Analysis

HPE OneView's CVSS 10.0: An Unauthenticated API Endpoint That Runs Commands

CVE-2025-37164 is a maximum-severity RCE in HPE OneView. An unauthenticated REST API endpoint executes arbitrary commands. 40,000+ exploit attempts on day one.

cve rce patch-now +1

Feb 1, 2026 · 6 min read

Ni8mare: n8n's CVSS 10.0 That Hands Over Your Entire Automation Stack

CVE-2026-21858 lets unauthenticated attackers take full control of n8n instances. 100K servers exposed, PoC is public, and your secrets are in the blast radius.

cve rce automation +1

Feb 1, 2026 · 5 min read

WinRAR's Six-Month-Old Bug Is a Favorite of Russian APTs, Chinese Espionage, and Brazilian Banking Trojans

CVE-2025-8088 is a path traversal flaw in WinRAR patched last July. Six months later, Sandworm, Turla, Gamaredon, RomCom, and financially motivated groups are still using it.

cve exploitation apt +2

Feb 1, 2026 · 7 min read

tutorial fundamentals ground-up +2

Authentication Attacks: Passwords, Sessions, and Tokens

How login systems break - brute force, credential stuffing, session hijacking, token flaws, and MFA bypass. The complete beginner's guide to auth attacks.

Cybersecurity Career Paths: Finding Your Direction

Offensive, defensive, GRC, cloud security, AppSec - the major cybersecurity career paths explained. What each role does, what skills you need, and how to choose.

Certifications, Learning Resources, and Next Steps

A practical guide to cybersecurity certifications, free and paid learning resources, communities, and building a plan for your first year in security.

Encryption Explained: Keeping Secrets on the Internet

Symmetric vs asymmetric encryption, how AES and RSA work conceptually, key exchange, and why encryption matters for security. No math required.

Jan 30, 2026 · 11 min read

Building Your First Security Lab

How to set up a safe, isolated environment for practicing cybersecurity skills - from a simple VM setup to a full attack-and-defend lab.

Jan 30, 2026 · 7 min read

Hardening 101: Practical Steps to Secure Systems

Practical system hardening for Linux and Windows - reducing attack surface, configuring firewalls, applying least privilege, and closing the gaps attackers exploit.

Hashing, Certificates, and TLS: Trust on the Internet

How hashing proves integrity, certificates prove identity, and TLS ties it all together. The second half of practical cryptography for beginners.

Jan 30, 2026 · 11 min read

How Web Applications Work (Before You Break Them)

Client-server architecture, request flow, cookies, sessions, and APIs. You need to understand the machine before you can find the cracks.

Incident Response: What Happens When Things Go Wrong

The structured process for handling security incidents - from detection to recovery. How IR teams contain breaches, investigate root cause, and prevent recurrence.

The Cyber Kill Chain: How Attacks Actually Work

The step-by-step anatomy of a cyberattack - from reconnaissance to objectives. Understanding the full chain so you know where to defend and where to break it.

Linux for Security: Your First 20 Commands

The essential Linux commands every security beginner needs - navigation, files, processes, and networking. No fluff, just what you'll actually use.

Logs and Monitoring: Your First Line of Defense

Understanding log types, where to find them, what to look for, and how SIEM tools turn raw data into actionable alerts. The foundation of every detection strategy.

Jan 30, 2026 · 7 min read

Networking Basics: How Computers Find Each Other

IP addresses, MAC addresses, DNS, and routing - explained from scratch. The networking foundation every security beginner needs.

Privilege Escalation: From User to Admin

How attackers go from low-privilege access to full system control. Linux and Windows techniques, common misconfigurations, and how defenders detect it.

Ports, Protocols, and Why They Matter for Security

What ports and protocols actually are, which ones matter, and how attackers and defenders use this knowledge. The final networking fundamental.

Reconnaissance: What Attackers See Before They Strike

Passive and active recon techniques - OSINT, DNS enumeration, port scanning, and attack surface mapping. The first stage of every attack.

Jan 30, 2026 · 7 min read

tutorial pentest detection +2

Reverse Shells Explained: The Complete Foundation

What reverse shells are, why attackers use them, how they work under the hood, and where they fit in the attack chain. The foundation before you touch a terminal.

Jan 30, 2026 · 11 min read

Reverse Shells: Hands-On Lab Guide for Practitioners

Lab setup, reverse shell techniques in 7 languages, TTY upgrades, encrypted shells, and detection rules. The practical follow-up.

tutorial pentest lab +2

Social Engineering: Hacking Humans

Phishing, pretexting, vishing, and why the human layer is the hardest to patch. The psychology behind social engineering and how to defend against it.

SQL Injection Explained: Talking to Databases You Shouldn't

How SQL injection works, why it's devastating, and how to prevent it. From basic injection to blind SQLi, explained for beginners.

Users, Permissions, and Why Root Is Dangerous

How Linux access control works - users, groups, file permissions, SUID, and sudo. Understanding this is understanding half of privilege escalation.

What Actually Happens When You Visit a Website

The full chain from URL to rendered page - DNS, TCP handshake, HTTP, and TLS. Understanding the request lifecycle is key to understanding web security.

Your First Vulnerability: Understanding XSS

Cross-Site Scripting explained from scratch - what it is, the three types, how attackers exploit it, and how to prevent it. With safe practice labs.

Windows Under the Hood: What Security Pros Need to Know

Registry, services, event logs, PowerShell, and Windows permissions. The Windows internals that matter for security work.

Jan 29, 2026 · 5 min read

Microsoft Office Zero-Day Gets Emergency Patch - CVE-2026-21509

Microsoft drops out-of-band patch for actively exploited Office vulnerability that bypasses OLE security controls. Here's what you need to know.

microsoft office cve +2

Jan 29, 2026 · 6 min read

React2Shell: The CVSS 10.0 That Hit 85,000 Servers

CVE-2025-55182 turned React Server Components into a one-request RCE. Nation-states and criminals moved within hours.

cve rce supply-chain +2

Jan 15, 2026 · 5 min read

The Citrix NetScaler Situation Just Got Worse

Mass exploitation of CVE-2024-8534 is ongoing. Notes from helping clients figure out if they're compromised.

citrix netscaler cve +2

News

year-review trends threat-landscape +1

What 2025 Taught Us About Security (The Real Version)

Looking back at a year of breaches, vulns, and trends. What actually mattered versus what got the headlines.

Jan 2, 2026 · 6 min read

passkeys authentication webauthn +2

Passkeys Are Finally Real and I Have Opinions

After years of promises, passwordless authentication is actually happening. My experience deploying passkeys and what's still broken.

Nov 18, 2025 · 5 min read

github-actions cicd supply-chain +1

I Audited Our GitHub Actions and Now I Can't Sleep

A look at the supply chain risks hiding in your CI/CD pipelines. Spoiler: it's worse than you think.

Nov 2, 2025 · 5 min read

News

Oct 21, 2025 · 5 min read

NIS2 Is Here and Most Companies Aren't Ready

The EU's NIS2 directive is now enforceable. A realistic look at what's required, who's affected, and why compliance programs are scrambling.

nis2 compliance eu +1

byovd drivers edr-bypass +2

BYOVD Is Out of Control and Nobody's Fixing It

Bring Your Own Vulnerable Driver attacks have gone from niche technique to standard playbook. After yet another incident, some thoughts on why we're losing this fight.

Sep 14, 2025 · 6 min read

kubernetes cloud-security misconfiguration +1

Every Kubernetes Cluster I've Tested This Year Had the Same Problem

After a dozen pentests involving K8s, I'm seeing the same misconfigurations over and over. Here's what keeps going wrong.

Aug 12, 2025 · 5 min read

Jul 18, 2025 · 5 min read

AI Phishing Isn't the Problem Everyone Says It Is (Yet)

Hot take: the panic about AI-generated phishing is overblown. The real AI threat to security is different than what the headlines suggest.

ai phishing llm +1

Breach

palo-alto apt firewall +2

Operation MidnightEclipse: When Your Firewall Becomes the Attacker's Foothold

Tracking a campaign that compromised hundreds of Palo Alto devices through CVE-2024-3400. This one got ugly fast.

Jun 3, 2025 · 5 min read

supply-chain open-source backdoor +1

The XZ Utils Backdoor: One Year Later, What Have We Learned?

A year after the discovery of the XZ Utils supply chain attack, examining what changed in open source security and what still keeps maintainers up at night.

Mar 29, 2025 · 5 min read

fortinet cve authentication-bypass +1

FortiGate Auth Bypass: We're Doing This Again

CVE-2024-55591 joins the long list of Fortinet vulnerabilities being mass-exploited. Notes from triaging this with clients.

Jan 24, 2025 · 6 min read

Jan 22, 2025 · 4 min read

Ivanti Connect Secure Under Mass Exploitation - What We Know So Far

Critical authentication bypass vulnerabilities in Ivanti's VPN appliances are being actively exploited. Here's the timeline, technical details, and what you should do right now.

ivanti vpn cve +2

News

Jan 20, 2025 · 5 min read

CISA's KEV Catalog Just Got Teeth: What the New BOD Means for You

The new binding operational directive expands KEV requirements beyond federal agencies. Here's what changed and why private sector should pay attention.

cisa kev compliance +2

Malware

lumma infostealer takedown +1

Inside the Lumma Stealer Takedown: How a Joint Operation Disrupted MaaS Infrastructure

A technical breakdown of the coordinated takedown of Lumma Stealer's infrastructure, the malware's capabilities, and why it'll probably be back.

Jan 15, 2025 · 5 min read

Malware

rust malware reverse-engineering +1

Why Malware Authors Are Switching to Rust (And What It Means for Defenders)

Examining the trend of malware written in Rust - from BlackCat to RustBucket - and the detection challenges this creates.

Jan 13, 2025 · 6 min read

osint investigation threat-intel +1

How I Actually Do OSINT Investigations

A realistic look at open source intelligence gathering - the tools I use, the process I follow, and why most OSINT tutorials are overly complicated.

Jan 11, 2025 · 6 min read

Breach

breach healthcare ransomware +1

MediSecure Breach: 13 Million Patient Records and a Ransomware Gang's Payday

Breaking down the MediSecure breach - how attackers compromised a prescription delivery service and walked away with one of Australia's largest healthcare data thefts.

Jan 8, 2025 · 6 min read

scattered-spider aitm phishing +2

Scattered Spider's AiTM Playbook: How They're Bypassing MFA at Scale

An analysis of Scattered Spider's adversary-in-the-middle techniques - the social engineering, the tooling, and why your MFA might not be enough.

Jan 6, 2025 · 6 min read

Breach

snowflake breach credentials +1

The Snowflake Situation: When Your Customer's Credentials Become Your Problem

Unpacking the wave of Snowflake customer breaches - it wasn't a Snowflake vulnerability, but the impact was massive. What shared responsibility really means.

Jan 3, 2025 · 5 min read