Hey! and welcome to another THEY BURNED MY BUG episode. This time, we introduce CVE-2025-25257. An SQLi that I spotted back in Feb. in case someone burn them before i get my bragging rights8157d42995395ba0c0cfccce37b934ebb63d3d5740ba43eda7fa853f389bca2a8…

How we bypassed Meta’s Llama Firewall in real-world tests at Trendyol

Posted by playzeroseige - 3 votes and 0 comments

Posted by oppai_silverman - 14 votes and 0 comments

Hello,

We have deployed Anubis to git.sr.ht.
After some internal discussions we have ultimately decided that the best course
of action to protect git.sr.ht from LLM crawlers is to deploy Anubis. This
software presents some users with a proof-of-work challenge which…

This report analyzes a historical class of security flaws known as “reflected vulnerabilities,”which were once potent zero-day attack vectors targeting early Windows versions and antivirussoftware. We examine classic exploitation techniques, such as parser…

Researchers from The DFIR Report, in partnership with Proofpoint, have identified a new and resilient variant of the Interlock ransomware group’s remote access trojan (RAT). This new malware,…

This is the personal website of Egidio Romano, a very curious guy from Sicily, Italy. He's a computer security enthusiast, particularly addicted to webapp security.

Partially solving the problem for procedures that need valid complex parameter types to fuzz, and open sourcing the tool

For my internship, I was tasked by my mentor Le Qi to analyze CVE-2024-30088, a double-fetch race condition bug in the Windows Kernel Image ntoskrnl.exe. A public POC demonstrating EoP from Medium Integrity Level to SYSTEM is available on GitHub here.
Additionally…

This course teaches you how to use the Binary Ninja debugger well enough to use it in classes that depend on it.

Inside Evalian’s SOC investigation of a Red Bull recruitment scam: fake job offers, Facebook phishing, and the detection techniques that stopped it.

A critical unauthenticated remote code execution (RCE) vulnerability was discovered in the Broadcom Symantec Altiris Inventory Rule Management (IRM) component of Symantec Endpoint Management.

Out of multiple conversations with people at BSD conferences, I noticed that many would love to see a chatbot that provides precise information on FreeBSD—for users, admins, and developers.
I strongly believe that there should not be an official chat.freebsd.org.…

Are you experienced in cybersecurity, ethical hacking, or penetration testing? We’re conducting a research study exploring how personality traits influence decision-making in cyber operations, and we want your perspective.📊 ~20-30 minutes | 🔐 100% anonymous

How a single alert led our team down a rabbit hole of sophisticated deception — and what we learned about the evolving threat landscape

In the never-ending cat-and-mouse game of cybersecurity, every advancement in defense inevitably drives attackers to evolve their tactics, exploiting new gaps and vulnerabilities. From the early days of signature-based antivirus solutions in the 1980s to…

This is the story of how I used a Gmail message to trigger code execution through Claude Desktop, and how Claude itself (!) helped me plan the attack.