GitLab CVE-2026-85706: Patch the File Read, Then Rotate What It Exposed
CISA lists GitLab CVE-2026-85706 as exploited. Self-managed administrators must patch, hunt the repository commits API, and treat readable secrets as potentially compromised.
Threat Intelligence & Analysis
Offensive thinking.
Offensive thinking.
Defensive expertise.
In-depth red team tactics, blue team strategy — and privacy-first security tools that run entirely in your browser. No accounts. No telemetry. No data leaves your machine.
Featured
Latest analysis
Archive
Recent posts
Secrets in Docker Images: How Credentials Survive Layers
Credentials can survive in image layers, metadata, and build logs. Learn how to find them, remove them safely, and build without baking them in.
HTTP Request Smuggling: When Two Servers Disagree
Request smuggling begins when a proxy and back end parse a request differently. Learn the risk, warning signs, safe validation, and durable fixes.
MFA Fatigue: How Push Bombing Works and How to Stop It
Learn how MFA push bombing turns a stolen password into account access, what the warning signs look like, and which controls actually stop it.
Session Cookie Theft: How Attackers Bypass MFA
A stolen session can bypass the login screen entirely. Learn how cookie theft works, how to detect replay, and how to contain it correctly.
Webhook Security: Signatures, Replay Attacks, and SSRF
Secure both sides of a webhook: verify genuine events, stop replay and duplicate processing, and prevent callback URLs from reaching internal systems.
PHP2Shell Update: Exploitation Began Before Disclosure
AWS saw PHP2Shell attempts before disclosure. Here is what defenders now know about exploitation, memory disclosure, patch verification, and compromise hunting.