Blog & Resources
Security awareness tips, phishing prevention guides, and best practices.
SCHUTZWERK-SA-2024-006: Stored Cross-Site Scripting via text fields in H5P module (h5p-nodejs-library) of Lumi Education
Posted by David Brown via Fulldisclosure on Sep 26A stored cross-site scripting (XSS) vulnerability has been identified in the H5P module h5p-nodejs-library by Lumi Education UG in versions prior to 9.3.3. The vulnerability allows users to inject malicious
‘Please bring my son back’: Indian student from Gujarat held in Ukraine after joining Russian Army; cancer-stricken mother seeks help to bring him back
Sahil Mahmad Husen Majothi, a student from Gujarat, traveled to Russia for his education but encountered a harrowing situation. Arrested on drug charges shortly after his arrival, he faced a severe seven-year prison sentence. To escape incarceration, he made
wordpress-cve-scanner
Skip to contentHacking, PenTest, and Cybersecurity Tools for Your Security Arsenal! Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to fi
Salesforce Agentforce Got Zero-Clicked Through Its Own Web Form – and the Attack Vector Is in Every Agent That Combines These Three Things
Enterprise web forms designed to ingest data from unknown parties are now active breach vectors. The disclosure of SalesBleed, a series of vulnerabilities in Salesforce Agentforce, confirms that a single poisoned record can trigger zero-click data exfiltratio
OpenAI Learns Its Tech Probed Another Cybersecurity Target: The US Government
OpenAIs autonomous agents probed U.S. government websites this summer without the company noticing. The agents interacted with sites operated by the Education Department, the Commerce Department and
Attackers Bypass WAFs to Exploit Oracle PeopleSoft Flaw and Deploy Web Shells
Google is warning of renewed mass exploitation of a known security vulnerability in Oracle PeopleSoft as part of a campaign targeting multiple sectors globally. The ShinyHunters-linked activity involves the weaponization of CVE-2026-35273 (CVSS score: 9.8), a critical security flaw that could resul
Elementor CSRF Flaw Lets Attackers Take Over Sites After Admin Clicks Crafted Link
Details have emerged about a high-severity security flaw in the Elementor Website Builder WordPress plugin that could be exploited by an unauthenticated attacker to create rogue administrator accounts and take control of a site. The cross-site request forgery (CSRF) vulnerability, which has yet to
ShinyHunters uses WAF bypass trick in Oracle PeopleSoft attacks
The ShinyHunters extortion gang is using a URL-encoding trick to bypass web application firewall rules that mitigate the Oracle PeopleSoft CVE-2026-35273 flaw, allowing the threat actors to resume widespread exploitation of a flaw on vulnerable servers.
SharePoint RCE and MikroTik RouterOS Flaws Actively Exploited in the Wild
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two security flaws impacting Microsoft SharePoint and Mikrotik RouterOS to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerabilities in question are as follows -
In 2023, recycled face-mask fibre was added to printable concrete; a 1% dose raised compressive strength by 41% over unreinforced concrete
Research revealed that fibres from discarded surgical masks can significantly improve the strength of 3D-printed concrete. Specifically, adding mask fibres increased the compressive strength by 41% when tested in laboratory conditions. The study indicated tha
waf-detector
️ High-performance WAF & CDN detection tool. Identify protection layers (Cloudflare, Akamai, AWS, Fastly, and more), run effectiveness and enforcement tests with evasion payloads, and generate posture reports. Built in Rust .
Hackers hijack AI accounts and servers to fuel a booming cyber crime economy
The rise of AI account hijacking fuels a growing cybercrime economy, complicating detection and straining cybersecurity resources globally.