New native AI features in Microsoft SQL Server 2025 provide a practical channel for data exfiltration and C2 transport within the database engine itself.

Few conversations cut through the noise to ask what AI means for those on the ground: the hunters, the security engineers, and the organizations trying to secure their data.In this blog, we open up that discussion, with insights from Leo Racaneli.

What's Changed
🎉 New Features

Added support for protocol redirects by @Mzack9999 in #7296
Added impacket integration by @Mzack9999 in #7356
Added wmi, tsch, scmr, and dcom helper modules for J...

What happens when you unleash an AI across all of Google's infrastructure? 1,500 APIs, 3,600 keys, and $500,000 in bounties later, here's what I found.

Visa Vulnerability Agentic Harness. Contribute to visa/visa-vulnerability-agentic-harness development by creating an account on GitHub.

A compatibility matrix tracking OAuth refresh-token support across 14 MCP clients. Covers status, root causes, SDK layers, and server-side workarounds.

A blog about bypassing authentication that is enforced only in client-side JavaScript, with four real-world case studies from bug bounty and Synack Red Team engagements.

I accidentally logged into a malicious website operated by threat actors after scrolling X. Here's how I do that.

There has been a lot of hype around Mythos and Large Language models being able to find and exploit vulnerabilities at scale recently, and while this may be true for these emerging frontier models, it's already a reality we live in today, and it's not just…

## Target

Burp Suite Professional 2026.3.3 on Windows.

## Summary

When Burp Scanner's browser-powered crawler crawls an attacker's website, the website can force Burp to write an...

Varonis Threat Labs discovered SearchLeak, a critical vulnerability chain in Microsoft 365 Copilot Enterprise that allows an attacker to steal sensitive data — MFA codes, email messages, meeting details, and private organizational files — with a single click.

An unauthenticated arbitrary file upload flaw in Amasty Order Attributes lets attackers write executable files to a Magento store without logging in, opening...

A friend of mine once told me: If you ever spot an IIS blue screen, don’t stop there; there must be something.

1. Introduction

Discover how LLMs, agentic CLIs and MCP servers boost Bug Bounty workflows while keeping manual validation at the core of vulnerability research.

CVE-2026-5667 – Unauthenticated remote control of Mitsubishi MAC-577IF-2E WiFi air conditioner adapters discovered via citywide probe request reconnaissance. Full technical writeup with PoC methodology.

AutoJack is a novel exploit chain showing how a single malicious webpage can turn an AI browsing agent into a remote code execution vector on the host machine. By abusing trust in localhost, missing authentication, and unsafe parameter handling, attackers…

Among models given nothing but a prompt, the best open-weight option beat Claude Opus 4.8.

Five years ago, a critical bug was rare and expensive to find. AI changed that overnight. What the quartz crisis in watchmaking reveals about hacking's future.

Campus Recruiting vulnerability exposed student information, and Audit Tracking Management System vulnerability exposed confidential internal audit data.