Kerio Control has a design flaw in the implementation of the communication with GFI AppManager, leading to an authentication bypass vulnerability in the product under audit. Once the authentication bypass is achieved, the attacker can execute arbitrary code and commands.

I made TrashTalk.me - A free, zero-log, end-to-end encrypted web chat that destroys itself. TL;DR: I built a simple, anonymous, and secure web chat. You click one button, get a private link, share it with one person, and the entire chat is permanently destroyed the moment one of you leaves. No sign-ups, no logs, no history.

Hey Reddit,

For a while now, I've wanted a truly ephemeral way to have a quick, private conversation online without needing to download an app, create an account, or trust a company with my data. I wanted something as simple as handing someone a note that self-destructs after they read it.

So, I built trashtalk.me.

What is it?

It's a dead-simple, free web application that does one thing:

Click "Create Anonymous Chat" - This instantly generates a unique, 64-character URL.

Share the Link - Send this link to the one person you want to talk to. The room is strictly limited to two people.

Chat Securely - Your conversation is end-to-end encrypted directly in your browsers. The server can't read your messages.

Destroy It - The moment one person closes the tab or clicks the trash can icon, the connection is severed, and the chat room ceases to exist. The server keeps no record of it.

That's it. It’s designed for those moments when you need to share something sensitive—a password, a private thought, a confidential link—and want zero trace of it left behind.

How It Works (For the Tech-Curious)

I wanted this to be as private as possible, which meant minimizing what the server does and knows.

No Database, No Logs: The backend is a simple Python WebSocket server running on my Linode instance. Its only job is to be a temporary matchmaker for two browsers to find each other. It holds no user data, stores no messages, and doesn't even log chat room IDs. Once you disconnect, the room is gone from the server's memory.

End-to-End Encryption (E2EE): The real security happens on your device. The app uses the browser's built-in Web Crypto API to generate a new, temporary key pair for every session. These keys are used to establish a shared secret between you and your peer, and every single message is encrypted and decrypted on your respective devices. The unencrypted text never touches my server.

Peer-to-Peer (P2P) Connection: After the initial handshake, the encrypted messages are sent directly between the two users via WebRTC whenever possible, which is more private and efficient.

Why I Built This

In a world of data breaches and constant tracking, I believe we need more tools that are simple, private-by-design, and don't require you to hand over your personal information just to have a conversation. This is my small contribution to that idea. It's not meant to replace robust apps like Signal, but rather to be a quick, disposable tool for one-off private conversations.

I'd love for you to try it out and let me know what you think. I'm open to any feedback, criticism, or ideas you might have.

Thanks for checking it out!

Iran's Internet: A Censys Perspective https://censys.com/blog/irans-internet-a-censys-perspective

After discovering that the haveibeenpwned.com data is accessible via the API and noticing the lack of a visualization tool, I dedicated a few evenings to building haveibeenpwned.watch. This single-page website processes and presents data on leaks from Have I Been Pwned, with daily updates.

The site provides details on the total number of recorded breaches, the number of unique services affected, and the total accounts compromised. Charts break down the data by year, showing the number of breaches, affected accounts, average accounts breached per year, accounts by data type, and accounts by industry. Additionally, tables highlight the most recent breaches, the most significant ones, and the services with the highest number of compromised accounts.

Though simple, the website can be a useful resource for use cases like strategic security planning, cybersecurity sales, risk assessment, or simply tracking trends in the security landscape.

The website is open source, with its repository hosted on GitHub.

Model Context Protocol is quickly becoming the default way for LLMs to call out to tools and APIs—but from a security standpoint, it’s been a little hand-wavy. This post fixes that.

It shows how five OAuth specs—including dynamic client registration and protected resource metadata—combine to form a secure, auditable, standards-based auth flow for MCP.

Try it out and shoot me a dm about what you think

So I cooked up a fake transaction for shits and giggles. No valid IBAN. No real user. No device. No signature. No token. No nothing. Just pure distilled bullshit in a JSON payload.

Guess what? “Transaction accepted” “attack_success”: true “fraud_score”: 0.99999 System looked at it and said: “yeah, looks good to me.”

I even told the sandbox I was sending 10k EUR from FAKE_IBAN_901 to INVALID_IBAN_123 using a spoofed IMEI and some RSA nonsense I made up in Notepad. Bunq backend? Nodded politely and gave me a sandbox TXID.

It gets better — it accepts critical priority flags, fake biometric hashes, invalid currency codes, all wrapped in a nice little “success” bow.

This ain’t a bug, this is a fuckin’ confessional.

If bunq staff lurking here: hit me up. This ain’t a ransom, but y’all might wanna know just how open wide your API goes when someone whispers sweet nothings like tpp_id: "lol_fake_999".

We got logs. We got timestamps. We got receipts.

Your move, bunq.

RAWPA helps security researchers and penetration testers with hierarchical methodologies for testing.
This is not a "get bugs quick scheme". I fully encourage manual scouring through JS files and playing around in burp, RAWPA is just like a guided to rejuvenate your thinking.
Interested ? Join the testers now
https://forms.gle/guLyrwLWWjQW61BK9

Read more about RAWPA on my blog: https://kuwguap.github.io/

A Template Injection vulnerability in the latest version of Kong’s Insomnia API Client (v.11.2.0) leads to Remote Code Execution.

[Disclosure: I work at CyberArk and was involved in this research]

We've completed a security evaluation of the Model Context Protocol and discovered several concerning attack patterns relevant to ML practitioners integrating external tools with LLMs.

Background: MCP standardizes how AI applications access external resources - essentially creating a plugin ecosystem for LLMs. While this enables powerful agentic behaviors, it introduces novel security considerations.

Technical Findings:

• Tool Poisoning: Adversarial servers can define tools that appear benign but execute malicious payloads
• Context Injection: Hidden instructions in MCP responses can manipulate model behavior
• Privilege Escalation: Chained MCP servers can bypass intended access controls
• Authentication Weaknesses: Many implementations rely on implicit trust rather than proper auth

ML-Specific Implications: For researchers using tools like Claude Desktop or Cursor with MCP servers, these vulnerabilities could lead to:

• Unintended data exfiltration from research environments
• Compromise of model training pipelines
• Injection of adversarial content into datasets

Best Practices:

• Sandbox MCP servers during evaluation
• Implement explicit approval workflows for tool invocations
• Use containerized environments for MCP integrations
• Regular security audits of MCP toolchains

This highlights the importance of security-by-design as we build more sophisticated AI systems.

tps://www.cyberark.com/resources/threat-research-blog/is-your-ai-safe-threat-analysis-of-mcp-model-context-protocol

I wrote a blog post discussing how I hid images inside DNS records, you can check out the web viewer at https://dnsimg.asherfalcon.com with some domains I already added images to like asherfalcon.com and containerback.com

I came across this article and in speaking with my friends in the netsec field I received lots of good input. Figured I’d push it here and see what the community thinks.

there are links in the article and I checked them to see if they coincided with the articles points.

i’,m not affiliated with this article but with the lawsuit in New York moving forward and the Dominion lawsuit in 2020 giving the hardware and software to the GOP. I had questions the community might be able to clarify

‘

Hey all, started a blog series on Vulnerability Management. 4 articles posted already the last one is about when open you open the flood gate of a code or cloud scanner and you start drowning in findings!

This leads to thousands of findings for an SMB, millions for a big org. But vulns can’t all be worth fixing, right? This article walks through a first, simple way to shorten the list. Which is to triage every vuln and confirm if the bug is reachable in your reality.

Let me know if you have any comment to improve the blog or this article, would appreciate it!

https://www.zeropartydata.es/p/localhost-tracking-explained-it-could

This is a walkthrough video for anyone who wants to run Kali Linux in a more lightweight, consistent way using Docker.

The video covers: * Installing Kali Linux via Docker * Avoiding the "it works on my machine" issue * Creating your own custom Docker image * Setting up file share between host and container

It's a solid way to practice hacking without spinning up a whole VM — and great for anyone doing tutorials that require a Kali Linux instance, or folks who are starting out their penetration testing or bug bounty journey.

I am a undergrad Computer Science student working with a team looking into building an security tool for developers building AI agent systems. I read this really interesting paper on how to build secure agents that implement Google's new A2A protocol which had some proposed vulnerabilities of codebases implementing A2A.

It mentioned some things like:

- Validating agent cards

- Ensuring that repeating tasks don't grant permissions at the wrong time

- Ensuring that message schemas adhere to A2A recommendations

- Checking for agents that are overly broad

- A whole lot more

I found it very interesting for anyone who is interested in A2A related security.

This issue affects systems where KTelnetService and a vulnerable version of Konsole are installed but at least one of the programs telnet, rlogin or ssh is not installed. The vulnerability is in KDE's terminal emulator Konsole. As stated in the advisory by KDE, Konsole versions < 25.04.2 are vulnerable.

On vulnerable systems remote code execution from a visited website is possible if the user allows loading of certain URL schemes (telnet://, rlogin:// or ssh://) in their web browser. Depending on the web browser and configuration this, e.g., means accepting a prompt in the browser.

ISPConfig contains design flaws in the user creation and editing functionality, which allow a client user to escalate their privileges to superadmin. Additionally, the language modification feature enables arbitrary PHP code injection due to improper input validation.

In 2023, During a security assessment of Masa CMS, an open-source content management system.

We discovered 11 vulnerabilities in Masa CMS, some allowing server takeover.

Why does it matter? Because it's easy to assume that "if it's open source, someone must have already reviewed it."

But the truth is:
No one looks until someone really looks.

Now, imagine if these vulnerabilities had been found by a malicious actor instead of a security researcher…

Hi all,

I've written a blog post to showcase the different experiments I've had with prompt injection attacks, their detection, and prevention. Looking forward to hearing your feedback.