Update: This post received a large amount of attention on Hacker News — see the discussion thread.

This morning, an advisory was released for Next.js about a vulnerability that leads to RCE in default configurations, with no prerequisites. The root cause of this issue lies in React Server Components, which Next.js utilizes. Over the last day, we have noticed…

Searchable index of CVE proof-of-concept links collected from GitHub.

A novel and powerful twist on an old classic.

See how prompt injection attacks work in ServiceNow to perform unauthorized actions, and how to defend against it with AppOmni AgentGuard.

AI-driven GitHub Actions expose new prompt-injection supply chain vulnerabilities.

How I found a large network of fake support groups spreading crypto stealers and drainers.

A subtle AWS privesc hiding in SageMaker lifecycle configs, and what it reveals about execution roles.

Professional self-hosted phishing platform built for enterprises, red teams, and security providers. Deploy locally for complete control over campaigns, data, and infrastructure with unlimited simulations and full privacy.

Posted by esmurf - 39 votes and 9 comments

Generate HTML/SVG payloads for testing Server-Side Request Forgery vulnerabilities.

Posted by filippo_cavallarin - 17 votes and 0 comments

Utilizing the Chrome DevTools Protocol to delegate C2 HTTP-traffic.

With over 3 billion users globally, mobile instant messaging apps have become indispensable for both personal and professional communication. Besides plain messaging, many services implement...

Compromising Developers with Malicious Extensions - VS Code, Cursor AI, and the Backdoor You Didn't See Coming.

We're excited to announce Tracebit Community Edition, a completely free-forever platform to deploy security canaries.

Model Context Protocol connects LLM apps to external data sources or tools. We examine its security implications through various attack vectors.

Critical React RCE vulnerability (React2Shell CVE-2025-55182) threatens Next.js apps. Learn how to detect with JFrog Xray and patch immediately.

Cloud security starts with thinking like the adversary—hack, test, and assess cloud environments built from real-world attacks.