Citrix NetScaler Zero-Days Exploited: What to Patch and How to Check for Compromise
Citrix confirms exploitation of two NetScaler flaws. Check affected builds and DTLS exposure, plan the upgrade, and investigate possible compromise.
Threat Intelligence & Analysis
Offensive thinking.
Offensive thinking.
Defensive expertise.
In-depth red team tactics, blue team strategy — and privacy-first security tools that run entirely in your browser. No accounts. No telemetry. No data leaves your machine.
Featured
Latest analysis
Archive
Recent posts
F5 BIG-IP APM Under Attack: Check the OAuth Boundary, Patch, and Investigate
F5 confirms exploitation of CVE-2026-94127. Identify affected APM virtual servers, install the fixed hotfix, and investigate OAuth failures and appliance activity.
Passkey Lures, Stolen Sessions, and the Microsoft 365 Data Trail
Microsoft describes intrusions that start with fake passkey support calls and continue through new MFA methods, Graph reconnaissance, and cloud data access.
VeloCloud CVE-2026-93952: An Exploited Flaw in the SD-WAN Control Plane
An actively exploited VeloCloud Orchestrator flaw needs no admin login. Check certificate-based exposure, fixed releases, and evidence of compromise.
BragJack: When a Browser Extension Reaches the AI Agent
Researchers demonstrated five ways a malicious extension could cross into browser AI features. The impact varies by product, but extension governance is the shared control.
The Digital Parasite: How Attacker Tradecraft Evolved in 2026
Picus Labs found evasion, persistence and command-and-control techniques in eight of its 2026 top ten malware behaviors. What defenders can take from the data.
The Cache That Bites Back: GitHub Actions Cache Poisoning Attacks
How attackers turn GitHub Actions' shared build cache into a supply chain weapon — real cases, attack mechanics, detection logic, and mitigations.