Autonomous Ethical Hacking for continuous security

CVE-2026-66066: how a .mat file declared as image/png chains into arbitrary file read and remote code execution as root on a default Ruby on Rails application.

Ethiack research team discovered KindaRails2Shell (CVE-2026-66066): a critical RCE in Ruby on Rails via Active Storage. 500,000+ sites affected. Find out if you are and how to mitigate.

Can AI actually hack? And how easy is it to hack AI? Mohan Sriram K...

GTFOBins is a curated list of Unix-like executables that can be used to bypass local security restrictions in misconfigured systems.

Discover how attackers exploit HTTP redirect discrepancies to extract sensitive data embedded in URLs, and what you can do to prevent secret leakage in your web infrastructure.

513 likes, 33 comments. "Building Claude Skills as a Bug Bounty Hunter (Ep. 166)"

TL;DR The couple of bugs described below are common across different OAuth 2.0 implementations. The bugs may allow a malicious application to maintain an access to victim's account even after access revocation performed by the victim.

Unofficial MCP server for accessing your HackerOne reports, programs, scope, and earnings from Claude Code - Sicks3c/hackerone-mcp-server

Trailing Danger: exploring HTTP Trailer parsing discrepancies

HTTP parameter discovery suite. Contribute to s0md3v/Arjun development by creating an account on GitHub.

🤖 The Modern Port Scanner 🤖. Contribute to bee-san/RustScan development by creating an account on GitHub.

Welcome back! As we near the end of 2025, we are, of course, waiting for the next round of SSLVPN exploitation to occur in January (as it did in 2024 and 2025). Weeeeeeeee. Before then, we want to clear the decks and see how much research we can publish. This

A novel XS-Leak technique that turns ETag length differences into a cross-site oracle via 431 errors and History API.