Install
Please confirm you are human
This browser or connection looks automated. Press and continuously hold the control for 3 seconds to enable Google-hosted web results and, when separately allowed, AI-assisted answers.
A successful check enables 100 search requests. Interactive access does not authorize scraping, systematic collection, or reuse of search output.
News
Claude Code Token Compromise & Hook Hijacking: Auditing CVE-2026-21852
3+ hour, 3+ min ago (374+ words) The transition from inline IDE autocomplete linters to autonomous, shell-wielding terminal agents (such as Anthropic's claude CLI) introduces an entirely new threat model. Terminal agents do not merely suggest code; they read configuration files, execute bash scripts, run test suites, interact…...
PHault pwnsec CTF writeup
54+ min ago (36+ words) reading the code: this code is obviously vulnerable to sql injection but the problem is, errors are disabled so it cant be error based, the time limit of the query is always …...
Poisoning the Pipeline: How HTTP Request Smuggling Let Me Capture Other Users’ Sessions ($11,000…
4+ hour, 16+ min ago (31+ words) Poisoning the Pipeline: How HTTP Request Smuggling Let Me Capture Other Users’ Sessions ($11,000 Bounty) There’s a category of web vulnerability that operates at a layer most hunters never look …...
Hacking VaultGate: Three Paths to One Flag
8+ hour, 39+ min ago (1142+ words) A walkthrough of four ways into a deliberately vulnerable web app — and how to fix each one. Tagged with security, cybersecurity, hacking, tutorial....
sk-1234 Is Not a Secret, It's a Docs Example, and 10% of You Shipped It Anyway
8+ hour, 50+ min ago (325+ words) Nearly one in ten internet-facing LiteLLM gateways were running with the literal example admin key from the documentation still active. Not a weak key. Not a leaked key. The key that's printed in tutorials, sk-1234, sitting wide open on the…...
9,300 Leaked AWS Keys Still Active, 768 Admin [2026]
23+ hour, 42+ min ago (442+ words) Security teams reading these numbers should treat them as a prompt to audit their own environment rather than assume the risk belongs to someone else. AWS’s IAM console can generate a full credential report showing every access key’s age and…...
Your CI Cache Can Carry Malicious Code. GitHub Just Added New Controls.
11+ hour, 44+ min ago (20+ words) GitHub Actions now supports cache-mode for least-privilege cache access. Learn how read, write, write-only, and none reduce CI cache-poisoning risk....
Check Point VPN CVE-2026-85102 and CVE-2026-85103: Early Warning for Pre-Authentication RCE
17+ hour, 15+ min ago (1541+ words) 1. Basic Information Original Title: Dutch NCSC: Critical Check Point VPN flaws exploitation is imminent Source: BleepingComputer, Dutch NCSC, Check Point Published Date: 2026-09-12 Severity: High Basis for Severity: Both CVSS 9.8 vulnerabilities allow unauthenticated remote code execution. Although the reference materials do…...
CodeQL 2.26.4 Enhances GitHub Actions Security, Adds Go 1.27 Support
1+ week, 3+ day ago (295+ words) Joerg Hiller Sep 03, 2026 15:43 GitHub's CodeQL 2.26.4 boosts security for GitHub Actions, improves Rust alerts, and extends support to Go 1.27. Key update for developers. GitHub Actions: Security checks for GitHub Actions have been fine-tuned. Specifically, the update enhances detection for mutable references…...
I Found an Undocumented MCP Server on OpenSea — and It Leaked Usernames for Any Wallet
19+ hour, 59+ min ago (492+ words) TL;DR: OpenSea runs an undocumented MCP server at mcp.opensea.io/mcp. One of its tools hands out API keys to anyone who asks, and another lets you resolve any Ethereum address with an OpenSea profile to its owner's…...