ONSEC.io Pentesting blog

ONSEC: Boutique Penetration Testing Agency

Sign in Subscribe

Latest

Cyber Daily 3/28: Mozilla Patches Windows, Chrome Zero-Day Exploit, Kuala Lumpur Airport Cyberattack, Akira Ransomware Bypasses EDR, New macOS Malware Emerges

Cyber Daily 3/28: Mozilla Patches Windows, Chrome Zero-Day Exploit, Kuala Lumpur Airport Cyberattack, Akira Ransomware Bypasses EDR, New macOS Malware Emerges

Good morning, ONSEC Cyber Daily readers! Today, we're diving into a whirlwind of cybersecurity updates and alerts that have been making headlines. First off, Mozilla has released an urgent patch for Windows in response to the Chrome Zero-Day Exploit. This comes as the Kuala Lumpur Airport is hit

Cyber Daily 3/27: Next.js Middleware Vulnerability, Active SAP Exploitation, DrayTek Router Issues, Chrome's CVE-2025-2783 Patch, Ghostscript Threats

Cyber Daily 3/27: Next.js Middleware Vulnerability, Active SAP Exploitation, DrayTek Router Issues, Chrome's CVE-2025-2783 Patch, Ghostscript Threats

Cyber Daily 3/26: Google's Chrome Patch for Russian Espionage, DrayTek Router Vulnerabilities, Kubernetes Ingress-NGINX Flaws, Ukraine Infrastructure Attacks

Cyber Daily 3/26: Google's Chrome Patch for Russian Espionage, DrayTek Router Vulnerabilities, Kubernetes Ingress-NGINX Flaws, Ukraine Infrastructure Attacks

Cyber Daily 3/25: FBI Warns of Threats to Hospitals, Ukraine Defense Sector Under Attack, Critical Vulnerabilities in Next.js, Kubernetes, Cisco CSLU, and Veeam Software

Cyber Daily 3/25: FBI Warns of Threats to Hospitals, Ukraine Defense Sector Under Attack, Critical Vulnerabilities in Next.js, Kubernetes, Cisco CSLU, and Veeam Software

Cyber Daily 3/21: Veeam and IBM Patch High-Risk Flaws, Google Chrome Users Warned of Cyber Threats, Dell and CISA Alert on Vulnerabilities, Chinese Hackers Exploit Exchange Vulnerabilities

Cyber Daily 3/21: Veeam and IBM Patch High-Risk Flaws, Google Chrome Users Warned of Cyber Threats, Dell and CISA Alert on Vulnerabilities, Chinese Hackers Exploit Exchange Vulnerabilities

Cyber Daily 3/20: Clovis Scam, FBI Warns of Gmail and Outlook Attacks, Microsoft Alerts on StilachiRAT, CISA Highlights Fortinet and GitHub Vulnerabilities, CERT NZ Advises on Apache Tomcat

Cyber Daily 3/20: Clovis Scam, FBI Warns of Gmail and Outlook Attacks, Microsoft Alerts on StilachiRAT, CISA Highlights Fortinet and GitHub Vulnerabilities, CERT NZ Advises on Apache Tomcat

Cyber Daily 3/19: SquareX Exposes Browser Vulnerabilities, CISA Adds Exploited Flaws to Catalog, AMI BMC and DeepSeek AI Vulnerabilities Raise Concerns, Google and Linux Patch Critical Issues

Cyber Daily 3/19: SquareX Exposes Browser Vulnerabilities, CISA Adds Exploited Flaws to Catalog, AMI BMC and DeepSeek AI Vulnerabilities Raise Concerns, Google and Linux Patch Critical Issues

pentest

TCP Tarpit and Port Scanning. Barricades on Both Sides.

TCP Tarpit and Port Scanning. Barricades on Both Sides.

Introduction Thousands of articles have been written about port scanning, discussing techniques, methodologies, tools... Yet, even in such a seemingly straightforward topic, there are several less-covered nuances. If you regularly scan subnets, participate in bug bounties, perform penetration testing, or automate this process, then this article might be useful to

When you're so bored, you start debugging someone else's code: bug hunting in a random Cloud-Native project

When you're so bored, you start debugging someone else's code: bug hunting in a random Cloud-Native project

Sandbox escape or How to catch all servers of the company

Sandbox escape or How to catch all servers of the company

CodeQL vs Semgrep: Fun and Friendly Showdown of SAST tools🥊

CodeQL vs Semgrep: Fun and Friendly Showdown of SAST tools🥊

Fresh Blood: Why Changing Pentest Providers Can Improve Your Security Posture

Fresh Blood: Why Changing Pentest Providers Can Improve Your Security Posture

Getting ready for your first pentest: startup founders guide

Getting ready for your first pentest: startup founders guide

Pentests Matrix for Top Security Compliances

Pentests Matrix for Top Security Compliances

rceexploit

Deep Dive into the CVE-2022-29464 RCE exploit

Deep Dive into the CVE-2022-29464 RCE exploit

WSO2 is the leading API Management solution company. It provides various software products for connecting, managing, and securing APIs (Application Programming Interfaces). Organizations in various industries, including financial services, healthcare, government, telecommunications, and retail, use WSO2 products. In April 2022, security researchers recently found a critical vulnerability in certain WSO2

compliance

Pentests Matrix for Top Security Compliances

Pentests Matrix for Top Security Compliances

The multitude of guidelines and regulations can be overwhelming, especially when it comes to understanding the penetration testing requirements for each. Determining what each compliance standard requires from a penetration test can be a headache, but it's crucial to get it right. To simplify the process, we'