Blog & Resources
Security awareness tips, phishing prevention guides, and best practices.
Zero-Click Attacks: Hackers Can Take Over Phones Silently
At Black Hat, Google's Project Zero demonstrated zero-click attacks that can compromise a Pixel phone without user interaction, turning it into a bugg
HackerOne Adds Source Code Remediation to Platform
HackerOne's H1 Platform now includes remediation for source code vulnerabilities, cutting time to fix validated weaknesses.
AI Finds New HTTP Desync Attacks and Apache Zero-Day
PortSwigger's AI system HTTP Terminator discovered novel HTTP desync techniques and an Apache Traffic Server zero-day after testing 30,000 websites.
Water System Attacks Expose Critical Infrastructure Risks
Recent cyber attacks on water systems show that common techniques can severely impact critical infrastructure, highlighting the need for proactive tea
NatJack Attacks Hijack TCP Sessions via NAT Tables
Researcher Malcolm Stagg disclosed NatJack, a new attack class that manipulates NAT state to hijack TCP sessions and spoof DNS, affecting Windows and
NatJack Attack Hijacks TCP Sessions via NAT State
Researcher Malcolm Stagg unveiled NatJack at Black Hat USA 2026, exploiting NAT connection state to hijack TCP sessions and spoof DNS responses.
Water Industry Turns to AI and Hackers After Iran Attacks
After suspected Iranian cyberattacks on U.S. water systems, companies are seeking help from volunteers, smaller firms, and AI programs.
GitHub Issue Exploit Hits Claude Code and Gemini CLI
A GitHub issue from an unprivileged account executed code on CI runners for Anthropic and Google coding agents, and hijacked OpenAI's next run.
Russian hackers can steal emails without a click
CISA warns of a Russian hacking campaign that can steal emails without user interaction, bypassing typical safety advice.
Bendix EC80 Recall Also Patched RCE Flaws
NMFTA research reveals that a Bendix EC80 brake controller safety recall also fixed remote code execution and denial-of-service vulnerabilities.
Malware can abuse Windows Hello for persistent Entra ID
Malware in a signed-in Windows session can use Windows Hello for Business keys without PIN or biometrics, enabling persistent Entra ID access.
Microsoft and Apple Ship Critical Security Patches
Microsoft patched critical flaws in Azure, Entra, and SharePoint, while Apple fixed a high-severity authentication bypass.