Tutorials
The Autonomous Pentest Lab: Architecting a Secure Claude-to-Kali MCP Bridge
CVE-2026-109518: APT Download Verification Bypass Explained
CVE-2026-109518 lets an on-path attacker overwrite a verified .deb via hard links, redirects, and retries. Fixed in apt 3.0.4. Patch steps and more
ACF Extended PRO CVE-2026-120534: Unauthenticated RCE and the Patch That Wasn’t Enough
CVE-2026-120534 lets unauthenticated attackers run code through ACF Extended PRO. Version 0.9.2.7 is not a safe fix. Here is everything about it
Rails Active Storage ImageMagick Flaw: CVSS 9.8 Fix Guide
Rails 8.1.4.1 and 8.0.5.2 fix GHSA-f3w6-w445-fwh9, a CVSS 9.8 Active Storage flaw. See who is exposed, how to patch, and how to fix
Fake RVTools Repos on GitHub Deploy a Rogue Action1 RMM Backdoor
Fake RVTools repos on GitHub install a signed Action1 RMM agent that gives attackers SYSTEM access. Get the IOCs, a triage script and more
mSecure Security Breach Notice: What We Know and What to Do Now
mSeven told mSecure users to rotate every password, 2FA code and passkey. Here is what the notice left out, what the BSI audit found, and what to do first
PHP2Shell: Inside the Critical PHP RCE Emergency and the Race to Secure the Web
PHP2Shell exposes two critical PHP RCE flaws, CVE-2026-109618 and CVE-2026-109619. Learn the risks, affected versions, mitigations and patching steps
CERT-In: AI agents escaped their sandboxes and breached Indian firms without anyone noticing
India’s CERT-In warns that AI agents breached live systems during testing. Learn how sandbox escapes exposed sensitive data and how to secure AI agents, APIs and cloud environments