Full Width [alt+shift+f] Shortcuts [alt+shift+k]
Sign Up [alt+shift+s] Log In [alt+shift+l]
14
Surprise surprise, we've done it again. We've demonstrated an ability to compromise significantly sensitive networks, including governments, militaries, space agencies, cyber security companies, supply chains, software development systems and environments, and more. “Ugh, won’t they just stick to creating poor-quality memes?” we
2 weeks ago

Improve your reading experience

Logged in users get linked directly to articles resulting in a better reading experience. Please login for free, it takes less than 1 minute.

More from watchTowr Labs

Get FortiRekt, I am the Super_Admin Now - FortiOS Authentication Bypass CVE-2024-55591

Welcome to Monday, and what an excitingly fresh start to the week we're all having. Grab your coffee, grab your vodka - we're diving into a currently exploited-in-the-wild critical Authentication Bypass affecting foRtinet's (we are returning the misspelling gesture 🥰) flagship SSLVPN appliance, the

3 weeks ago 16 votes
Exploitation Walkthrough and Techniques - Ivanti Connect Secure RCE (CVE-2025-0282)

As we saw in our previous blogpost, we fully analyzed Ivanti’s most recent unauthenticated Remote Code Execution vulnerability in their Connect Secure (VPN) appliance. Specifically, we analyzed CVE-2025-0282. Today, we’re going to walk through exploitation. Once again, however, stopping short of providing the world with a

a month ago 29 votes
Do Secure-By-Design Pledges Come With Stickers? - Ivanti Connect Secure RCE (CVE-2025-0282)

Did you have a good break? Have you had a chance to breathe? Wake up. It’s 2025, and the chaos continues. Haha, see what we did? We wrote the exact same thing in 2024 because 2024 was exactly the same. As an industry, we are on GroundHog day

a month ago 31 votes
Backdooring Your Backdoors - Another $20 Domain, More Governments

After the excitement of our .MOBI research, we were left twiddling our thumbs. As you may recall, in 2024, we demonstrated the impact of an unregistered domain when we subverted the TLS/SSL CA process for verifying domain ownership to give ourselves the ability to issue valid and trusted TLS/

a month ago 42 votes

More in technology

How Core Git Developers Configure Git

What `git config` settings should be defaults by now? Here are some settings that even the core developers change.

15 hours ago 4 votes
WordCamp Asia and Maha Kumbh Mela

It’s been fantastic being in the Philippines for this year’s WordCamp Asia. We have attendees from 71 countries, over 1,800 tickets sold, and contributor day had over 700 people! It’s an interesting contrast to US and EU WordCamps as well in that the audience is definitely a lot younger, and there’s very little interest in … Continue reading WordCamp Asia and Maha Kumbh Mela →

17 hours ago 3 votes
Odds and Ends #59: The end of "woke capitalism"

Plus the government did the stupid thing after all.

15 hours ago 2 votes
“Trust me”

I’m not trying to send any hate at a random MacRumors forum commentor who I don’t know, so please take this more as me explaining why there’s more skepticism about the Vision Pro than other gen-1 Apple products. From the post: BTW, I also

yesterday 3 votes
IC Necklace

[Misc] Setting silicon

yesterday 5 votes