Kerio Control has a design flaw in the implementation of the communication with GFI AppManager, leading to an authentication bypass vulnerability in the product under audit. Once the authentication bypass is achieved, the attacker can execute arbitrary code and commands.
I made TrashTalk.me - A free, zero-log, end-to-end encrypted web chat that destroys itself.
TL;DR: I built a simple, anonymous, and secure web chat. You click one button, get a private link, share it with one person, and the entire chat is permanently destroyed the moment one of you leaves. No sign-ups, no logs, no history.
Hey Reddit,
For a while now, I've wanted a truly ephemeral way to have a quick, private conversation online without needing to download an app, create an account, or trust
FileFix – New Alternative to ClickFix Attack
Source: https://www.mobile-hacker.com/2025/06/24/introducing-filefix-a-new-alternative-to-clickfix-attacks
CVE-2025-48703 is a remote code execution vulnerability in CentOS Web Panel, a widely used web hosting control panel. It allows unauthenticated attackers to execute arbitrary code remotely, potentially leading to full system compromise. No official patches or mitigations have been released yet, and no active exploits are currently known in the wild. The vulnerability is considered high risk due to the ease of exploitation and critical impact on confidentiality, integrity, and availability. Immediate mitigations include restricting network access to the control panel and monitoring for suspicious activity. Organizations using CentOS Web Panel, especially in Europe and other regions with significant deployment, should prioritize network-level protections and prepare for patch deployment once available. This threat poses risks of data breaches, service disruptions, and loss of control over hosting infrastructure. Defenders must act proactively to reduce exposure until official fixes are released.
After discovering that the haveibeenpwned.com data is accessible via the API and noticing the lack of a visualization tool, I dedicated a few evenings to building haveibeenpwned.watch. This single-page website processes and presents data on leaks from Have I Been Pwned, with daily updates.
The site provides details on the total number of recorded breaches, the number of unique services affected, and the total accounts compromised. Charts break down the data by year, showing the number of breach
Model Context Protocol is quickly becoming the default way for LLMs to call out to tools and APIs—but from a security standpoint, it’s been a little hand-wavy. This post fixes that.
It shows how five OAuth specs—including dynamic client registration and protected resource metadata—combine to form a secure, auditable, standards-based auth flow for MCP.
So I cooked up a fake transaction for shits and giggles.
No valid IBAN. No real user. No device. No signature. No token. No nothing.
Just pure distilled bullshit in a JSON payload.
Guess what?
“Transaction accepted”
“attack_success”: true
“fraud_score”: 0.99999
System looked at it and said: “yeah, looks good to me.”
I even told the sandbox I was sending 10k EUR from FAKE_IBAN_901 to INVALID_IBAN_123 using a spoofed IMEI and some RSA nonsense I made up in Notepad.
Bunq backend? Nodded politely
RAWPA helps security researchers and penetration testers with hierarchical methodologies for testing.
**This is not a "get bugs quick scheme"**. I fully encourage manual scouring through JS files and playing around in burp, RAWPA is just like a guided to rejuvenate your thinking.
Interested ? Join the testers now
[https://forms.gle/guLyrwLWWjQW61BK9](https://forms.gle/guLyrwLWWjQW61BK9)
Read more about RAWPA on my blog: [https://kuwguap.github.io/](https://kuwguap.github.io/)
