The Gold Mine Red Teamers Never Touch www.abdulmhsblog.com/posts/useing...

How Windows PE Files Use Custom Resources to Embed Anything trainsec.net/library/wind...

CVE-2026-40369: Twelve Bytes to Escape the Browser Sandbox voidsec.com/cve-2026-403...

How a Single @ Symbol Turned Into a 1-Click Account Takeover naaaash.github.io/posts/oauth-...

GhostTree: Unveiling Path Manipulation Techniques to Bypass Windows Security www.varonis.com/blog/ghosttr...

Abusing Redirect Discrepancies to leak secrets in URLs ethiack.com/news/researc...

Abusing Redirect Discrepancies to leak secrets in URLs ethiack.com/news/researc...

NTFS Transactions in Windows: Kernel Transaction Manager, CreateFileTransacted, and Process Doppelganging trainsec.net/library/wind...

About PCIe DMA Cheats: Protocol, IOMMU, Hardware, and Detection kernullist.github.io/kernullist-b...

Bypassing SSL Pinning on Play Store AVDs without Frida www.mfumis.com/posts/bypass...

Tulsi #Gabbard, dont la mise à l'écart du processus décisionnel était patente depuis le début du conflit en #Iran et qui semblait sur la sellette avec #Trump, démissionne de son poste de directrice du renseignement national. Pour cause de santé de son mari. 1/ www.axios.com/2026/05/22/t...

La réécoute de @lafabriquedelinfo.bsky.social de @francoissaltiel.bsky.social à laquelle j'ai eu la chance de participer: www.radiofrance.fr/francecultur...

Stealth Request That Bypasses CSP, Hides from DevTools, and Leaks the Real User-Agent brokenbrowser.com/blog/2026-05...

Cybersécurité et réalité de terrain dans les centres hospitaliers - NoLimitSecu

After copy[.]fail and DirtyFrag, a 3rd Linux kernel LPE (corrupting the kernel page cache through a flaw in XFRM ESP-in-TCP) in 2 weeks github.com/v12-security... thehackernews.com/2026/05/new-...

Another OpenGraph collector for BloodHound CE. Windows SSH Misconfiguration Discovery Tool Map lateral movement paths through misconfigured SSH services in Active Directory environments github.com/1r0BIT/WinSS...

Malicious Coding Agent Skills and the Risk of Dynamic Context | Datadog Security Labs securitylabs.datadoghq.com/articles/mal...

BSCP : easy pizi | YoyoChaud yoyochaud.fr/chaud/bscp-r...

Le président des #EtatsUnis D. #Trump exige de juges de la #CourSuprême qu'il a nommés de prendre une décision- sur le droit du sol- en sa faveur par "loyauté" au pays en les citant explicitement. Du jamais vu et un indice établi d'un glissement autoritaire d'1 #démocratie... 1/

$170k in Bypasses: The Vercel React2Shell Challenge www.hacktron.ai/blog/react2s...

AWS Bedrock Security Guide for API Keys www.beyondtrust.com/blog/entry/a...

The New Ouroboros Technique and How It Fits in dMSA’s Security Model www.akamai.com/blog/securit...

DAEMON Tools software infected – supply chain attack ongoing since April 8, 2026 securelist.com/tr/daemon-to...

Copirate 365 at DEF CON: Plundering in the Depths of Microsoft Copilot (CVE-2026-24299) · Embrace The Red embracethered.com/blog/posts/2...

Ghosts of Encryption Past – How we Read All Your Emails in Salesforce Marketing Cloud slcyber.io/research-cen...

PFAS dans les Ardennes : après l’eau, les produits agricoles contaminés www.mediapart.fr/journal/ecol...

AI threats in the wild: The current state of prompt injections on the web blog.google/security/pro...

How I Found Open-Source 0-days with an LLM Multi-Agent Workflow blog.cykor.kr//2026/02/How...

Recursively fuzzing MS-RPC structures and monitoring using ETW www.incendium.rocks/posts/Fuzzin...

PFAS dans les Ardennes : après l’eau, les produits agricoles contaminés www.mediapart.fr/journal/ecol...

ARP Around and Find Out: Hijacking GPO UNC Paths for Code Execution… trustedsec.com/blog/arp-aro...

Bypassing Windows authentication reflection mitigations for SYSTEM Part 1 www.synacktiv.com/en/publicati... Part 2 www.synacktiv.com/en/publicati...

The Internet Is Falling Down, Falling Down, Falling Down (cPanel & WHM Authentication Bypass CVE-2026-41940) labs.watchtowr.com/the-internet...

Bypassing Windows authentication reflection mitigations for SYSTEM www.synacktiv.com/en/publicati...

The woes of sanitizing SVGs muffin.ink/blog/scratch...

Gathers on a single site, articles on the main attacks on JWT rmrf.tips/en/

OWASP Autonomous Penetration Testing Standard owasp.org/APTS/ github.com/OWASP/APTS

Leveraging LLMs and patch diffing, this research details a Use-After-Free vulnerability in Windows DWM, demonstrating a reliable exploit that achieves escalation from low-privileged user permissions to SYSTEM. www.elastic.co/security-lab...

US tech firms successfully lobbied EU to keep datacentre emissions secret www.theguardian.com/technology/2...

ExchangeHound is a defensive BloodHound OpenGraph collector for on-prem Microsoft Exchange that maps mailbox delegation and Exchange privilege relationships to help blue teams find abuse paths and permission risks. Tool: github.com/FilipPwn/exc... Blog: filippwn.github.io/blog/2026/04...

CI/CD Red Team Framework "Like Metasploit, but for CI/CD pipelines" by creators of Poutine (github.com/boostsecurit...) github.com/boostsecurit...

GoPacket by @mandiant.com: A complete Go implementation of Impacket, 63 tools and 24 library packages for Windows network protocol interaction. github.com/mandiant/gop...

Shadow Admins in Active Directory: Hidden Privilege Paths Attackers Exploit www.praetorian.com/blog/shadow-...

LmCompatibilityLevel and the PDC Trap decoder.cloud/2026/04/15/l...

pySIDHistory - Remote SID History Injection from Linux Blog: felixbillieres.github.io/posts/pysidh... Tool: github.com/felixbillier... Lab: github.com/felixbillier...