How a flagged Meta IP running an open Grafana turned into a five-hop chain ending at 507 private repositories. The full story, no code accessed.

15 kernel bugs, including 3 RCEs, 5 LPEs, and 1 bhyve escape.

Akwaaba! everyone. This one was quite fun, and I will breakdown my methodology. My last writeup was a $500 OAuth Account Fusion bug which…

Introduction
Hello, I’m RyotaK
( @ryotkak
), a security researcher at GMO Flatt Security Inc.
After publishing my previous article ( Pwning Claude Code in 8 Different Ways
), I continued investigating Claude-related products and found several more vulnerabilities.…

Turning a reflected HTML injection under a strict CSP into full credential theft by chaining password autofill with Referer header leakage.

Hello folks,

DarkReplica is a post-authentication Use-After-Free in Redis's replication subsystem. By abusing master-replica synchronization during a running Lua script, the freed Lua engine can be controlled to achieve arbitrary code execution.

Assalamu Alaikum. I’m Mahbubur Rahman Soraf, a part-time bug bounty hunter from Bangladesh.

A web pentest dead-end turned into RCE. I downloaded an EXE the app shouldn't have exposed, let AI walk me through .NET reverse engineering, and chained CSWSH into one-click code execution.

A bug bounty story about OAuth, PKCE, open client registration, and how multiple low-level issues chained together into a critical account…

Intigriti won Best Security Company (under 250 employees) at the 2026 SC Awards Europe.  

poc it like it's hot. Contribute to v12-security/pocs development by creating an account on GitHub.

Today, Ivanti published an advisory.

“No way?” we hear you say. "Yes way!"

Today’s advisory outlines two vulnerabilities in Ivanti’s Sentry product, appealing directly to our inner desire for sophisticated server-side, pre-authenticated vulnerabilities.…

ArubaOS 8.13.2.0 port 32000/TCP exposes an unauthenticated XML parser (default-xml-api AAA profile) that resolves SYSTEM external entities. Confirmed: OOB SSRF via wire-level pcap, internal port scan (9 ports confirmed open), attacker DTD fetch, and target…

SQL Server 2025 AI features can be abused for data exfiltration, NTLM coercion, and C2 traffic. See how attackers exploit them and how defenders can respond.

Few conversations cut through the noise to ask what AI means for those on the ground: the hunters, the security engineers, and the organizations trying to secure their data.

What's Changed
🎉 New Features

Added support for protocol redirects by @Mzack9999 in #7296
Added impacket integration by @Mzack9999 in #7356
Added wmi, tsch, scmr, and dcom helper modules for J...