OOghenemaro Ikelegbe·5d agoMS Paint: A "Zero-Click" Flaw Hits Windows' Lovable Drawing AppMicrosoft confirmed a flaw in MS Paint that could let attackers run code remotely. Here’s what happened and the fixed version2 min read·cybersage.hashnode.dev
AArshad·Oct 22PHP Developers Wanted a Patch. Hackers Wanted a PoC. Nobody SleptDiscover PHP2Shell, the critical PHP zero-days, and how AI agents are accelerating vulnerability research, PoC development, and security threats.5 min read·blog.arshadakl.in1A
VVũ Nhật Lâm·Oct 13One Email Was Enough: When a Guardrail Detects the Attack and Still Can't Stop ItSummary Salt Labs, the research arm of Salt Security, turned the agentic AI platform Manus into a path to remote code execution with a single email. The victim did not have to click a link, download a9 min read·blog.fiscybersec.com1X
YYogeshwar Peela·Oct 12TryHackMe: PlottedTMS WriteupExplore the TryHackMe Plotted room walkthrough covering SQL injection, PHP web shell upload,cron-based privilege escalation, and doas misconfiguration8 min read·exploitnotes.hashnode.dev
YYogeshwar Peela·Oct 12TryHackMe: Gallery WriteupExplore the TryHackMe Gallery walkthrough covering SQL injection, PHP webshell upload, leaked credentials, sudo misconfiguration, and nano privilege.7 min read·exploitnotes.hashnode.dev
YYogeshwar Peela·Sep 22TryHackMe: Adventure Time WriteupAdventure Time TryHackMe writeup covering FTP EXIF clues, web puzzles, Morse, AES, Vigenère, Spoon, steganography, and Exim CVE-2019-10149.11 min read·exploitnotes.hashnode.dev
YYogeshwar Peela·Sep 22TryHackMe: Python Playground WriteupPython Playground TryHackMe writeup covering Python sandbox bypass, RCE, credential recovery, Docker container escape, and SUID privilege escalation.8 min read·exploitnotes.hashnode.dev
YYogeshwar Peela·Sep 10TryHackMe - Olympus WriteupOlympus TryHackMe writeup covering Victor CMS SQL injection, credential cracking, file upload RCE, SUID abuse, SSH access, and root shell.10 min read·exploitnotes.hashnode.dev
AAlireza Kalhor·Aug 25CVE-2026-17532: nonce: true => Web ShellUnauthenticated XSS in a WordPress caching plugin (50,000+ sites) chains into 1-click RCE via a PHP type-juggling bug. Write-up + PoC lab inside.7 min read·kalhor.hashnode.dev
4404 Founders·Aug 26Two Exchange Bugs, Two Very Different PrerequisitesTwo August Exchange flaws share a patch window, but the attack prerequisites are different enough that defenders should not treat them as one problem.3 min read·404-founders.com1
