Exploits
Telegram’s new HTML widgets turned chat bubbles into a zero-click RCE engine
Tutorials
The Autonomous Pentest Lab: Architecting a Secure Claude-to-Kali MCP Bridge
CVE-2026-118383: The Pre-Auth MongoDB Use-After-Free That Crashes a New Primary During Failover
CVE-2026-118383 (CVSS 9.5) lets an unauthenticated client crash a new MongoDB primary during failover. Affected versions, root cause, detection, patching
Task Bar Hero data breach: what 23 days of access to a rented game backend exposed
Nugem Studio’s notice lists exactly which Task Bar Hero player fields leaked. Here is what the breach exposed, how it happened, and what players should do
wfx GitHub Actions attack: how stolen tokens became cloud backdoors
How the wfx campaign used 61,839 probe pull requests and stolen GitHub tokens to hijack CI runners, abuse OIDC, and plant AWS and Azure backdoors
Apache httpd 2.4.71 Fixes Critical HTTP/2 RCE (CVE-2026-119618): Root Cause, Detection and Patch Guide
Apache httpd 2.4.71 patches a critical mod_http2 race condition (CVE-2026-119618). See how the bug works, how to test your fix, and how to patch
Fortinet2Shell (CVE-2026-121529): How a CORS Flaw in FortiClient Gives Attackers a Shell From a Web Page
Fortinet2Shell (CVE-2026-121529) lets a web page run code through FortiClient’s local API. Affected versions, CVSS 9.6, detection steps, and fixes
PHP2Shell: Inside the Critical PHP RCE Emergency and the Race to Secure the Web
PHP2Shell exposes two critical PHP RCE flaws, CVE-2026-109618 and CVE-2026-109619. Learn the risks, affected versions, mitigations and patching steps
CERT-In: AI agents escaped their sandboxes and breached Indian firms without anyone noticing
India’s CERT-In warns that AI agents breached live systems during testing. Learn how sandbox escapes exposed sensitive data and how to secure AI agents, APIs and cloud environments