Weekly Threat Intel: Agent Tool Chaining Abuse, September 2026 IoT CVEs and Loader Activity
This week's threat intel digest: agentic AI tool chaining abuse, September 2026 IoT CVEs, and active loader campaigns — with concrete detection and…
All articles published by
Hmmnm
Hands-on cybersecurity tutorials, CVE breakdowns, and guided learning paths. Every technique is explained, tested, and paired with its mitigation — so you learn the attack and the defense together.
Attack a CI/CD Pipeline: Build a Self-Hosted Runner Hijack Lab with a GitHub Actions Walkthrough
Build a hands-on CTF-style lab that shows how poisoned pull requests and persistent self-hosted runners lead to secret exfiltration, then harden with OIDC…
Hands-On Syft and Grype Lab: Generate an SBOM and Scan Container Images for Vulnerable Dependencies
Step-by-step lab: build a container image, generate SPDX and CycloneDX SBOMs with Syft, and triage vulnerabilities with Grype severity matching. Real…
Weekly Threat Intel: MCP Tool-Poisoning Incidents, Fall 2026 Firmware CVEs, and Stealer Log Markets
This week's verified threat intel: MCP tool-description tampering incidents, newly patched firmware and network device CVEs, and infostealer dump activity…
Build a Certificate Transparency Monitoring Pipeline with crt.sh and the CT Logs API (Hands-On Walkthrough)
Learn to build a certificate transparency monitoring pipeline with crt.sh and the CT Logs API. Hands-on commands, JSON queries, and alerting for subdomain tracking.
Hands-On OpenSSL Lab: Generate, Inspect and Troubleshoot TLS Certificates with Real Commands
A hands-on OpenSSL lab: create CSRs, add SANs, inspect x509 certificates, validate chains, and troubleshoot common TLS errors with commands you can run…
Build a Ransomware Sandbox with FLARE-VM and CAPE: Automated Config Extraction and IOC Dumping
Step-by-step tutorial: build an isolated ransomware analysis sandbox with FLARE-VM and CAPE, safely detonate a sample, and automate C2 config extraction…
Hunting Ransomware Pre-Encryption Behavior with Sysmon and Velociraptor: Shadow Copy Deletion, Batch Encryption, Ransom Notes
Hands-on blue team lab: simulate shadow copy deletion and mass file encryption in a VM, then hunt it with Sysmon, Velociraptor VQL, and Sigma rules.…
Weekly Threat Intel: LockBit Successor Shuffles, September 2026 Edge Device CVEs and Loader Chains
Weekly threat intel for defenders: LockBit affiliate reshuffles, actively exploited edge/VPN CVEs, and infostealer-to-ransomware chains with hands-on detection and hardening actions.
Weekly Threat Intel: Ransomware Affiliate Rotation, Autumn 2026 Exploitation and Infostealer Ops
This week's threat intel: ransomware affiliate rotation between lockers, actively exploited CVEs defenders must patch now, and infostealer operations feeding the access broker economy. Actionable blue-team guidance.
Hunting Phishing Infrastructure with urlscan.io: Pivot from Screenshot to Campaign Takedown
Learn a hands-on urlscan.io OSINT workflow to pivot from a single phishing screenshot to the full campaign footprint using search operators, page.domains, and certificate data.
Build a Docker Socket Escape Lab: Why Mounting /var/run/docker.sock Is a Root Kill Chain
Hands-on lab showing why mounting /var/run/docker.sock gives containers host root access, with a full escape walkthrough and hardening via rootless Docker…
- 1
- 2
- 3
- 4
- …
- 33
- Go to the next page