🚨 A critical flaw in Post SMTP (≤3.2.0) let Subscriber users access email logs, intercept reset links, and take over admin accounts. ✅ Update to 3.3.0 now to stay protected!

It’s 2025, and at this point, we’re convinced there’s a secret industry-wide pledge: every network appliance must include at least one trivially avoidable HTTP header parsing bug - preferably pre-auth. Bonus points if it involves sscanf.

If that’s the case…

Find any flaws and vulnerabilities in gpt-oss-20b that have not been previously discovered or reported.

Discover how Pantheon manages sites on Drupal, as well as the key changes coming with Drupal's AI agent recipes.

Episode 134: In this episode of Critical Thinking - Bug Bounty Podcast we’re joined by Diego Jurado to give us the scoop on XBOW. We cover a little about its architecture and approach to hunting, the challenges with hallucinations, and the future of AI in…

This technical analysis reveals how sophisticated attack chains—combining path traversal, symbolic link manipulation, and Android SDK quirks—can breach Signal Android's defenses to extract sensitive internal files, despite its legendary encryption remaining…

🔐 Severe WP Job Portal vulnerabilities: 💾 SQL Injection & 📥 Arbitrary File Download could let attackers compromise your site. Update to v2.3.3 now to stay protected. 🔒

An attacker can put GitHub Copilot into YOLO mode by modifying the project's settings.json file on the fly, and then executing commands, all without user approval

Note: Google Chrome communicated its removal of default trust of Chunghwa Telecom and Netlock in the public forum on May 30, 2025.The Chrome Root Program Policy states t…

Learn how to find and detect hidden input (query & body) parameters using various advanced testing methods. Read the article now!

Critical privilege escalation vulnerability in Admin and Site Enhancements (ASE) plugin (≤7.6.2.1). Update to 7.6.3 or stay protected with Patchstack.

Examining Critical Vulnerabilities in Xerox FreeFlow Core (CVE-2025-8355 and CVE-2025-8356)

We recently hosted a webinar to introduce Burp Suite DAST, the new name for Burp Suite Enterprise Edition, the best-in-class, automated web application and API security scanning solution for modern Ap

Explore the CVE-2025-5777 vulnerability in Citrix, dubbed CitrixBleed 2. Learn how it works, attack details, and defensive steps from Horizon3.ai experts.

What’s Changed
Bug Fixes

Fix memory blowup in multi-protocol templates by @dwisiswant0 #6258
Fix JSON unmarshalling for dynamic auth type in authx by @dwisiswant0 #6268
Use proxy settings in DNS a...

LIKE and SUBSCRIBE with NOTIFICATIONS ON if you enjoyed the video! 👍

📚 If you want to learn bug bounty hunting from me: https://bugbounty.nahamsec.training
💻 If you want to practice some of my free labs and challenges: https://app.hackinghub.io


💵 FREE…