All Posts

1. OVERVIEW: Cisco Catalyst SD-WAN Controllers are affected by two vulnerabilities that can be chained together to achieve full system compromise. The first vulnerability, CVE-2026-20182, exists within the controller's peering authentication mechanism. By sending crafted requests to an affected system, an unauthenticated remote attacker can authenticate as an internal, high-privileged, non-root user account. This access provides the attacker with NETCONF capabilities, al

1. Incident Overview Check Point disclosed CVE-2026-50751, a critical zero-day authentication bypass vulnerability affecting multiple VPN products, including Mobile Access VPN, SSL VPN, Remote Access VPN, and Spark gateways. The vulnerability allows remote attackers to establish unauthorized VPN connections without valid credentials, providing a potential entry point into internal networks. According to Check Point, exploitation activity has been linked to tooling associ

Security teams are being urged to patch vulnerable SolarWinds Serv-U installations after CISA added CVE-2026-28318 to its Known Exploited Vulnerabilities (KEV) catalog. The vulnerability affects SolarWinds Serv-U Managed File Transfer and Secure FTP products and has already been observed being exploited in the wild to disrupt services and cause outages. Unlike many vulnerabilities that remain theoretical, this one has crossed an important threshold: attackers are actively usi

Recent threat intelligence reporting has revealed a targeted cyber espionage campaign leveraging a previously undocumented Remote Access Trojan (RAT) known as Atlas RAT. The malware has been linked to suspected state-sponsored threat actors targeting organizations throughout Europe. Unlike traditional financially motivated malware, Atlas RAT appears designed to provide long-term covert access to victim environments, enabling intelligence gathering and persistent surveillance.

By: Taylor Jackson, Nicholas Meade, Kenvodrick Jay, Odalys Huerta, Brice Hagood ​ Introduction Advanced Persistent Threats (APTs) represent one of the most formidable challenges in modern cybersecurity, combining stealth, persistence, and strategic intent that far exceed the capabilities of typical cybercriminal activity. Unlike opportunistic attacks that seek immediate financial gain, APTs are often orchestrated by well-resourced, state-sponsored groups whose operatio

CVE-2007-2447 is a critical remote command execution vulnerability affecting legacy versions of Samba . The issue stems from improper input sanitization when the username map script feature is enabled, allowing attackers to inject and execute arbitrary commands with elevated privileges. Although this vulnerability is over a decade old, it remains highly relevant in cybersecurity education due to how clearly it demonstrates the risks of insecure configuration combined with uns

Overview This lab demonstrates the exploitation of CVE-2011-2523 , a backdoor vulnerability affecting vsftpd version 2.3.4 . The objective was to move from service enumeration to confirmed system compromise in a controlled environment, while validating impact through manual testing rather than relying solely on automated scanners. Step 1: Service Enumeration The first step was identifying exposed services on the target system using focused service discovery. nmap -sV -p 21 <v

The Uncanny Adventures at Geek Squad: Too Secure for Their Own Good Edition Yesterday, I talked about the “A” in the CIA triad—Availability. Today’s story ties directly into that. For many older clients, the biggest issue isn’t malware, hackers, or data breaches. It’s simply getting locked out of their accounts. They don’t use password managers, they don’t understand passkeys—they just want their accounts accessible with a password they can remember and a reset option that do

The uncanny adventures at Geek Squad: The Scannow Edition Over the past week, I’ve had several clients come in frustrated because Windows or their games kept crashing. Systems were unstable, unavailable, and unusable — meaning one pillar of the CIA Triad was compromised: Availability. And yes — that alone can make this a cybersecurity incident. Too many people picture cybersecurity as hackers in basements, malware, or Hollywood-level digital warfare. But the CIA Triad isn’t b

The Uncanny Adventures at Geek Squad — A gentleman came in today, worried and shaken. He said his bank had called him — two unauthorized checks had been deposited into his account. Instinctively I asked the first question every security-minded person should: “Did you change your password?” “Yes,” he said. “The banker helped me reset it over the phone.” Good… right? My team lead and I inspected his phone — apps, settings, update history, anything suspicious. Nothing. No malwar

As many of you know, I’ve been working with Pearl Technologies on researching behaviors of Threat actors in newer and modern technology,...

Cap HTB – From IDOR to Root via Linux Capabilities Introduction The HackTheBox machine Cap is a great example of how seemingly small...

CVE-2020-1934: XXE to RCE in HTB “Markup” Box Walkthrough Box Name: Markup Vuln Spotlight: XXE exploitation leading to privilege...

Published on: August 23, 2025 By: Nickmeade1990 Introduction File Inclusion vulnerabilities are among the most dangerous flaws in...

In late 2021, the cybersecurity world was shaken by one of the most severe zero-days ever discovered: CVE-2021-44228 , better known as...

🎯 Introduction Recently, I decided to put together a quick live demonstration for my spouse to explain how vulnerability scanning and...

Threat actors. We all know them. Hacktivist – Malicious intent to proof a political point. Organized crime – criminal organization...

Passwords have been in our lives for decades. Even before technology, a spoken password might have been given to receive access to a...