en
CVE-2026-59310: VMware vCenter Server Syslog Path Traversal Remote Code Execution
How attackers leverage CVE-2026-59310 in VMware vCenter Server's Syslog service to achieve unauthenticated root RCE and deploy reverse_ssh backdoors.
guides
en
CVE-2026-69836: Microsoft Entra ID's Critical CVSS 10.0 Deserialization Zero-Day
Technical analysis of CVE-2026-69836, a CVSS 10.0 deserialization flaw in Microsoft Entra ID actively targeted in cloud identity infrastructure.
en
Snowflake's GitHub Actions Injection: How an AI Red-Team Agent Found What Copilot Missed
How Wiz's autonomous AI red-team agent found a GitHub Actions command injection bug in a public Snowflake repository that Copilot-assisted review had missed.
en
CVE-2026-15748: Forminator Forms' Unauthenticated Arbitrary File Upload to RCE
Technical breakdown of CVE-2026-15748, the CVSS 9.8 unauthenticated arbitrary file upload flaw in Forminator Forms threatening 300,000 WordPress sites.
en
CVE-2026-18577: N-able N-central's Actively Exploited Authentication Bypass
Deep dive on CVE-2026-18577, the actively exploited N-able N-central authentication bypass that lets attackers pivot from RMM servers into managed customer endpoints.
en
CVE-2026-19478: GitLab's Critical Unauthenticated GraphQL Data Deletion Flaw
Deep technical analysis of CVE-2026-19478, GitLab's CVSS 9.4 unauthenticated GraphQL flaw that lets attackers delete public projects and user data.
en
CVE-2026-63520: Microsoft SharePoint's Remote Code Execution Vulnerability
Technical breakdown of CVE-2026-63520 and how threat actors chain SharePoint input validation bugs to achieve pre-auth remote code execution.
en
CVE-2026-62815: Microsoft QUIC's Critical Unauthenticated Remote Code Execution Flaw
Deep technical analysis of CVE-2026-62815, a CVSS 9.8 Use-After-Free vulnerability in Microsoft QUIC allowing zero-click RCE over UDP.
en
Inside ojo: How ColibriSec’s Scanner Finds Vulnerabilities, Secrets, and Misconfigurations
Under the hood of ojo's zero-dependency engine: manifest parsing, Tree-sitter SAST queries, OS package diffing, and offline vulnerability databases.
guides
OWASP Dependency-Track: Free SBOM-Powered Supply Chain Security for Everyone
A complete architecture and deployment guide for OWASP Dependency-Track using Docker Compose, FluxCD, and ArgoCD.
Homelab
World Accessible Pi with Cert Auth!
Step-by-step tutorial on securing a public-facing Raspberry Pi running Pi-hole, Squid, and Webmin with client TLS certificate authentication.
Hardware
Hashcat and Machine Learning on a budget
How to build a budget multi-GPU cracking rig and machine learning workstation using repurposed hardware.