Intel suspended a bug bounty that paid up to $100,000. curl and HackerOne's IBB did the same this year.

Three researchers used Claude Opus 5 to chain a libheif bug into OpenAI's internal monorepo.

Google's Gemini accessed three real companies during a security test by guessing a password and finding credentials online.

One attacker used stolen signing and minting keys to drain FET and mint NTX, AGIX, and WMTx across three ASI Alliance projects.

A developer's guide to prompt injection in AI agents: direct vs indirect vs stored, why agentic AI security is hard, and how to prevent it, built on a real Manus case study.

The Brevo supply chain attack exposed 100K sites to ClickFix malware after attackers abused a hardcoded Cloudflare API key. Here's how it happened.

Two Maryland hospitals reverted to paper charts after a cyberattack. A technical look at how ransomware actually moves through a hospital network, and why availability, not data, is the real target.

McKesson's breach came through third-party apps, not its own code. A technical breakdown of the vishing-to-OAuth attack chain, why it keeps working, and how to test for it.

How the Liquid Network hack drained 95% of a Bitcoin sidechain's reserves in 23 minutes without compromising a single key, and what attack path validation would have caught.

SAST reads the repo. SCA reads the lockfile. Nothing reads the signed artifact your users install. Four macOS desktop clients audited, the recurring bug classes, and the method.

IDOR vulnerabilities let attackers access any user’s data with a simple ID change. Learn every variant, real exploits, and how to prevent it in APIs and SaaS systems.

Learn how AI penetration testing works, from reconnaissance and vulnerability discovery to exploitation, attack paths, reporting, and human validation.