A bug bounty story about OAuth, PKCE, open client registration, and how multiple low-level issues chained together into a critical account…

Intigriti won Best Security Company (under 250 employees) at the 2026 SC Awards Europe.  

poc it like it's hot. Contribute to v12-security/pocs development by creating an account on GitHub.

Today, Ivanti published an advisory.

“No way?” we hear you say. "Yes way!"

Today’s advisory outlines two vulnerabilities in Ivanti’s Sentry product, appealing directly to our inner desire for sophisticated server-side, pre-authenticated vulnerabilities.…

ArubaOS 8.13.2.0 port 32000/TCP exposes an unauthenticated XML parser (default-xml-api AAA profile) that resolves SYSTEM external entities. Confirmed: OOB SSRF via wire-level pcap, internal port scan (9 ports confirmed open), attacker DTD fetch, and target…

SQL Server 2025 AI features can be abused for data exfiltration, NTLM coercion, and C2 traffic. See how attackers exploit them and how defenders can respond.

Few conversations cut through the noise to ask what AI means for those on the ground: the hunters, the security engineers, and the organizations trying to secure their data.

What's Changed
🎉 New Features

Added support for protocol redirects by @Mzack9999 in #7296
Added impacket integration by @Mzack9999 in #7356
Added wmi, tsch, scmr, and dcom helper modules for J...

What happens when you unleash an AI across all of Google's infrastructure? 1,500 APIs, 3,600 keys, and $500,000 in bounties later, here's what I found.

Visa Vulnerability Agentic Harness. Contribute to visa/visa-vulnerability-agentic-harness development by creating an account on GitHub.

A compatibility matrix tracking OAuth refresh-token support across 14 MCP clients. Covers status, root causes, SDK layers, and server-side workarounds.

A blog about bypassing authentication that is enforced only in client-side JavaScript, with four real-world case studies from bug bounty and Synack Red Team engagements.

I accidentally logged into a malicious website operated by threat actors after scrolling X. Here's how I do that.

There has been a lot of hype around Mythos and Large Language models being able to find and exploit vulnerabilities at scale recently, and while this may be true for these emerging frontier models, it's already a reality we live in today, and it's not just…

## Target

Burp Suite Professional 2026.3.3 on Windows.

## Summary

When Burp Scanner's browser-powered crawler crawls an attacker's website, the website can force Burp to write an...

Varonis Threat Labs discovered SearchLeak, a critical vulnerability chain in Microsoft 365 Copilot Enterprise that allows an attacker to steal sensitive data — MFA codes, email messages, meeting details, and private organizational files — with a single click.

An unauthenticated arbitrary file upload flaw in Amasty Order Attributes (CVE-2026-53787) lets attackers write executable files to a Magento store without lo...

cybersecurity, tech, and personal annoyance log

1. Introduction