Fixing security vulnerabilities in a timely manner is more complicated than you realize.

A look into how an unexpectedly weak PRNG in Dart led to Zellic's discovery of multiple vulnerabilities

We were having a nice uneventful week at watchTowr, when we got news of some ransomware operators using a zero-day exploit in Cleo MFT software - namely, LexiCom, VLTransfer, and Harmony - applications that many large enterprises rely on to share files securely.…

Messenger is used by hundreds of millions of people globally, and as of December 2023, it has adopted end-to-end encryption (E2EE) by default for chats and calls. However, when a group chat is created, it initially does not use E2EE. Interestingly, non-E2EE…

Join Deep Instinct Security Researcher Eliran Nissan as he exposes a powerful new DCOM lateral movement attack that remotely writes custom payloads to create an embedded backdoor.

Team82's research of Ruijie Networks’ cloud and device ecosystem uncovered 10 vulnerabilities that would allow an attacker to execute arbitrary code on every cloud-connected device. Team82 also developed an attack called Open Sesame that allows an attacker…

An analysis of CVE-2024-8534, a memory safety vulnerability leading to memory corruption and Denial of Service in NetScaler ADC and Gateway.

A homemade SSPM framework to uncover SaaS security risks

Our findings highlight that at least 336,000 servers expose their Prometheus servers and exporters to the internet

Intro This is another attempt as part of my @vr_progress to hack my old, unpatched OnePlus phone which didn’t get any updates for years. This time I chose CVE-2022-20201, a crafty little bug hiding in one of the subsystems used by Android’s package manager.

Messenger is used by hundreds of millions of people globally, and as of December 2023, it has adopted end-to-end encryption (E2EE) by default for chats and calls. However, when a group chat is created, it initially does not use E2EE. Interestingly, non-E2EE…

Until NTLM gets disabled by default, Microsoft is working on shoring up defenses against NTLM relay attacks.

Learn how to bypass HTML sanitizers by abusing the intricate parsing rules and mutations. Including my CVE-2024-52595 (lxml_html_clean bypass) and the solution to a hard challenge I shared online

We’ve crafted a bold defense strategy that not only slows scans but actively disrupts and deceives attackers.

Firefox is removing the Do Not Track setting from version 135 onwards. Mozilla recommends using Global Privacy Control setting as alternative,

Want to learn about using a static analysis tool called CodeQL to search for vulnerabilities in Google Chrome? Then this blog post is for you!

Misimplementation of PublicKeyCallback leads to authorization bypass in Go's x/crypto/sshPlatform.