I setup a challenge for a new kind of tool there's a private key in plain text in this browser instance. You can copy paste and use it. But you cannot see it or take it. It's basically a mirrored document editor that allows you to control it on any webpage without exposure.
There's a 20$ private bitcoin key directly usable by any user on it. Copy paste and delete it or move it around. If you break the new algorithm it's yours!
Beware the false false-positive: how to distinguish HTTP pipelining from request smuggling
Source: https://portswigger.net/research/how-to-distinguish-http-pipelining-from-request-smuggling
Flaw in Older Version of Android Rooting Tool KernelSU Allows Full Device Takeover
Source: https://hackread.com/kernelsu-android-rooting-tool-flaw-device-takeover/
I came across a broken link hijacking case involving a Google Play Store package. The app link returns a 404, and the package name is currently unclaimed.which means it can potentially be taken over. It’s a valid security issue and could be eligible for a bug bounty, though I'm not 100% sure.
The company asked for a working proof of concept, meaning the package has to actually be claimed and uploaded to the Play Store. I haven’t created a developer account myself yet, since I haven’t needed one except for this case and it requires a $25 fee.
If you already have a developer account, would you be willing to contribute by uploading a simple placeholder app using that package name, just to prove the takeover? If the report gets rewarded, I’ll share 10% of the bounty with you. Usually, these types of reports are rewarded with $50 or $100, so I hope you understand I can’t offer more than 10%.
Let me know if you’re open to it.
Thanks!
Struts Devmode in 2025? Critical Pre-Auth Vulnerabilities in Adobe Experience Manager Forms
Source: https://slcyber.io/assetnote-security-research-center/struts-devmode-in-2025-critical-pre-auth-vulnerabilities-in-adobe-experience-manager-forms/
Critical Flaws in Niagara Framework Threaten Smart Buildings and Industrial Systems Worldwide
Source: https://thehackernews.com/2025/07/critical-flaws-in-niagara-framework.html
A Novel Technique for SQL Injection in PDO’s Prepared Statements
Source: https://slcyber.io/assetnote-security-research-center/a-novel-technique-for-sql-injection-in-pdos-prepared-statements/
Leaked Shellter Elite Tool for Red Teams Now Enabling Infostealer Attacks Worldwide
Source: https://hackread.com/leaked-shellter-elite-tool-infostealer-attacks-worldwide/
McDonald’s AI Hiring Tool McHire Leaked Data of 64 Million Job Seekers
Source: https://hackread.com/mcdonalds-ai-hiring-tool-mchire-leaked-job-seekers-data/
In the high-stakes arena of cybersecurity, Microsoft Defender stands as a cornerstone ofWindows security, integrating a sophisticated array of defenses: the Antimalware Scan Interface (AMSI) for runtime script scanning, Endpoint Detection and Response (EDR) forreal-time telemetry, cloud-based reputation services for file analysis, sandboxing for isolated execution, and machine learning-driven heuristics for behavioral detection. Despiteits robust architecture, attackers increasingly bypass these defenses—not by exploitingcode-level vulnerabilities within the Microsoft Security Response Center’s (MSRC) service boundaries, but by targeting logical vulnerabilities in Defender’s decision-makingand analysis pipelines. These logical attacks manipulate the system’s own rules, turningits complexity into a weapon against it.This article series, Strengthening Microsoft Defender: Analyzing and Countering Logical Evasion Techniques, is designed to empower Blue Teams, security researchers, threathunters, and system administrators with the knowledge to understand, detect, and neutralize these threats. By framing logical evasion techniques as threat models and providingactionable Indicators of Compromise (IoCs) and defensive strategies, we aim to bridgethe gap between attacker ingenuity and defender resilience. Our approach is grounded inethical research, responsible disclosure, and practical application, ensuring that defenderscan anticipate and counter sophisticated attacks without crossing legal or ethical lines.
This comprehensive security report investigates unpatchable vulnerabilities in Windows 10 and11, focusing on systemic flaws that resist traditional patching due to their deep integration intothe operating system’s architecture, hardware dependencies, and legacy compatibility requirements. These vulnerabilities, rooted in fundamental design choices and ecosystem constraints,pose significant challenges to securing millions of Windows devices worldwide. The report examines three critical vulnerabilities: legacy BIOS/UEFI firmware weaknesses, kernel memorymanagement flaws, and backward compatibility with legacy protocols. It provides a detailedtechnical analysis, exploitation vectors, detection challenges, and comprehensive mitigationstrategies. With Windows 10 approaching its end-of-support deadline in October 2025, theseflaws pose heightened risks, necessitating proactive defenses. This report adheres to responsible disclosure principles and aims to support Microsoft’s efforts to strengthen Windows securityin 2025
Infostealers-as-a-Service Push Identity Hacks to Record Highs, Report
Source: https://hackread.com/infostealers-as-a-service-identity-hacks-record-highs/
Hackers abuse leaked Shellter red team tool to deploy infostealers
Source: https://www.bleepingcomputer.com/news/security/hackers-abuse-leaked-shellter-red-team-tool-to-deploy-infostealers/
Sharing a project I’ve been building called **T3E** .
It converts *any file* into a `.wav` audio file using:
* Deterministic frequency encoding
* Signal obfuscation
* Key-based frequency shifting
**T3E was built to challenge traditional encryption assumptions** — especially in response to:
* Quantum computing
* AI-based reverse engineering
* Memory forensics & low-level analysis
I have a `.wav` file that contains a fully encrypted Excel spreadsheet.
It plays as normal audio — but is **reversible only** with the correct key and decoder.
# Key Properties:
* No ciphertext or headers (not AES, not base64)
* Audio plays clean, but stores real data
* AI/quantum-resistant — no repeating patterns
* Even with the same key, each encryption produces a unique `.wav`
* Decryption requires the **exact** `.wav` **file** \+ key
* Optional memory-free decryption (executes in RAM only)
Not selling anything — just posting to gather early feedback from serious folks in netsec, RE, and crypto.
Appreciate any critiques on:
* Security model
* Weaknesses or edge cases
* Post-quantum viability
Try breaking it — I’d love to see how it holds up.
How we got persistent XSS on every AEM cloud site, thrice
Source: https://slcyber.io/assetnote-security-research-center/how-we-got-persistent-xss-on-every-aem-cloud-site-thrice/
I made TrashTalk.me - A free, zero-log, end-to-end encrypted web chat that destroys itself.
TL;DR: I built a simple, anonymous, and secure web chat. You click one button, get a private link, share it with one person, and the entire chat is permanently destroyed the moment one of you leaves. No sign-ups, no logs, no history.
Hey Reddit,
For a while now, I've wanted a truly ephemeral way to have a quick, private conversation online without needing to download an app, create an account, or trust
