We're excited to announce Tracebit Community Edition, a completely free-forever platform to deploy security canaries.

Model Context Protocol connects LLM apps to external data sources or tools. We examine its security implications through various attack vectors.

Critical React RCE vulnerability (React2Shell CVE-2025-55182) threatens Next.js apps. Learn how to detect with JFrog Xray and patch immediately.

Cloud security starts with thinking like the adversary—hack, test, and assess cloud environments built from real-world attacks.

Reverse engineering a dummy KAISTDE format and generating parsers with Kaitai Struct.

Air-gapped cybersecurity assistant for security professionals. 100% offline AI-powered analysis tool for Nmap, Volatility, BloodHound, Metasploit, YARA, and more. Built for environments where cloud AI isn't available.

Deploy free honey tokens across your infrastructure in minutes. Real-time alerts when credentials are used. No credit card required.

A comprehensive guide on extending Burp Scanner with custom scan checks.

We break down a new infostealer attack that combines the ClickFix technique with a shared chat containing malicious user guides on the official ChatGPT website.

Welcome back! As we near the end of 2025, we are, of course, waiting for the next round of SSLVPN exploitation to occur in January (as it did in 2024 and 2025).

Weeeeeeeee. Before then, we want to clear the decks and see how much research we can publish.…

Professional self-hosted phishing platform built for enterprises, red teams, and security providers. Deploy locally for complete control over campaigns, data, and infrastructure with unlimited simulations and full privacy.

Learn why Alias Robotics transitioned from CAI ONE to CAI PRO. Real-world usage revealed that token-based models are incompatible with AI security workflows. CAI PRO delivers unlimited, enterprise-grade autonomous security performance.

This blog post demonstrates how a modern variant of an hardware attack found in the 2000's allowed the extraction of a €12 smartwatch's firmware using only cheap and robust hardware. Damien and Thomas (introduced later in this post) gave a talk on this subject…

Require Google to Remove One-Click Full Logout URLs

Horizon3.ai uncovers FreePBX flaws, including CVE-2025-66039 auth bypass, SQL injection, and file upload RCE—and shows how NodeZero detects them.

Nextcloud - a safe home for all your data

On November 25th, one of our engineers was compromised by the Shai-Hulud npm supply chain worm. Here's what happened, how we responded, and what we've changed.