We found a path traversal vulnerability in Smithery.ai that compromised over 3,000 MCP servers and exposed thousands of API keys. Here's how a single Docker build bug nearly triggered one of the largest AI supply chain attacks to date.

Adversis releases a Burp Extension for NextJS Hash-to-Function Mapping

In June, 2025, Shubs Shah and I discovered a vulnerability in the online poker website ClubWPT Gold which would have allowed an attacker to fully access the core back office application that is used for all administrative site functionality.

Last year we (PHP HOOLIGANS) competed in Pwn2Own (ireland, 2024) once again. One of our (succesful) entries was against a little pet peeve target of mine, the CANON ImageCLASS printer. In this post I’ll walk you through the vulnerability I found and exploited.

October is all about spooky surprises, but don’t let a data breach be one of them. Celebrate Cybersecurity Awareness Month safely!

In this post I discuss request smuggling, the recent vulnerability in ASP.NET Core with a severity score of 9.9, and how attackers could exploit it

One year from now, with the release of Chrome 154 in October 2026, we will change the default settings of Chrome to enable “Always Use Secu...

Trail of Bits is disclosing vulnerabilities in confidential computing systems that use LUKS2 for disk encryption. These vulnerabilities allow attackers with access to storage disks to extract confidential data and modify contents.

Posted by Lyubov Farafonova, Product Manager, Phone by Google; Alberto Pastor Nieto, Sr. Product Manager Google Messages and RCS Spam and Ab...

This blog post describes how electronic passports work, the threats within their threat model, and how they protect against those threats using cryptography. It also discusses the implications of using electronic passports for novel applications, such as…

Summary of Releases v10.3.0 & v10.3.1

This month, we had two major releases of Nuclei Templates, introducing numerous improvements and new templates for Nuclei users.


🚀 Hacktober Stats




Release
New Templates Added
CVEs Added
First-time Contributors…

Posted by Lyubov Farafonova, Product Manager, Phone by Google; Alberto Pastor Nieto, Sr. Product Manager Google Messages and RCS Spam and Ab...

What’s Changed
Bug Fixes

Fix memory blowup in multi-protocol templates by @dwisiswant0 #6258
Fix JSON unmarshalling for dynamic auth type in authx by @dwisiswant0 #6268
Use proxy settings in DNS a...

Artificial intelligence is rapidly changing how we develop software. But beyond the hype, how are developers like you actually using these new tools in your daily workflows? To find out, we're kicking off our first annual State of Code developer research…

Learn how to assess Next.js apps for SSRF, XSS, CSTI, SSTI, CSRF, cache issues, and data leaks. Practical tips, checks, and tools for bug bounty and pentesting.