LSHIY Password Spray: ROPC and MFA Gaps in Microsoft 365
A June 2026 password spray from LSHIY LLC's IPv6 range compromised 78 Microsoft accounts across 64 organizations by abusing Azure CLI ROPC sign-ins that MFA policies did not cover.
Security Research & Analysis
Offensive thinking.
Offensive thinking.
Defensive expertise.
In-depth red team research, blue team strategy — and privacy-first security tools that run entirely in your browser. No accounts. No telemetry. No data leaves your machine.
Featured
Latest research
Archive
Recent posts
The Clean Repo Trap: AI Coding Agents and the Trust Boundary Problem
A 0DIN proof of concept against Claude Code demonstrates how a clean-looking repository can lead to runtime command execution. The structural risk behind the attack applies to any AI coding agent with shell access.
Your Favicon Is Leaking Your Entire Infrastructure
A single 16x16 icon file can expose hundreds of servers, bypass WAF protections, and map your entire attack surface — here's how attackers use favicon hashing with Shodan, and how defenders can stop it.
Google's Audio Memory: What If the Promises Don't Hold?
Google's new Pixel feature listens to your day and remembers it. The company says everything stays on your device. But what if it doesn't — and does it matter either way?
pedit COW & DirtyClone: Two New Linux Root Exploits That Bypass On-Disk Integrity Checks
CVE-2026-46331 and CVE-2026-43503 both corrupt the Linux page cache via network subsystems to grant root — bypassing file integrity tools like AIDE and Tripwire without touching files on disk.
Trump Died of Rabies — And What That Means for Your Package Manager
When DuckDuckGo's AI killed Trump with rabies, the world laughed. When AI coding assistants invent package names, attackers register them. Nobody's laughing then.
One HTTP Header, Full Admin Access: Gitea's June 2026 Security Release Explained
Gitea 1.26.3 and 1.26.4 addressed a dense security release window, including a 9.8 CRITICAL auth bypass exploitable with a single HTTP header. Here's what broke and how to fix it.