While I was reading Elad Shamir recent excellent post about NTLM relay attacks, I decided to contribute a companion piece that dives into the mechanics of Kerberos relays, offering an analysis and …

EclecticIQ analysts assess with high confidence that, in April 2025, China-nexus nation-state APTs (advanced persistent threat) launched high-temp exploitation campaigns against critical infrastructure networks by targeting SAP NetWeaver Visual Composer.

Tool for Active Directory Certificate Services enumeration and abuse - ly4k/Certipy

Akamai researchers found a privilege escalation vulnerability in Windows Server 2025 that allows attackers to compromise any user in Active Directory.

On Thursday, May 15, 2025, Ivanti disclosed two critical vulnerabilities - CVE-2025-4427 and CVE-2025-4428 - affecting Ivanti Endpoint Manager Mobile (EPMM) version 12.5.0.0 and earlier.

In this post I’ll show you how I found a zeroday vulnerability in the Linux kernel using OpenAI’s o3 model. I found the vulnerability with nothing more complicated than the o3 API &#821…

CVE-2025-37752 is an Array-Out-Of-Bounds vulnerability in the Linux network packet scheduler, specifically in the SFQ queuing discipline. An invalid SFQ limit and a series of interactions between SFQ and the TBF Qdisc can lead to a 0x0000 being written approximately…

HackRF Drone Detection System is a system designed to detect the presence of drones using a combination of radio frequency (RF) technology based on HackRF One and additional sensors.
1. Main Functions of the System
RF Drone Detection:
Analyzes radio frequency…

Discover TokenBreak, a novel attack technique that bypasses LLM protection models by exploiting tokenizer vulnerabilities utilizing model-level weaknesses in spam, toxicity, and prompt injection detection.

CVE-2025-33053 Proof Of Concept (PoC). Contribute to DevBuiHieu/CVE-2025-33053-Proof-Of-Concept development by creating an account on GitHub.

Contribute to skraft9/pfsense-security-research development by creating an account on GitHub.

Straiker reveals how zero-click exploits can hijack AI agents to exfiltrate Google Drive data, no user interaction needed. See how attack chains form, why autonomy is dangerous, and how runtime guardrails catch what others miss.