The Proxy Saw One Request: http4s Ember HTTP Desync
Three http4s Ember flaws let proxies and origins disagree about HTTP request boundaries. Trace the mechanics, safe lab, detection, and durable fixes.
-
-
The Constructor Was the Endpoint: Jenkins Stapler Data Binding
Jenkins configuration forms can become constructor dispatch. Trace the September 2026 flaws, a safe mechanism lab, detection signals, and durable fixes.
-
The ID Was in the Body: CVE-2026-47849 and JSON Patch
CVE-2026-47849 let JSON Patch mutate Spring Data REST identifiers and version fields. This analysis verifies the binding flaw, traces the cross-record overwrite path, and maps practical detection and hardening controls.
-
ShieldBreak: When Defender Becomes the Privilege Boundary
ShieldBreak (CVE-2026-69414) abuses file-path resolution around Microsoft Defender. Trace the privilege chain, detection telemetry, and interim controls.
-
Pass-ta-Key: When Synced Passkeys Trust a Compromised Host
Unit 42’s Pass-ta-key research exposes device-trust and recovery attacks around Google-synced passkeys. Trace the mechanics, detection, and defensive choices.
-
Shodan.io for Offensive Security: Getting the Most Out of the Internet’s Search Engine
Practical Shodan.io guide for security teams: build precise queries, use facets, avoid false positives, automate checks, and validate internet exposure.
-
HackerDNA: 4 Steps to Train for Pentesting
How to use ethical hacking labs to train enumeration, exploitation, evidence gathering, and reporting discipline without falling into CTF habits.
-
The 5 Highest-Paying Bug Bounty Vulnerabilities
The five vulnerability classes that most often command the highest bug bounty payouts, with advanced local-lab examples, impact validation, mitigation guidance, and tips for stronger reports.
-
AI Recon: LLMs, RAGs, and Agents
Authorized reconnaissance for enterprise AI: map LLMs, RAG pipelines, agents, tools, IAM, APIs, cloud exposure, and evidence without drifting out of scope.
-
Autonomous Pentest Agent: AI, Red Team, and Attack Chains
Autonomous Pentest Agents can accelerate Red Team operations, but they also introduce risk around prompt injection, tool misuse, scope control, evidence quality, and detection.
-
Defensive Corporate OSINT: A Red Team Guide to Mapping Exposure, Identity, and Cloud
An advanced guide to defensive corporate OSINT from a Red Team perspective, covering identity, cloud, APIs, detection, and real attack chains.
-
Burp Suite Extensions for API Security
An AppSec guide to building safe Burp Suite extensions for authorized API assessments across JWT, BOLA/IDOR, mass assignment, rate limiting, OpenAPI drift, and evidence collection.
-
WAF Bypass in Practice: Real Techniques, Detection, and Mitigation
Learn real WAF bypass techniques, how to validate evidence safely, and which controls to apply for detection and mitigation in defensive environments.
-
Router Pentest with Claude: A Practical Security Assessment Methodology
A practical lab-based methodology for assessing router security with Claude, MCP, controlled recon, vendor disclosure, and defensible evidence handling.
-
Nmap on Android (ARM64): Fast Internal Recon from a Mobile Foothold
Why running Nmap on Android changes internal recon: faster enumeration from a mobile foothold, realistic constraints, and practical offensive tradecraft.
