Malicious browser extension: inside KREMLIN banking malware

Sovereign Shield, Alliance Sword: Evolving NATO's Strategic Communications Doctrine for Cognitive Warfare

UAC Bypass - CMSTPLUA COM Exploitation | 0xSec

Bring Your Own Trusted Caller (BYOTC): A New Way to Exploit Vulnerable Windows Drivers (Part 1)

Malware on the Blockchain: An Ongoing Campaign's New WebRTC Twist

WeWorm

NetNTLMv1 Is Dead. Long Live NetNTLMv1. | Outflank

How to use Codex for Bug Bounty: research, test and validate

SHARE Foundation: Students and Opposition Politicians Targeted by Spyware - SHARE Fondacija

German government blames Russia for Leipzig airport drone attack with explosives

‘Unprecedented’ number of Apple users received recent spyware alert, say investigators | TechCrunch

Dan Driscoll, le secrétaire à l’armée de terre américain, démissionne après plusieurs mois de tension avec Pete Hegseth

French intelligence chief warns of more ‘violent, hostile action’ after Leipzig drone attack

What's in a tag name? JavaScript, apparently

SLEEPWALKER: A Passive Backdoor With Its Own Command Language

AWSHound: An Open-Source AWS OpenGraph Collector

Grand Remplacement

Poutine ouvre-t-il un front dans le Pacifique ?

SAML Vulnerabilities and Attacks: A Practical Guide

Attack of The Extensions

Return of the Cookie Monster

Shattering the Dream - When a Job Offer Becomes a Zero-Day Attack - Check Point Research

GitHub - KriyosArcane/TrustMeBro: Authenticode signature manipulation toolkit for Red Team operations and security research. Covers signature stealing, metadata cloning, SIP hijacking across 19 file types, WinVerifyTrust FinalPolicy bypass, PKCS#7 payload embedding, SIP execution surface implants, Smart App Control Bypass, and analyst-triggered persistence via OID handlers.

GitHub - ivancabrera02/pyTGTdeleg

Can AI do novel security research? Meet the HTTP Terminator

CRLF-Powered Desync Attacks: Beheading HTTP Streams

Inside the Falcon How CrowdStrike Catches You

Clustered Points of Failure

KindaRails2Shell - Critical RCE in Rails via Active Storage (CVE-2026-66066) | Ethiack — Autonomous Ethical Hacking for continuous security

RefluXFS: A Linux Kernel Local Privilege Escalation to Root in XFS (CVE-2026-64600) | Qualys

Special Token Injection (STI) Attack Guide

GitHub - projectdiscovery/depx: Malicious package & supply-chain intelligence

CVE-2026-54121.md

Statement of attribution to Russia of malicious cyber activities targeting France for espionage purposes | France Diplomatie

EU and UK officially blame Russian spies for cyberattack on Poland's power grid

Windows Privilege Abuse: Attackers' Path to Active Directory Compromise

Authentication Bypass in the default configuration phpBB

Qemouflage: Beyond the EDR’s Reach

klist.exe Revisited: Internals and Further Use Cases – Jake Otte

It’s 37oC, And All We Can Think About Is ColdFusion (Adobe ColdFusion Security Bulletin APSB26-68 CVE Bonanza)

We have Mythos at Home: GLM 5.2 beats Claude in our Cyber Benchmarks

Enterprise Tech In, Shell Out (Progress Kemp LoadMaster Uninitialized Heap to Pre-Auth RCE CVE-2026-8037)

Claude Code Is Steganographically Marking Requests

Sleeper Squats: How a Hyphen (Almost) Unraveled GitHub's Immutable OIDC Subject Claim | Boost Security Labs

Le contrat qui prouve qu’Erik Tegnér agissait comme un agent d'influence du pouvoir hongrois

Public PoC Released for Critical libssh2 CVE-2026-55200 Client-Side SSH Flaw

When EPA isn't EPA'ing: What Tools Like Certify, Certipy and checkMSSQLStatus.py miss

PoC Released for Microsoft Exchange Server EWS InstallApp SSRF Vulnerability

Quand Annie Genevard, ministre de l’agriculture, invite BASF à faire blanchir l’un de ses herbicides