Explore articles on Threat Intelligence, Cybersecurity, AppSec, and Information Security. Content created to share knowledge, analysis, and best practices that strengthen the security posture of organizations and professionals in the field.
-
SQL Injection in WordPress Depicter (CVE-2025-2011): When Queries Talk Too Much
Databases are meant to be structured, obedient, and a little boring. They answer questions, return rows, and quietly store the lifeblood of your application. But sometimes, when developers aren’t careful, those same databases turn into over-sharers. Ask them the wrong way, and they’ll happily spill secrets that were never meant to leave the server. That’s…
-
The Dark Side of AI Hacking
When people think of AI, they picture fast robots or chatbots dodging refunds — not hackers twisting models to leak data, write exploits, or sabotage training. Now imagine your company’s crown jewels in the hands of an AI that can be taught to betray you. Attackers don’t break in anymore; they just whisper the right…
-
The Power of OSINT: Mapping Data You Didn’t Know Existed
When you think about hacking, you probably imagine someone furiously typing commands into a terminal, exploiting vulnerabilities and breaching firewalls. But what if I told you that some of the most powerful attacks start with nothing more than a web browser and a curious mindset? Welcome to the world of OSINT—Open-Source Intelligence. No zero-days, no…
-
XXE Through RSS: Exposing Files with CVE‑2023‑38490 in Kirby CMS
When parsing goes wrong… bad things happen. XML was built to organize data, but when poorly handled, it can organize a disaster. That’s what happened with Kirby CMS and CVE‑2023‑38490, where a simple RSS feed parser became an entry point for an XML External Entity (XXE) attack. In this article, we’ll break down how XXE…
-
Mobile Hacking: Understanding the Risks and Defenses in the Palm of Your Hand
Mobile hacking is all about uncovering vulnerabilities in mobile apps before real attackers do. With the explosion of smartphones and mobile-first services, apps are handling more sensitive data than ever—making them an irresistible target for hackers. But what exactly is mobile hacking, how does it work, and what are the main techniques and tools used…
-
CVE-2025-23211: How a Jinja2 SSTI Vulnerability Turns Recipes Into RCE
When you think about vulnerabilities in web applications, classics like SQL Injection or XSS probably come to mind. But some flaws are hidden in plain sight, and one of them is SSTI—Server-Side Template Injection. This type of bug doesn’t just let attackers mess with your page; it can turn a seemingly innocent field into a…