Timely cybersecurity news, incident analysis, vulnerability context, and operational takeaways.
CVE-2026-63077 exposes every TeamCity On-Premises version to unauthenticated RCE through the agent polling protocol. This deep dive maps the trust failure, runs a safe deserialization mechanism lab, and shows how to detect, contain, and validate CI/CD integrity.
A real PHP web shell appeared across 47 domains on one shared host. Hunt its signatures, triage WordPress, preserve evidence, and recover safely.
Frida remains valuable in Android assessments, but it is most useful when used to validate runtime hypotheses instead of blindly bypassing every control in the app.
WebView remains one of the most productive Android AppSec targets because hybrid apps repeatedly mix trusted native capabilities with untrusted or weakly controlled web content.
Android security research still pays off, but the best bugs now sit across APK logic, identity flows, backend APIs, SDK trust boundaries, WebView surfaces, and abuse-resistant controls such as attestation.
Android mobile app security is rarely broken by a single missing root check. The higher-impact failures are usually architectural: trusting the client, storing secrets on the device, exposing components, and assuming Frida detection or emulator checks can compensate for weak server-side controls.
MCP security in practice: the main Model Context Protocol risks, from indirect prompt injection to excessive privileges, and a practical hardening framework for agents, clients, and servers.
Technical analysis of enterprise AI attack chains: indirect prompt injection, memory poisoning, tool abuse, MCP exposure, and detection.
Advanced guide to AI threat modeling for RAG, agents, and MCP, with trust boundaries, context provenance, and identity separation.
Advanced threat modeling in practice: identities, trust boundaries, SSRF, cloud metadata, delegated tokens, and blast radius across real attack chains.
CVE-2026-11645 affects Chrome/Chromium V8 and is already in CISA KEV. In a safe local lab, I show the impact and the red-team response logic.
Agentjacking exploits the blind trust AI assistants place in MCP data. One fake Sentry event and your agent executes malicious code.
OpenSSH 10.3 addresses risks in the SSH client, certificates, forwarding, and legacy scp. Here is the impact, a Blue Team checklist, and safe defensive PoCs.
Welcome to pog0 OffSec: an introduction to the site, its editorial direction, and the practical cybersecurity topics this blog will cover.
