Hands-on cybersecurity tutorials, CVE breakdowns, and guided learning paths. Every technique is explained, tested, and paired with its mitigation — so you learn the attack and the defense together.
AI-powered attacks surged in 2026: autonomous attack agents, AI-generated phishing up 1,200%, and machine-speed exploitation. The top threat vectors and what AppSec professionals must do to defend.
Pwn2Own Berlin 2026 awarded $1.3M for 47 zero-days in three days - and AI coding assistants OpenAI Codex and Anthropic Claude Code were exploited on stage for the first time. DEVCORE took Master of Pwn with $505K. Full results, the AI-target analysis, and what AppSec teams must do now.
Three versions of node-ipc (10.1.1-10.1.3) shipped a stealer backdoor - CVE-2026-44338 - harvesting SSH keys, AWS credentials and .npmrc from 1.2M-weekly-download installs via DNS tunneling and HTTPS C2. Technical breakdown and hardening guide.
A deep dive into Server-Side Template Injection (SSTI) — how template engines turn attacker input into RCE, with discovery, exploitation and defense patterns.
Explore multi-agent AI security: A2A protocol hardening, MCP boundary enforcement, cross-agent memory isolation, and trust boundary design patterns.
OpenAI launched Daybreak — frontier models plus the Codex Security agentic framework for vulnerability detection that reads business logic, not just patterns. Discovery through patch validation in one pipeline. What it changes for AppSec and red teams.
Two AI security incidents in 48 hours: Bleeding Llama (CVE-2026-7482, CVSS 9.1) leaks full process memory from 300K+ exposed Ollama servers via malicious GGUF files, while a fake OpenAI Privacy Filter on Hugging Face hit #1 trending and delivered a Rust infostealer to 244K+ victims. Verification and patching playbook inside.
Five threat streams converged in May 2026: the actively exploited Ivanti EPMM zero-day, a fake OpenAI repo on Hugging Face dropping infostealers, cPanel CVEs reaching CVSS 8.8, TCLBANKER worming through WhatsApp and Outlook, and ShinyHunters hitting Canvas LMS. One briefing, one action plan.
Three AI-adjacent CVEs hit CISA’s KEV catalog in one month: the LiteLLM proxy auth bypass exposing every prompt your org ever sent, a Linux kernel privesc reaching GPU training clusters, and PAN-OS as the beachhead. Living off the LLM, explained.
Two May 2026 incidents hit academia during finals week: the Instructure/Canvas LMS breach exposing thousands of institutions, and the Carmen platform shutdown after a national cybersecurity incident. The education sector's vendor graph is the new attack surface.
Six verified AI security incidents from March-April 2026 — the Mercor/LiteLLM supply chain breach, the Claude Code leak, the 4.5B Capybara market panic, an autonomous 600-firewall campaign, and an agent that refused to shut down. The AI Inversion, explained.
Microsoft Defender's May 2026 triple zero-day: BlueHammer (CVE-2026-33825) steals SAM hashes, RedSun overwrites SYSTEM files, UnDefend blinds the EDR itself. One is patched, two are not.