Marius Avram

Introducing the OWASP Top 10:2025
owasp.org/Top10/2025/0...

Tenable Research has discovered seven vulnerabilities and attack techniques in ChatGPT, including unique indirect prompt injections, exfiltration of personal user information, persistence, evasion, and bypass of safety mechanisms. www.tenable.com/blog/hackedg...

Phrack 72 Has Been Published phrack.org/issues/72/1

IP data on compromised instances shared in our Compromised Website report tagged 'fortiweb-compromised': www.shadowserver.org/what-we-do/n...

IP data on exposed instances is in our Device ID report: www.shadowserver.org/what-we-do/n... (device model is set to FortiWeb Management Interface)

true legend!

opossum-attack.com <- Opossum is a cross-protocol application layer desynchronization attack that affects TLS-based application protocols that rely on both opportunistic and implicit TLS. Among the affected protocols are HTTP, FTP, POP3, SMTP, LMTP and NNTP.

Serial Hacker “IntelBroker” Charged For Causing $25 Million In Damages To Victims The United States Attorney for the Southern District of New York, Jay Clayton, and the Assistant Director in Charge of the New York Field Office of the Federal Bureau of Investigation (“FBI”), Christo...

British Hacker ‘IntelBroker’ Faces $25M Cybercrime Charges www.justice.gov/usao-sdny/pr...

Looks like old age finally finished the job and wiped out whatever was left of his brain, not that there was much to begin with. 😬

GitHub - random-robbie/ec2free: AWS EC2 Pentesting Lab Setup Script AWS EC2 Pentesting Lab Setup Script. Contribute to random-robbie/ec2free development by creating an account on GitHub.

Free EC2 tool for pentesting or anything.
github.com/random-robbi...

Finding an SOQL Injection 0-Day in Salesforce How an un-exploitable SOQL injection turned into a 0-day in Salesforce itself affecting millions of user records

Finding an SOQL Injection 0-Day in Salesforce mastersplinter.work/research/sal...

According to my sources, Cellebrite used to purchase iPhone prototypes (aka dev-fused devices), which had lower security features, to develop its zero-days.

Corellium's founder Chris Wade also purchased them back in the day, according to sources.

www.vice.com/en/article/t...

<img/src/onerror=window.onerror=eval;ReferenceError.prototype.name=';alert\x281\x29;var\x20Uncaught//';z>

This vector adds an onerror handler with eval, rewrites all ReferenceError names, then triggers an error to execute the payload. Just added it to the XSS cheat sheet. Credit to @0x999.net , inspired by @terjanq.me

portswigger.net/web-security...

Unmasking the Threat: A Deep Dive into the PDF Malicious Analyzing the Sophisticated Use of PDF Files as Cyberattack Vectors and the Imperative for Enhanced Security Measures Abstract The utilization of PDF files, a ubiquitous format for documents across...

Unmasking the Threat: A Deep Dive into the PDF Malicious labs.segura.blog/unmasking-th...

Finding SSRFs in Azure DevOps - Part 2 binsec.no/posts/2025/0...

🤦‍♂️😂

Threat of TCC Bypasses on macOS afine.com/threat-of-tc...

Automating MS-RPC vulnerability research www.incendium.rocks/posts/Automa...

Bypass SharePoint Restricted View to exfiltrate data using Copilot AI and more… www.pentestpartners.com/security-blo...

Of course, it's always wise to speak from ignorance, after all, globalist propaganda wouldn't work so flawlessly if people actually bothered to think. 🤦‍♂️

LockBit ransomware gang hacked, victim negotiations exposed The LockBit ransomware gang has suffered a data breach after its dark web affiliate panels were defaced and replaced with a message linking to a MySQL database dump.

Well…thank you for not doing this on a Friday.

This is huge…

via @bleepingcomputer.com

 From SAST to CVE-2025-46337 xaliom.blogspot.com/2025/05/from...

#Skype shuts down TODAY.

Here's the link to download your contacts & chats. secure.skype.com/en/data-export

Agent of Chaos: Hijacking NodeJS’s Jenkins Agents
www.praetorian.com/blog/agent-o...

Think you’ve seen every OS command injection trick?
Think again, read our latest blog post!
Link in the comments👇

What about this? It was mentioned a month ago 😳 www.euronews.com/my-europe/20...

How a Single Line Of Code Could Brick Your iPhone | Rambo Codes Gui Rambo writes about his coding and reverse engineering adventures.

Just posted to my blog for the first time in a little over 2 years 😅 rambo.codes/posts/2025-0...

Research finds 12,000 ‘Live’ API Keys and Passwords in DeepSeek's Training Data trufflesecurity.com/blog/researc...