An Evening with Claude (Code) - XPN InfoSec Blog blog.xpnsec.com/An-Evening-w...

3 Recent OAuth TTPs + How to Detect Them with Entra ID Logs | Wiz Blog www.wiz.io/blog/recent-...

www.afis.org/La-desinform...

The Trojan Horse You Didn’t Check: PHP Session Unserialization as an Attack Vector d3caff.gitbook.io/me/blog-post...

​​Spyware Allows Cyber Threat Actors to Target Users of Messaging Applications​ www.cisa.gov/news-events/...

How to Research & Reverse Web Vulnerabilities 101 — ProjectDiscovery Blog projectdiscovery.io/blog/how-to-...

Write Path Traversal to a RCE Art Department lab.ctbb.show/research/wri...

An updated, curated collection of Hashcat rules for cracking complex passwords. github.com/ibnaleem/rules

Cession à LVMH du groupe de presse Croque Futur : face aux craintes sociales, éthiques et éditoriales, les syndicats de journalistes apportent leur SOUTIEN aux rédactions de La Recherche, de Science et Avenir, et du magazine économique Challenges COMMUNIQUÉ INTERSYNDICAL ⬇️ snj.fr/soutien-aux-...

Promotion de Zemmour, temps de parole contourné… «Complément d’enquête» démonte les méthodes de CNews www.liberation.fr/economie/med... www.france.tv/france-2/com...

RCE via a malicious SVG in mPDF medium.com/@brun0ne/rce...

Less Praying More Relaying - Enumerating EPA Enforcement for MSSQL and HTTPS specterops.io/blog/2025/11...

Remotely crashing the Spooler service www.incendium.rocks/posts/Remote...

Breaking Oracle’s Identity Manager: Pre-Auth RCE (CVE-2025-61757) slcyber.io/research-cen...

SCCM’s AdminService uses Entra tokens without confirming the UPN exists in AD. A crafted synced UPN can let an attacker impersonate the site server. Microsoft now requires on-prem SID matching (CVE-2025-59501). specterops.io/blog/2025/11... github.com/garrettfoste...

Active Directory Security: Trusts Stuck on Windows 2000 Attributes www.tenable.com/blog/active-...

Production-grade Web Application Firewall testing tool. Detects Cloudflare, AWS WAF, Akamai & more. Identifies bypass vectors via URL normalization. Perfect for bug bounty & pentesting. github.com/theghostshin...

When The Impersonation Function Gets Used To Impersonate Users (Fortinet FortiWeb Auth. Bypass CVE-2025-64446) labs.watchtowr.com/when-the-imp...

Injection for an athlete swarm.ptsecurity.com/injection-fo...

Detecting Jira & Confluence Versions and Mapping Known CVEs fenrisk.com/atlasscan

Is It CitrixBleed4? Well, No. Is It Good? Also, No. (Citrix NetScaler Memory Leak & RXSS CVE-2025-12101) labs.watchtowr.com/is-it-citrix...

You win some, you CheckSum: New Kerberos delegation vulnerability discovered—attackers could impersonate, escalate privileges and stay hidden | Silverfort www.silverfort.com/blog/you-win...

Look At This Photograph - Passively Downloading Malware Payloads Via Image Caching malwaretech.com/2025/10/exif...

Introducing HTTP Anomaly Rank | Update of Burp Turbo Intruder portswigger.net/research/int...

CVE-2025-41253 Using Spring Expression Language To Expose Environment Variables and System Properties – psytester psytester.github.io/CVE-2025-412...

Deleting the BCD through COM as low privileged user - Warpnet warpnet.nl/blog/deletin...

How I Found the Worst ASP.NET Vulnerability — A $10K Bug (CVE-2025-55315) www.praetorian.com/blog/how-i-f...

Critical SQL Injection Vulnerability in Django (CVE-2025-64459) | Blog | Endor Labs www.endorlabs.com/learn/critic...

From vendor to ESC1 medium.com/@Debugger/fr...

Soon, @exegogol & THR ! 💣 ️ Guests ➡️ @_nwodtuhs & @Dramelac_ 🏰 Co-Streamer & Militant Exegol ➡️ @rayanlecat 🥸

0-Day MSR Kernel Exploit for Windows 11 25H2 www.exploitpack.com/blogs/news/0...

Introduction - OWASP Top 10:2025 RC1 owasp.org/Top10/2025/0...

Exploiting JWT vulnerabilities: A complete guide www.intigriti.com/researchers/...

Nunjucks - Exploiting Second-Order SSTI adeadfed.com/posts/nunjuc...

What’s That Coming Over The Hill? (Monsta FTP Remote Code Execution CVE-2025-34299) labs.watchtowr.com/whats-that-c...

Ghosts in /proc: Manipulation and Timeline Corruption | Group-IB Blog www.group-ib.com/blog/ghosts-...

Tool Spotlight: TaskHound - r0bit's blog r0bit.io/posts/taskho...

gopengraph A Go library to create BloodHound OpenGraphs easily github.com/TheManticore... by @podalirius.bsky.social

“We should have banned government use of face recognition when we had the chance because it is dangerous, invasive, and an inherent threat to civil liberties,” EFF’s @MGuariglia.bsky.social told @404Media.co. www.404media.co/ice-and-cbp...

Hack-cessibility: When DLL Hijacks Meet Windows Helpers trustedsec.com/blog/hack-ce...

Creating a "Two-Face" Rust binary on Linux www.synacktiv.com/en/publicati...

CVE-2025-62725: From “docker compose ps” to System Compromise www.imperva.com/blog/cve-202...

C# tool for requesting certificates from ADCS using DCOM over SMB. This allows you to remotely request X.509 certificates from CA server using the MS-WCCE protocol over DCOM and It bypasses the traditional endpoint mapper requirement by using SMB directly. github.com/7hePr0fess0r...

EDR-Redir V2: Blind EDR With Fake Program Files www.zerosalarium.com/2025/11/EDR-... github.com/TwoSevenOneT...

Sniffing established BLE connections with HackRF One blog.lexfo.fr/sniffing-ble...

Bypassing WiFi Client Isolation pulsesecurity.co.nz/articles/byp...

Uncovering network attack paths with runZeroHound www.runzero.com/blog/introdu...