Preface

Take potentially dangerous PDFs, office documents, or images and convert them to a safe PDF.

TruffleHog now detects JWTs signed with public-key cryptography and verifies them for liveness. This new detector has already found hundreds of live JWTs for our customers.

It was yet another day at the office. Our team was internally discussing moving to a different platform analytics solution. Our team was really leaning more towards Posthog. It’s one of the brilliant -I personally believe it’s the best- products on the market.…

elttam is a globally recognised, independent information security company, renowned for our advanced technical security assessments.

Learn more about JUMPSHOT: XM Cyber Uncovers Critical Local Privilege Escalation (CVE-2025-34352) in JumpCloud Agent . Read more on XM Cyber website.

Evalian SOC investigates a phishing campaign targeting HubSpot users and how attackers used MailChimp & BEC to steal credentials.

Execute code securely in isolated virtual machines with our high-performance cloud infrastructure.

Introducing Pathfinding.cloud, a library of AWS IAM privilege escalation paths

Access your desktop computer or other devices remotely from home or on the road with our AI-enhanced remote desktop software. Trusted, secure, and fast.

How we pwned X (Twitter), Vercel, Cursor, Discord, and hundreds of companies through a supply-chain attack - writeup.md

Principal Security Engineer Tao Sauvage uncovers four SAPCAR bugs, where parsing a SAR archive could lead to local privilege escalation.

We don’t lack cybersecurity ideas. We lack companies hiring juniors and products that are secure by default. These two problems are connected, and until we fix both, we’ll keep talking about a skills shortage while making it impossible to build a secure society.

In this blog post, we present our approach for uncovering vulnerabilities by combining LLM reasoning with static analysis. By layering an LLM on top of CodeQL, we significantly reduce the...

A critical vulnerability in mcp-remote affected 558,846 downloads. The bug was client-side, but the attack exploited OAuth dynamic discovery—a trust assumption that breaks for autonomous agents.