ONSEC.io Pentesting blog

ONSEC: Boutique Penetration Testing Agency

Sign in Subscribe

Latest

Cyber Daily 1/17: Veeam Azure Backup Vulnerability, Microsoft's Massive Patch Tuesday, Fortinet's Zero-Day Exploit, Samsung's Galaxy S20 FE 5G Security Patch

Cyber Daily 1/17: Veeam Azure Backup Vulnerability, Microsoft's Massive Patch Tuesday, Fortinet's Zero-Day Exploit, Samsung's Galaxy S20 FE 5G Security Patch

Welcome to your daily dose of ONSEC Cyber Daily. Today's issue is packed with critical updates and insights on the latest cybersecurity threats and patches. We kick off with a vulnerability in Veeam Azure Backup Solution that allows attackers to enumerate networks, a serious threat that requires immediate

Cyber Daily 1/16: Fortinet, FortiOS Vulnerabilities Alert, AI's Double-Edged Sword, Google Chrome's Urgent Update, BeyondTrust Exploits, Microsoft's Record Patch Tuesday, macOS SIP Exploit, Rsync Flaws

Cyber Daily 1/16: Fortinet, FortiOS Vulnerabilities Alert, AI's Double-Edged Sword, Google Chrome's Urgent Update, BeyondTrust Exploits, Microsoft's Record Patch Tuesday, macOS SIP Exploit, Rsync Flaws

Cyber Daily 1/15: Quantum Tech Threatens Encryption, Beyond Trust and Olik Bugs on CISA's KEV List, Aviatrix Controller Flaw Exploited, Record 159 CVEs Patched in Microsoft's January Update

Cyber Daily 1/15: Quantum Tech Threatens Encryption, Beyond Trust and Olik Bugs on CISA's KEV List, Aviatrix Controller Flaw Exploited, Record 159 CVEs Patched in Microsoft's January Update

Cyber Daily 1/14: Schools' Data Breach, Ivanti Zero-Day Alert, Cyber Risks in Sex Toys, Microsoft Discloses macOS Vulnerability, Fortinet Firewalls Exploited

Cyber Daily 1/14: Schools' Data Breach, Ivanti Zero-Day Alert, Cyber Risks in Sex Toys, Microsoft Discloses macOS Vulnerability, Fortinet Firewalls Exploited

Cyber Daily 1/13: CISA's 4-Year Review, Sex Toy Cyber Threat, Samsung's S24, S23 Attacks, Malicious Browser Extensions, macOS and Ivanti Vulnerabilities, Google's Android Alert

Cyber Daily 1/13: CISA's 4-Year Review, Sex Toy Cyber Threat, Samsung's S24, S23 Attacks, Malicious Browser Extensions, macOS and Ivanti Vulnerabilities, Google's Android Alert

Cyber Daily 1/10: Ivanti VPN Vulnerability Exploited, ACSC Issues Alert, Quorum Cyber Acquires Kivu, Critical Mitel and Oracle Flaws, Ivanti and SonicWall Patches Urged

Cyber Daily 1/10: Ivanti VPN Vulnerability Exploited, ACSC Issues Alert, Quorum Cyber Acquires Kivu, Critical Mitel and Oracle Flaws, Ivanti and SonicWall Patches Urged

Cyber Daily 1/9: Ivanti and CISA Warn of Active Exploits, Mitel and Oracle Under Attack, Patching Urged for CVE-2025-0282, Cybersecurity Podcasts Trending

Cyber Daily 1/9: Ivanti and CISA Warn of Active Exploits, Mitel and Oracle Under Attack, Patching Urged for CVE-2025-0282, Cybersecurity Podcasts Trending

pentest

TCP Tarpit and Port Scanning. Barricades on Both Sides.

TCP Tarpit and Port Scanning. Barricades on Both Sides.

Introduction Thousands of articles have been written about port scanning, discussing techniques, methodologies, tools... Yet, even in such a seemingly straightforward topic, there are several less-covered nuances. If you regularly scan subnets, participate in bug bounties, perform penetration testing, or automate this process, then this article might be useful to

When you're so bored, you start debugging someone else's code: bug hunting in a random Cloud-Native project

When you're so bored, you start debugging someone else's code: bug hunting in a random Cloud-Native project

Sandbox escape or How to catch all servers of the company

Sandbox escape or How to catch all servers of the company

CodeQL vs Semgrep: Fun and Friendly Showdown of SAST tools🥊

CodeQL vs Semgrep: Fun and Friendly Showdown of SAST tools🥊

Fresh Blood: Why Changing Pentest Providers Can Improve Your Security Posture

Fresh Blood: Why Changing Pentest Providers Can Improve Your Security Posture

Getting ready for your first pentest: startup founders guide

Getting ready for your first pentest: startup founders guide

Pentests Matrix for Top Security Compliances

Pentests Matrix for Top Security Compliances

rceexploit

Deep Dive into the CVE-2022-29464 RCE exploit

Deep Dive into the CVE-2022-29464 RCE exploit

WSO2 is the leading API Management solution company. It provides various software products for connecting, managing, and securing APIs (Application Programming Interfaces). Organizations in various industries, including financial services, healthcare, government, telecommunications, and retail, use WSO2 products. In April 2022, security researchers recently found a critical vulnerability in certain WSO2

compliance

Pentests Matrix for Top Security Compliances

Pentests Matrix for Top Security Compliances

The multitude of guidelines and regulations can be overwhelming, especially when it comes to understanding the penetration testing requirements for each. Determining what each compliance standard requires from a penetration test can be a headache, but it's crucial to get it right. To simplify the process, we'