API Connections allow anyone to fully compromise any other connection worldwide, giving full access to the connected backend.

TL;DR. SConnect - 1M+ users, an extension middleware+native host for authentication with eIDs, 3SKeys and other hardware signing tokens had a drive-by RCE which enabled any site or iframe a user saw to silently download and execute a dll due to a poor hand-rolled implementation of RSA-2048 token validation, enabling a use of uninitialized memory validation bypass which enabled "plugins" (DLLs) to be loaded. v2.16.0.0 of the extension and native host is vulnerable. CVE-2026-18397. CVSS 9.4.

A blue-team writeup on detecting a compromised MikroTik from its own config. Seven techniques, each with the collection command, the artifact it leaves behind, and a triage step. Feedback welcome.

OpenBao engineers at ControlPlane have chained 4 vulnerabilities to show how under certain conditions, an OpenBao or Vault server can be completely compromised from an unauthenticated position. This is only the second RCE ever found in the Vault codebase.

The exploit is highly plausible in real-world environments, requiring only an unauthenticated entry path and a defined Raft snapshot policy to trigger a complete server compromise.

If you are impacted, upgrade as soon as possible to OpenBao 2.6.3 or 2.7.0

While OpenBao is fully patched, HashiCorp Vault remains exposed as of writing. Unfortunately, IBM's unwillingness to coordinate a mutual disclosure policy means Vault users currently lack an official mitigation

This is an article about the internals of Win32k (Windows's GUI subsystem) and their callouts, with the purpose of shedding light on a very undocumented and crucial subsystem in Windows :)

Proton Mail confirmed and paid for an email-spoofing bug, then left it unfixed for 16 months

Short version: OT tooling mostly sucks, abandoned repos or stuff that stops at a banner grab. Every assessment I ended up glueing pymodbus, asyncua and snap7 scripts together. OIDA is my attempt at putting one syntax over all of it: oida <protocol> <target>, nxc-style.

Same checks everywhere: writable registers, default creds, anonymous access, missing TLS/GOOSE per IEC 62351. Plus passive discovery (PROFINET DCP, CODESYS), pcap analysis for building an inventory offline, and boofuzz fuzzing on top. Runs fully offline, air-gapped is fine.

To be clear: it wraps existing protocol libs, doesn't reimplement them. The interesting part is the layer on top, that's what the writeup is about.

Feedback welcome, repo in comments.

Unlike traditional approaches, console named-pipe injection does not use VirtualAllocEx and WriteProcessMemory. Instead, it takes advantage of read and write operations through a named pipe, along with the way console programs store interactive commands in memory.