What happens when you unleash an AI across all of Google's infrastructure? 1,500 APIs, 3,600 keys, and $500,000 in bounties later, here's what I found.

Visa Vulnerability Agentic Harness. Contribute to visa/visa-vulnerability-agentic-harness development by creating an account on GitHub.

A compatibility matrix tracking OAuth refresh-token support across 14 MCP clients. Covers status, root causes, SDK layers, and server-side workarounds.

A blog about bypassing authentication that is enforced only in client-side JavaScript, with four real-world case studies from bug bounty and Synack Red Team engagements.

I accidentally logged into a malicious website operated by threat actors after scrolling X. Here's how I do that.

There has been a lot of hype around Mythos and Large Language models being able to find and exploit vulnerabilities at scale recently, and while this may be true for these emerging frontier models, it's already a reality we live in today, and it's not just…

## Target

Burp Suite Professional 2026.3.3 on Windows.

## Summary

When Burp Scanner's browser-powered crawler crawls an attacker's website, the website can force Burp to write an...

Varonis Threat Labs discovered SearchLeak, a critical vulnerability chain in Microsoft 365 Copilot Enterprise that allows an attacker to steal sensitive data — MFA codes, email messages, meeting details, and private organizational files — with a single click.

An unauthenticated arbitrary file upload flaw in Amasty Order Attributes (CVE-2026-53787) lets attackers write executable files to a Magento store without lo...

cybersecurity, tech, and personal annoyance log

1. Introduction

CVE-2026-5667 – Unauthenticated remote control of Mitsubishi MAC-577IF-2E WiFi air conditioner adapters discovered via citywide probe request reconnaissance. Full technical writeup with PoC methodology.

AutoJack is a novel exploit chain showing how a single malicious webpage can turn an AI browsing agent into a remote code execution vector on the host machine. By abusing trust in localhost, missing authentication, and unsafe parameter handling, attackers…

Among models given nothing but a prompt, the best open-weight option beat Claude Opus 4.8.

Five years ago, a critical bug was rare and expensive to find. AI changed that overnight. What the quartz crisis in watchmaking reveals about hacking's future.

Campus Recruiting vulnerability exposed student information, and Audit Tracking Management System vulnerability exposed confidential internal audit data.

Contribute to Metnew/write-ups development by creating an account on GitHub.

How competent are local AI models for cyber security bug hunting and research?

Modern Android devices make biometric authentication feel routine: a touch, a glance, and the device accepts that the user is present. Underneath that convenience is a security boundary that is easy to underestimate. Fingerprint and face authentication are…