Gunra Before Encryption: Detect the Ransomware Handoff
Gunra’s locker is the last stage. Detect the earlier handoff from VPN compromise to remote access, exfiltration, backup deletion, and offline encryption.
- FeaturedAI Security
Advanced Threat Modeling: Identities, Trust Boundaries, and Attack Chains
Advanced threat modeling in practice: identities, trust boundaries, SSRF, cloud metadata, delegated tokens, and blast radius across real attack chains.
-
-
The Page Was Blank: Inside macOS ClickFix Cloaking
A macOS ClickFix campaign hid its lure behind browser fingerprinting. This analysis reproduces the gate safely and builds detection across web, endpoint and identity telemetry.
-
An SBOM Is Not an Alarm: Build a VEX Decision Pipeline
CISA’s 2026 SBOM baseline improves software identity and evidence quality. This advanced guide turns that inventory into an auditable VEX pipeline for exploitability decisions, release policy, and detection.
-
CVE-2026-63077: When TeamCity Deserializes Trust
CVE-2026-63077 exposes every TeamCity On-Premises version to unauthenticated RCE through the agent polling protocol. This deep dive maps the trust failure, runs a safe deserialization mechanism lab, and shows how to detect, contain, and validate CI/CD integrity.
-
OWAReaper and the Half-Click: When Reading Email Runs Code
TA488 turned ordinary webmail rendering into browser-resident access. Trace OWAReaper from reading pane to persistence, then hunt its mailbox and browser artifacts.
-
CVE-2025-68686: The FortiOS Patch Bypass That Starts After Compromise
CVE-2025-68686 is not initial access. It is a FortiOS SSL-VPN symlink patch bypass that turns prior filesystem compromise into remote data exposure.
-
GitLost: When a Public Issue Can Read a Private Repo
GitLost turned a public GitHub issue into a private-repository disclosure. Trace the confused-deputy chain, reproduce it safely, and harden agentic CI.
-
wp2shell: How WordPress Route Confusion Became RCE
wp2shell chains WordPress REST route confusion with SQL injection to reach pre-auth RCE. Learn the mechanics, affected versions, evidence sources, and safe response workflow.
-
GhostApproval: When AI Agent Approval Dialogs Lie
GhostApproval turns a harmless-looking AI agent edit into an out-of-workspace write. Learn the symlink mechanics, safe lab reproduction, detection, and race-resistant defenses.
-
The Same PHP Web Shell Appeared Across 47 Domains—Here’s How to Hunt It
A real PHP web shell appeared across 47 domains on one shared host. Hunt its signatures, triage WordPress, preserve evidence, and recover safely.
-
SharePoint Exploitation in 2026: Patch, Hunt, and Harden
Active SharePoint exploitation demands more than patching. Validate every farm node, hunt IIS and EDR telemetry, rotate trust material, and harden the complete attack path.
-
Shodan.io for Offensive Security: Getting the Most Out of the Internet’s Search Engine
Practical Shodan.io guide for security teams: build precise queries, use facets, avoid false positives, automate checks, and validate internet exposure.
-
Ransomware Recovery: Where to Find Public Decryptors Before You Pay
A practical guide for security teams on when public ransomware decryptors work, where to find them, and how to avoid making recovery worse.
-
Frida for Modern Android Assessments: What Still Works, What Breaks, and Where It Wastes Time
Frida remains valuable in Android assessments, but it is most useful when used to validate runtime hypotheses instead of blindly bypassing every control in the app.
-
WebView Is Still a Mess: Android Hybrid Apps Keep Repeating the Same Security Mistakes
WebView remains one of the most productive Android AppSec targets because hybrid apps repeatedly mix trusted native capabilities with untrusted or weakly controlled web content.
