Information Security Services. Offensive Security, Penetration Testing, Mobile and Application, Purple Team, Red Team

Oligo Security reveals AirBorne, a new set of vulnerabilities in Apple’s AirPlay protocol and SDK. Learn how zero-click RCEs, ACL bypasses, and wormable exploits could endanger Apple and IoT devices worldwide — and how to protect yourself.

Shadow roles in AWS defaults can expose hidden attack paths enabling privilege escalation, cross-service access, and even account compromise

MCP rapidly enhances AI capabilities but introduces security challenges through its distributed architecture. Especially, the distributed nature of MCP requires a lot of NHIs and their secrets. Our research shows that MCP is a new source of leaks that already…

This Google Threat Intelligence Group report presents an analysis of detected 2024 zero-day exploits.

What is this product GFI MailEssentials all about? We’re living the future, right? So let’s ask the GFI AI.

Tencent’s Zhuque Lab recently dropped AI-Infra-Guard V2, an open-source, AI-driven security tool built specifically for MCP servers. After…

Summary MagicINFO exposes an endpoint which: Wrapping all together it is possible to upload a JSP file to execute arbitrary server-side code without having a valid user. Credit An independent security researcher working with SSD Secure Disclosure. Vendor…

Reverse engineering binaries often resembles digital archaeology: excavating layers of compiled code, interpreting obscured logic, and…

You've heard of vibe coding, but have you considered vibe hacking? I tried thinking less to find an authentication bypass and RCE in OpenGamePanel.

Learn how we managed to circumvent "phishing-resistant" MFA based on Windows Hello for Business, during an internal capture-the-flag competition.

Two CI/CD vulnerabilities in the nodejs/node GitHub repository exposed Node.js to remote code execution on Jenkins agents and the potential to merge unreviewed code to the main branch of the repository.

Explore how AI hiveminds and autonomous agents are transforming cyber attacks in 2025. Learn about their speed, adaptability, and impact

Chromium's advanced security still leaves enterprises vulnerable to local attacks. But it’s not Chromium’s fault. A deeper look via the Chromium issue tracker

How “Chimera” Nearly Destroyed X Business in 2025 — and What Every Small Business Must Learn

Instant YARA rule testing and validation in the browser.

A Foray into the Shadowy Corners of Reddit: Understanding Reddit Shadowbans