OpenClaw: How the Viral AI Agent Became 2026's First Major Security Crisis
OpenClaw went from 0 to 180,000 GitHub stars in weeks — and then came the RCE, 30,000 exposed instances, and a supply chain attack poisoning its entire skill marketplace.
Security Research & Analysis
Offensive thinking.
Offensive thinking.
Defensive expertise.
In-depth research on red team techniques, threat analysis, and blue team strategy. No fluff — only what matters.
Featured
Latest research
Archive
Recent posts
Invisible Characters as an Attack Vector
Unicode's invisible characters are being weaponized — hiding malicious code in repositories, hijacking AI agents, and bypassing security reviews without leaving a trace visible to human eyes.
Phishing Under the Microscope: Analyzing a Real Attack Email Step by Step
We tear apart a realistic phishing email using Security Decoder — headers, URLs, JWT tokens, and obfuscated JavaScript — and show exactly what each red flag means.
CrackArmor: Nine AppArmor Flaws That Let Attackers Own the Kernel
Qualys TRU disclosed nine confused deputy vulnerabilities in Linux AppArmor — exposing 12.6 million servers to root escalation, KASLR bypass, and container isolation collapse. Technical deep dive and detection guide.
Zombie ZIP: How a Malformed Archive Header Blinds 98% of Antivirus Engines
CVE-2026-0866 — a single two-byte header manipulation causes 50 of 51 AV engines to scan compressed noise instead of the actual payload. Technical breakdown, attack scenarios, and detection.
AirSnitch: How Attackers Silently Break Wi-Fi Client Isolation
AirSnitch bypasses Wi-Fi client isolation using four attack primitives — even on WPA3. Every router tested was vulnerable. Here's how it works and how to defend against it.
Kerberoasting: A Deep Dive into Service Account Attacks
A comprehensive analysis of Kerberoasting — how it works at the protocol level, detection opportunities, and hardening strategies for Active Directory environments.