A big part of what I do for PentesterLab is reading CVEs. I spend a lot of time going through them: ...
⚒️ evilsocket / audit • 🤖 Autonomous fuzzing process under LLM supervision • 💰 StubZero: $148,337 RCE in Google Cloud Production
🐚 The React2Shell Story and What Happened Next.js • 🏛️ Mythos finds a curl vulnerability • 🤖 Claude Code RCE: Exploiting Deeplink Handlers via Settings Injection
🤖 AI threats in the wild: The current state of prompt injections on the web • 🪟 Persistence Atlas: 19 Techniques Nobody Talks About • 😳 Securing GitHub: Wiz Research uncovers RCE in GitHub.com
📆 The zero-days are numbered • 🔁 High-Quality Chaos • 🪡 Needle in the haystack: LLMs for vulnerability research
Back when I worked in appsec, I wrote the same tool twice for two different companies. Both times it was a ...
🤖 Lessons Learned From RITSEC CTF • 😼 Fail Open, Game Over: Turning a One-Line Tomcat Fix into Unauthenticated RCE • 🤖 I Let Claude Opus Write a Chrome Exploit
👾 GDDRHammer and GeForge: GPU Rowhammer Now Achieves Full System Compromise • 🤖 Assessing Claude Mythos Preview’s cybersecurity capabilities
✨ ImageMagick: From Arbitrary File Read to File Write In Every Policy • 🧑🏻💻 Leveling Up Secure Code Reviews with Claude Code • 🤖 Vulnerability Research Is Cooked
Everyone is panicking about AI-generated zero days. They should be paying attention to the other side of the equation. Anthropic recently ...
☁️ Remote Command Execution in Google Cloud with Single Directory Deletion
🤖 Testing AI for Vulnerability Research: 4 Approaches & Where I Failed • 🛠️ Hyoketsu – Solving the Vendor Dependency Problem in RE • 🐧 Sashiko
As part of our CVE monitoring, we came across GHSA-pcq9-mq6m-mvmp (CVE-2025-68402), an authentication bypass in FreshRSS, a self-hosted RSS aggregator. It ...