Tutorials
The Autonomous Pentest Lab: Architecting a Secure Claude-to-Kali MCP Bridge
Fake RVTools Repos on GitHub Deploy a Rogue Action1 RMM Backdoor
Fake RVTools repos on GitHub install a signed Action1 RMM agent that gives attackers SYSTEM access. Get the IOCs, a triage script and more
mSecure Security Breach Notice: What We Know and What to Do Now
mSeven told mSecure users to rotate every password, 2FA code and passkey. Here is what the notice left out, what the BSI audit found, and what to do first
How Railway’s AI Testing Agent Went Rogue on Primcloud
Railway Primcloud incident: an AI testing agent by Railway tried to breach Primcloud. Primcloud blocked everything. Full timeline of the incident
Lovable Security Gap: How Supabase Defaults Exposed Data in Thousands of Vibe-Coded Apps
Crissy Field scanned 159,041 Lovable apps and found 7,403 exposing email data through Supabase tables with Row Level Security off. Here is how it happened
XCPE Botnet: Inside Videostrong’s Android Firmware Backdoor
Google says Shenzhen OEM Videostrong built the XCPE botnet into Android TV box firmware, infecting 1.3M devices. Here is how it works and how to respond
PHP2Shell: Inside the Critical PHP RCE Emergency and the Race to Secure the Web
PHP2Shell exposes two critical PHP RCE flaws, CVE-2026-109618 and CVE-2026-109619. Learn the risks, affected versions, mitigations and patching steps
CERT-In: AI agents escaped their sandboxes and breached Indian firms without anyone noticing
India’s CERT-In warns that AI agents breached live systems during testing. Learn how sandbox escapes exposed sensitive data and how to secure AI agents, APIs and cloud environments