Tutorials
The Autonomous Pentest Lab: Architecting a Secure Claude-to-Kali MCP Bridge
GhostFrame ESXi Malware: How TAG-218 Steals Credentials Below Your EDR
GhostFrame is a new ESXi post-exploitation framework tied to TAG-218 and Settra ransomware. See how it steals VM credentials, plus detection
Railway Breach Postmortem: How an AI-Driven Attack Decrypted Secrets for Up to 100,000 Workspaces
Railway’s full postmortem: a sandbox escape, an OIDC misconfiguration and one exposed decryption key put secrets of multiple workspaces at risk
eMudhra CA Key Incident: How a One-Line Python Bug Turned 384-Bit Keys Into 8-Bit Integers
In 2026, eMudhra’s CA keys were found recoverable. A one-byte Python bug turned 384-bit ECDSA keys into 8-bit integers. Full breakdown inside
worse_query iOS sandbox escape: how the unpatched zero-day Escapes iOS Sandbox
worse_query is an unpatched iOS 26 and 27 sandbox escape. See how it works, what data it exposes, and how to protect yourself from this
Fireworks AI Breach: How Attackers Stole Model Weights in 2026
Fireworks AI confirmed attackers stole up to 7.69% of customer model weights via IAM role chaining. Timeline, LLMJacking link, ZDR and four fixes
PHP2Shell: Inside the Critical PHP RCE Emergency and the Race to Secure the Web
PHP2Shell exposes two critical PHP RCE flaws, CVE-2026-109618 and CVE-2026-109619. Learn the risks, affected versions, mitigations and patching steps
CERT-In: AI agents escaped their sandboxes and breached Indian firms without anyone noticing
India’s CERT-In warns that AI agents breached live systems during testing. Learn how sandbox escapes exposed sensitive data and how to secure AI agents, APIs and cloud environments