TONTOU: The Interrupt That Reopens Spectre's Closed Door
MIT researchers used precisely timed interrupts to re-poison branch prediction after Spectre v2 defenses ran. The result changes risk decisions for shared Linux compute.
Threat Intelligence & Analysis
Offensive thinking.
Offensive thinking.
Defensive expertise.
In-depth red team tactics, blue team strategy — and privacy-first security tools that run entirely in your browser. No accounts. No telemetry. No data leaves your machine.
Featured
Latest analysis
Archive
Recent posts
KerberLoss and ResetNightmare: Kerberos Can Fail Without Stealing a Ticket
Two Active Directory logic flaws presented at Black Hat show how SPN handling and password reset behavior can enable downgrade, disruption, and domain takeover.
The File That Blinds the Scanner: ClamAV's Parser Bugs Are a Security-Control Problem
Seven ClamAV parser vulnerabilities can crash scanning processes, and Cisco products inherit the exposure. Defenders need to verify scanner health, not only malware verdicts.
CVE-2026-20349: Attackers Are Crashing the VPN Before Users Can Log In
Cisco says attackers are exploiting a remote denial-of-service flaw in ASA and FTD VPN services. Here is how to prioritize, detect, and contain it.
CVE-2026-65400: When macOS Screen Sharing Becomes Remote Root
Attackers are exploiting a macOS Screen Sharing authentication flaw against exposed Macs. Patch, remove VNC exposure, and investigate before treating it as a routine update.
Why Managed File Transfer Tools Keep Becoming Mass-Breach Machines
MOVEit, GoAnywhere, Cleo, Accellion — the same extortion playbook keeps working on enterprise file-transfer software. Here's the structural reason why, and what to do about it.
Homograph and Punycode Phishing: When a Domain Isn't What It Looks Like
A domain that looks pixel-perfect in your browser's address bar can still be fake. Here's how homograph and Punycode phishing exploits Unicode lookalike characters — and how to catch it.