In-depth red team tactics, blue team strategy — and privacy-first security tools that run entirely in your browser. No accounts. No telemetry. No data leaves your machine.
Australian and U.S. authorities have charged alleged TeamPCP operators after a software supply chain campaign that authorities say hit more than 1,000 organizations. The defensive lesson is about tokens, publishing rights, and update speed.
University of Toronto researchers showed GPUThor can overwhelm ECC on tested NVIDIA Ampere workstation GPUs, causing denial of service and root-level privilege escalation under lab conditions.
A fake Cloudflare CAPTCHA campaign used npm packages and mirror CDNs as trusted-looking web hosting. The packages were not the payload; the mirror URLs were.
Attackers are exploiting a Zimbra SNMP command injection flaw after a fixed version was already available. The real work is not only patching, but compromise triage.
MIT researchers used precisely timed interrupts to re-poison branch prediction after Spectre v2 defenses ran. The result changes risk decisions for shared Linux compute.
Two Active Directory logic flaws presented at Black Hat show how SPN handling and password reset behavior can enable downgrade, disruption, and domain takeover.
Seven ClamAV parser vulnerabilities can crash scanning processes, and Cisco products inherit the exposure. Defenders need to verify scanner health, not only malware verdicts.