Cybersecurity

Attackers Target miniOrange SAML Flaws That Can Grant WordPress Admin Access

Bad actors are attempting to exploit two severe unauthenticated authentication bypasses in the Xecur…

Actively Exploited Oracle WebLogic Flaw Lets Unauthenticated Attackers Access Critical Data

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a maximum-severity …

Are there any currently working hacks for TouchTunes?

New here and to the whole world of pen testing and stuff. The first thing thats really inspiring me …

Private File Storage for User-Uploaded Documents with 15-Minute Signed URLs

Short answer: use a private, S3-compatible object store and issue short-lived signed URLs after your…

How to Create a BIMI Record (Free Generator + Real Setup Example)

How to Create a BIMI Record (Free Generator + Real Setup Example) If you've ever wondered why some…

Why your password manager shouldn't have a "god mode"

Your lead DevOps engineer quits on a Friday, no notice, master password included. Or maybe it's simp…

Complete Guide: Online Privacy Tools in 2026

Complete Guide: Online Privacy Tools in 2026 🔒 Recommended Tools VPN: ➡️ Get NordVPN…

Email Change Flows Need Risk Snapshots

Changing the primary email on an account looks routine in product roadmaps, but it is one of the hig…

A Broken-Link Check Counts 404s. The Resource That Breaks Your Padlock Returns 200.

Originally published on the Merlonix blog. A broken-link checker does one well-defined thing: it wa…

Is My Domain Blacklisted? Why a Public DNSBL Check Can Show a False Positive

Originally published on the Merlonix blog. A DNS blocklist (DNSBL, sometimes RBL) is a published li…

Why Bcrypt Fails Against Modern GPUs: Tuning Argon2id in Production

For over two decades, bcrypt has been the default recommendation for hashing passwords in production…

A 6-Gate Two Factor Login Test for SMS and Backup Email Delivery

Short answer: use SMS as the primary two factor authentication channel, poll its delivery state, and…