Keycloak's reset-credentials flow skips its own email action token: an unauthenticated attacker can set a new password on any account, including admins. CVSS 9.1, fixed in 26.7.2 - patch guide, detection hunting, and the temporary mitigation inside.
GitLab CVE-2026-19478 went from disclosure to in-the-wild exploitation in days; a compromised maintainer account backdoored three Rust crates with 245M downloads for 86 minutes; Citrix shipped a CVSS 9.3 NetScaler auth bypass. The week's threats, IoCs, and your Monday patch list.
Three supply chain campaigns in one week: 400+ hijacked AUR packages, Velvet Ant's nine-year Linux PAM backdoor, and KEV entries for Oracle PeopleSoft and Ivanti Sentry. Trust is the attack surface.
A deep dive into Server-Side Template Injection (SSTI) — how template engines turn attacker input into RCE, with discovery, exploitation and defense patterns.
XXE Injection remains one of the most dangerous web vulnerabilities, allowing attackers to read server files, execute SSRF, and even achieve remote code execution. Master in-band, out-of-band, and blind XXE techniques with practical payload examples.
100 essential networking topics to revise before your technical interview. Covers OSI model, TCP/IP fundamentals, routing protocols, switching concepts, security basics, and troubleshooting methodologies.
CORS misconfigurations rank among the most critical web security vulnerabilities in modern applications. Learn how to identify, exploit, and remediate cross-origin resource sharing flaws including origin reflection, null origin trust, and subdomain bypass techniques.
Learn error-based exploitation techniques used by pentesters to extract sensitive data from vulnerable applications. Covers SQL injection, SSTI, and other injection-based attacks with practical examples and mitigation strategies.
CISO guide to ransomware incident response: a complete checklist covering preparation, detection, containment, eradication, and recovery phases for enterprise environments under active ransomware attacks.