CVE-2026-5667 – Unauthenticated remote control of Mitsubishi MAC-577IF-2E WiFi air conditioner adapters discovered via citywide probe request reconnaissance. Full technical writeup with PoC methodology.

AutoJack is a novel exploit chain showing how a single malicious webpage can turn an AI browsing agent into a remote code execution vector on the host machine. By abusing trust in localhost, missing authentication, and unsafe parameter handling, attackers…

Among models given nothing but a prompt, the best open-weight option beat Claude Opus 4.8.

Five years ago, a critical bug was rare and expensive to find. AI changed that overnight. What the quartz crisis in watchmaking reveals about hacking's future.

Campus Recruiting vulnerability exposed student information, and Audit Tracking Management System vulnerability exposed confidential internal audit data.

Contribute to Metnew/write-ups development by creating an account on GitHub.

How competent are local AI models for cyber security bug hunting and research?

Modern Android devices make biometric authentication feel routine: a touch, a glance, and the device accepts that the user is present. Underneath that convenience is a security boundary that is easy to underestimate. Fingerprint and face authentication are…

Well, well, well - once again, the cat has dragged us in and spat us out.

Today, we find ourselves questioning the reality we sit within. Must it be so predictable, and why us? “But watchTowr, what do you mean?”

Well, if you’re here, you likely fit into…

Detections for Claude on the execution layer: Sigma rules and a correlation runner that catch permission bypasses, rogue MCP servers, and more.

Analysis of a fixed Google Messages vulnerability that exposed contact photos without READ_CONTACTS, covering its root cause and responsible disclosure.

Trying to coerce useful work out of LLMs without the harness is like supervising a room full of drunk toddlers, each convinced they're helping, none of them checking with each other and falling over the next.

Who Am I?

RFC 8628's device authorization grant lets a TV or CLI

Critical issue discovered in WordPress Core affecting the majority of WordPress-built sites. A pre-authentication Remote Code Execution (RCE) that can be used by attackers to run malicious code to steal data or seize control without requiring login details.