PHP's Emergency Security Release: What Determines Your Exposure?
PHP has patched CVE-2026-109618 and CVE-2026-109619. Understand confirmed attack paths, fixed versions, and the limits of temporary mitigations.
Threat Intelligence & Analysis
Offensive thinking.
Offensive thinking.
Defensive expertise.
In-depth red team tactics, blue team strategy — and privacy-first security tools that run entirely in your browser. No accounts. No telemetry. No data leaves your machine.
Featured
Latest analysis
Archive
Recent posts
Drupal CVE-2026-108097: Field UI Turns Module Combinations Into an RCE Risk
Drupal fixed a critical Field UI remote-code-execution vulnerability that becomes exploitable through contributed modules or custom code. Identify exposed versions, update core, and investigate the application boundary before treating the patch as closure.
Meta’s New Commercial Terms: Your Business Website Becomes Part of the Deal
Meta’s October 30 commercial terms authorize broad website scraping for advertising and business products. What changed, what remains uncertain, and what businesses should review now.
ConnectWise Cloud Backup Incident: Treat SaaS Application Trust as an Incident Boundary
ConnectWise suspended Cloud Backup after unauthorized access to application identities. The defensible response is to hunt application activity in each Microsoft 365 tenant, not to mistake downtime for proof of compromise.
Console Hacking Is a Supply-Chain Problem: Who Checks the Emulator?
Jailbreaks, emulators, ports, and homebrew are not the same thing. The security question is what else reaches the console, who built it, and who verified the artifact.
AdFection: How an Online Ad Can Install Spyware Without a Click
How AdFection turns targeted ads into a spyware delivery route, where browser security boundaries matter, and how to reduce exposure without mistaking a hidden ad for a blocked request.
Cryptomus and Heleket: Following Cybercrime's Payment Rails Through a Rebrand
UK sanctions connect Cryptomus and Heleket. The evidence shows why investigators must track payment infrastructure, corporate identities, and customer migration together.