HackerOne report #1672388 by yvvdwf on 2022-08-17, assigned to @nmalcolm:

During the assessment of a PHP application, we recently came across a file upload vulnerability allowing the interpretation of PHP code inserted into valid PNG files. However, the image processing pe

Discover global private cryptographic keys embedded within the Siemens SIMATIC S7-1200/1500 PLC and TIA Portal product lines with Team82 and Claroty.

The Caffeine phishing-as-a-service platform has an intuitive interface, comes at a relatively low cost and provides many features and tools to its criminal clients.

Doyensec's Blog :: Doyensec is an independent security research and development company focused on vulnerability discovery and remediation.

a brief postMessage testing methodology

On a recent engagement I found myself testing a Kubernetes environment. Through application-level bugs I had gotten remote shell access to some of its containers. For further exploration and analysis…

With a CVSS rating of 9.9, the vulnerability fixed in SAP Security Note #3242933 affects SAP Manufacturing Execution and is considered significant.

My OSCP Pre-Preparation Phase. I'm not sure if I'll be able to afford the exam but what count's trying and learning things. I'm gonna give it a try. [Start Date: 21...

Operator require CRDs. In Kubernetes 1.25, CEL validation is in beta! Peek into the process of developing validations for CRDs with & without CEL

A deep dive into CVE-2021–42847

Cerberus is another simple stressing tool simulating DDoS attacks. - GitHub - francesco-ficarola/cerberus: Cerberus is another simple stressing tool simulating DDoS attacks.

Comparing the industry's top subdomain enumeration tools

developers can enroll in the Google Play Services beta and use Chrome Canary. Both features will be generally available on stable channels

After talking about LSMs (“Linux Security Modules”) it is time to continue talking about different technologies which leverage them. I am…

Via timing attacks, threat actors create phony public npm packages masked as private ones to deceive developers into downloading compromised packages

This repository includes code and IoCs that are the product of research done in Akamai's various security research teams. - akamai/akamai-security-research