Elttam

This post releases a new universal chain that turns a single Marshal.load into command execution on Ruby, built with new gadgets from untapped sources as well as old gadgets put to new use.

After reviewing Flowise, a popular AI agent/workflow platform, and its history of critical security advisories, we uncovered 6 new remote code execution vulnerabilities in v3.1.1/v3.1.2.

Welcome to the Top 10 Web Hacking Techniques of 2025, the 19th edition of our annual community-powered effort to identify the most innovative must-read web security research published in the last year

Discover how ORM Leak vulnerabilities affect more frameworks than you think, and how attackers can bypass common protections to steal sensitive data.

A new RCE gadget chain discovered in the sqlite3 gem affects all default Rails installations. Learn how unsafe reflection leads to remote code execution.

Understand ORM Leak vulnerabilities and how attackers exploit Django's ORM to extract sensitive data from your application.

Introducing Talkback, a smart infosec resource aggregator. Learn how it works, its key features, and how to use the UI and GraphQL API.

How we found a critical pre-authentication RCE in Home Assistant, exploring the attack surface and publishing advisories including CVE-2023-27482.

A practical guide to security code review for Go codebases, identifying dangerous patterns, common pitfalls, and Go-specific vulnerabilities.