mandate-or-omb-memorandum-m-26-14) - **Source:** wiz.io/blog · **Author:** Mitch Herckis - **Date:** 2026-06-12T12:00:01.000Z - **Summary:** The White House Memorandum puts in place an “adaptive framework,” where agencies make risk-based, prioritized logging decisions. - **Tags:** #security --- ## [AI Threat Readiness Pillar 3: Perform AI Code Analysis Natively in Wiz](https://www.wiz.io/blog/ai-threat-readiness-pillar-3) - **Source:** wiz.io/blog · **Author:** Salman Ladha - **Date:** 2026-06-11T22:17:33.000Z - **Summary:** Your guide to operationalizing AI-powered code analysis with Wiz to stay ahead of AI driven development and adversaries - **Tags:** #security --- ## [AI Threat Readiness Pillar 2: Accelerate Patching and Response](https://www.wiz.io/blog/ai-threat-readiness-pillar-2) - **Source:** wiz.io/blog · **Author:** Bandhna Bedi - **Date:** 2026-06-09T15:25:20.000Z - **Summary:** Your guide to operationalizing ownership, remediation, and response with Wiz to keep pace with the AI threat landscape. - **Tags:** #security --- ## [Introducing Wiz Cloud Cost: Powering Cost Management and Optimization with Context](https://www.wiz.io/blog/introducing-wiz-cloud-cost) - **Source:** wiz.io/blog · **Author:** Rotem Zarin - **Date:** 2026-06-08T12:00:00.000Z - **Summary:** Wiz unifies cloud and AI cost visibility to help teams eliminate waste and improve spend efficiency across their AWS, Azure, and GCP environments. - **Tags:** #security --- ## [AI Threat Readiness Pillar 1: Reduce Critical Exposures & Scan with AI](https://www.wiz.io/blog/ai-threat-readiness-pillar-1) - **Source:** wiz.io/blog · **Author:** Shaked Rotlevi - **Date:** 2026-06-04T14:19:33.000Z - **Summary:** Diving into the first pillar of the AI Threat Readiness Framework and how Wiz helps - **Tags:** #security --- ## [From Posture to Runtime: A Unified Approach to OpenShift Security](https://www.wiz.io/blog/openshift-posture-runtime-security-wiz) - **Source:** wiz.io/blog · **Author:** Daniel Lemos - **Date:** 2026-06-01T21:20:57.000Z - **Summary:** Unified visibility, posture, and runtime protection for security teams owning their side of the OpenShift shared responsibility model. - **Tags:** #security --- ## [Eliminate Critical API Attack Paths with Wiz API SPM](https://www.wiz.io/blog/introducing-wiz-api-spm) - **Source:** wiz.io/blog · **Author:** Mike McGuire - **Date:** 2026-06-01T15:02:08.000Z - **Summary:** Wiz API SPM is now GA, enabling customers to discover APIs, assess APIs for exploitability, and prioritize remediation to mitigate the risk of an API-related breach. - **Tags:** #security --- ## [Miasma: Supply Chain Attack Targeting RedHat npm Packages](https://www.wiz.io/blog/miasma-supply-chain-attack-targeting-redhat-npm-packages) - **Source:** wiz.io/blog · **Author:** Merav Bar - **Date:** 2026-06-01T12:45:51.000Z - **Summary:** Detect and mitigate malicious npm packages linked to the latest npm supply chain attack, based on the open sourced Mini Shai-Hulud malware. - **Tags:** #security --- ## [State of Post Quantum Cryptography](https://www.wiz.io/blog/state-of-post-quantum-cryptography) - **Source:** wiz.io/blog · **Author:** Scott Piper - **Date:** 2026-05-28T13:34:55.000Z - **Summary:** Discussion of PQC relevant statistics that we see across our customers and other data sources. - **Tags:** #security --- ## [Evidence at the Moment of Attack. Answers at AI Speed.](https://www.wiz.io/blog/wiz-sensor-forensics-ga) - **Source:** wiz.io/blog · **Author:** Shashank Golla - **Date:** 2026-05-27T16:03:11.000Z - **Summary:** Wiz Sensor Forensics is now generally available - automatically capturing forensic artifacts at the moment of detection and using AI to accelerate investigation for SOC and IR teams. - **Tags:** #security --- ## [Commit to Compromise: A New Threat Actor Targeting the Cryptocurrency Industry's Software Development Infrastructure](https://www.wiz.io/blog/threat-actors-target-crypto-orgs) - **Source:** wiz.io/blog · **Author:** Shira Ayal - **Date:** 2026-05-27T13:52:45.000Z - **Summary:** Wiz CIRT and Wiz Research detail JINX-0164, a threat actor using LinkedIn social engineering, custom macOS malware, and CI/CD hijacking to target cryptocurrency organizations. - **Tags:** #security --- ## [Defending at Machine-Speed: Building AI Threat Readiness with Wiz](https://www.wiz.io/blog/wiz-ai-threat-readiness-operating-model) - **Source:** wiz.io/blog · **Author:** Shaked Rotlevi - **Date:** 2026-05-27T12:00:02.000Z - **Summary:** How Wiz helps organizations adopt an AI Operating Model for AI Threat Readiness - **Tags:** #security --- ## [State of SDLC Security 2026: How Risk Scales in Modern Development](https://www.wiz.io/blog/sdlc-security-report-2026-key-takeaways) - **Source:** wiz.io/blog · **Author:** Wiz Threat Research - **Date:** 2026-05-26T12:45:02.000Z - **Summary:** Insights from real-world environments into how code, developer tooling, automation, and AI are reshaping application security. - **Tags:** #security --- ## [Claude Enterprise Meets the Security Graph: Wiz Integrates with Anthropic's Compliance API](https://www.wiz.io/blog/claude-wiz-integration) - **Source:** wiz.io/blog · **Author:** Snegha Ramnarayanan - **Date:** 2026-05-21T17:05:00.000Z - **Summary:** Security and compliance teams can now monitor Claude activity directly in Wiz, extending the workflows they already rely on to AI - **Tags:** #security --- ## [durabletask: TeamPCP's Latest PyPi Compromise](https://www.wiz.io/blog/durabletask-teampcp-supply-chain-attack) - **Source:** wiz.io/blog · **Author:** Rami McCarthy - **Date:** 2026-05-19T17:30:20.000Z - **Summary:** Discover the latest on malicious versions of the pypi package durabletask, matching TeamPCP tactics. - **Tags:** #security --- ## [Introducing Runtime Threat Detection for Google Cloud Run](https://www.wiz.io/blog/introducing-runtime-threat-detection-for-google-cloud-run) - **Source:** wiz.io/blog · **Author:** Shashank Golla - **Date:** 2026-05-19T13:17:41.000Z - **Summary:** Wiz Runtime Sensor support for Google Cloud Run Containers is now generally available, giving teams real-time threat detection and response for their serverless container workloads. - **Tags:** #security --- ## [The Worm That Keeps on Digging: TeamPCP Hits @antv in Latest Wave](https://www.wiz.io/blog/mini-shai-hulud-teampcp-hits-antv-supply-chain) - **Source:** wiz.io/blog · **Author:** Rami McCarthy - **Date:** 2026-05-19T08:29:30.000Z - **Summary:** Multi-ecosystem supply chain compromise by TeamPCP targets GitHub, NPM, and VSCode to steal credentials and establish persistence. - **Tags:** #security --- ## [From Cryptographic Blind Spots to Post-Quantum Agility: Introducing Wiz for PQC Readiness](https://www.wiz.io/blog/wiz-for-pqc-readiness) - **Source:** wiz.io/blog · **Author:** Addi Grinbaum - **Date:** 2026-05-18T11:00:01.000Z - **Summary:** Eliminate cryptographic blind spots and neutralize legacy debt with an integrated cryptographic asset inventory. Identify risks across code, cloud, and runtime, using the Wiz Security Graph to prioritize migration and protect against "Harvest Now, Decrypt Later" attacks. - **Tags:** #security --- ## [Beyond Findings: Connecting Exploitable Risk to Cloud Context with Wiz and HackerOne](https://www.wiz.io/blog/wiz-hackerone-integration) - **Source:** wiz.io/blog · **Author:** Rom Gendler - **Date:** 2026-05-13T13:00:02.000Z - **Summary:** See proven, exploitable risk in the context of your full cloud environment - **Tags:** #security --- ## [Fragnesia: Linux Kernel Local Privilege Escalation via ESP-in-TCP](https://www.wiz.io/blog/fragnesia-linux-kernel-local-privilege-escalation-via-esp-in-tcp) - **Source:** wiz.io/blog · **Author:** Merav Bar - **Date:** 2026-05-13T12:13:44.000Z - **Summary:** A new page-cache corruption vulnerability in the Dirty Frag family enables unprivileged local attackers to achieve root - **Tags:** #security --- ## [Introducing Wiz Audit History: Track Every Change Across your Environment](https://www.wiz.io/blog/introducing-audit-history) - **Source:** wiz.io/blog · **Author:** Guy Silberman - **Date:** 2026-05-12T13:24:56.000Z - **Summary:** Wiz Audit History is now GA, providing a continuous, cross-cloud timeline of changes to resource configurations and findings to accelerate incident response and simplify compliance. - **Tags:** #security --- ## [Mini Shai-Hulud Strikes Again: TanStack + more npm Packages Compromised](https://www.wiz.io/blog/mini-shai-hulud-strikes-again-tanstack-more-npm-packages-compromised) - **Source:** wiz.io/blog · **Author:** Rami McCarthy - **Date:** 2026-05-12T01:38:56.000Z - **Summary:** Detect and mitigate malicious npm packages linked to the latest Mini Shai-Hulud supply chain campaign targeting high-value developer tooling. - **Tags:** #security --- ## [Wiz at Wiz: Reducing Risk through Service Ownership](https://www.wiz.io/blog/reducing-risk-through-service-ownership) - **Source:** wiz.io/blog · **Author:** Kelsey Nelson - **Date:** 2026-05-11T13:00:00.000Z - **Summary:** How Wiz security uses Service Catalog to turn cloud risk into service ownership - **Tags:** #security