Unauthenticated SQL injection in mJobTime (CVE-2026-9209) exposes construction and field services data. No vendor fix exists after 120-day disclosure.
Resources
Blog
Technical
Keep up to date with the latest offensive security news, knowledge, and resources.
Apex, one of Sprocket's AI agents, found a session injection flaw in minutes. Human testers chained it into two zero-days.
AI accelerates pentesting but human judgement close the gap. See how two real engagements turned quiet banners and a single timestamp into critical findings.
Discover how a self-propagating XSS worm exploits multi-tenant widget frameworks to autonomously spread across enterprise applications using legitimate API calls, bypassing CSP, evading audit trails, and surviving password changes.
MFA doesn't stop session cookie replay. Endpoint detection doesn't catch fileless malware without behavioral analysis. Here's the full post-phishing kill chain and what actually stops it.
Step-by-step walkthrough of cracking NTLMv1-SSP hashes with rainbow tables, including how to coerce auth, disable ESS, recover NT hashes, and remediate.
