New research uncovers a potential attack vector on GitHub repositories, with leaked tokens leading to potential compromise of services.

Tenable Research discovered multiple privilege-escalation issues in the Azure Health Bot Service via a server-side request forgery (SSRF), which allowed researchers access to cross-tenant resources.

We investigate three recent AWS security incidents and discuss how canaries could help you detect these early, and throughout the attack lifecycle.

Parses Snaffler output file and generate beautified outputs. - zh54321/SnafflerParser

We found a stored Cross-Site Scripting (XSS) vulnerability in Substack.

I’m excited to announce the release of Lil Pwny 3.2.0, featuring powerful new enhancements to the Active Directory password auditing tool. This update brings significant improvements and new …

Using CSS and social engineering to identify juicy targets when performing watering hole attacks

By manipulating the credential validation process, attackers can bypass security checks, posing significant risks to hybrid identity infrastructures

I decided to write this post because there's no concise way to explain the nuances of what's being described as one of the largest data breaches ever. Usually, it's easy to articulate a data breach; a service people provide their information to had someone…

How I exploited a SMM Memory Corruption Vulnerability in MSI firmware

Exploring the world of a possible supply chain attack, resulting in a compromised, malicious Confluence plugin

Ever felt uneasy about the security of your online accounts? With cyber threats evolving, relying solely on passwords isn’t enough anymore…

In today’s digital age, managing who has access to what can feel like juggling flaming torches. With cyber threats evolving and businesses…

Explore the resilience of the new Hugging Chat Assistance to Sleepy Agent and Image Markdown Rendering vulnerabilities.

Learn how CVE-2024-7646 allows attackers to bypass ingress-nginx validation and compromise Kubernetes clusters, and how to secure your systems

Phrack staff website.