# Security Researchers Find Vulnerabilities in Mental Health Apps; One With Millions of Users May Leak Therapy Notes Your AI therapist’s notes may be worth more than your credit card number on the dark web. Security analysis reveals a potential new frontier for cyber espionage. Oversecured, a mobile application security […]

# Time-to-Exploit is Negative 🔗 By now, you may have Anthropic’s zero-days blogpost where an “out-of-the-box” Claude Opus 4.6 workflow was used to find 500 vulnerabilities in open-source projects. While I think this is a logical application of LLMs (see may keynote at the recent Association for the Advancement of […]

# CVE-2025-6978: Arbitrary Code Execution in the Arista NG Firewall February 05, 2026 | TrendAI Research Team _In this excerpt of a TrendAI Research Services vulnerability report, Jonathan Lein and Simon Humbert of the TrendAI Research team detail a recently patched command injection vulnerability in the Arista NG Firewall. This […]

Director of Research **Published:** 05 February 2026 at 15:28 UTC **Updated:** 05 February 2026 at 15:30 UTC Welcome to the Top 10 Web Hacking Techniques of 2025, the 19th edition of our annual community-powered effort to identify the most innovative must-read web security research published in the last year. This […]

# OpenAI Explains URL-Based Data Exfiltration Mitigations in New Paper Last week I saw this paper from OpenAI called “Preventing URL-Based Data Exfiltration in Language-Model Agents”, which goes into detail on new mitigations they’ve added. **This is a great read.** I like this transparency. ### Initial Disclosure in 2023 Nearly […]

## TL;DR In December 2025, Cisco published https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sma-attack-N9bf4 addressing CVE-2025-20393, a critical vulnerability (CVSS 10.0) affecting Cisco Secure Email Gateway and Secure Email and Web Manager. The advisory was notably sparse on technical details, describing only “Improper Input Validation” (CWE-20). We decided to dig deeper. Through reverse engineering and code […]

A friend of mine, namely Antide “xarkes” Petit, came up with a pretty good rule of thumb that I think should be elevated into a law, Antide’s Law: > If it’s unclear what a cyber-security company is doing, what they’re doing is pretty clear. For example, take a look at […]

**Check Point Research** has identified several campaigns targeting multiple countries in the **Southeast Asian region**. These related activities have been collectively categorized under the codename “ **Amaranth-Dragon**”. The campaigns demonstrate a clear focus on **government entities** across the region, suggesting a motivated threat actor with a strong interest in **geopolitical […]

# How Mercari strengthened mobile security for millions of users with Oversecured # CUSTOMER SUCCESS STORY ## How Mercari strengthened mobile security for millions of users with Oversecured ### Case Study Summary **Company:** Mercari – Japan’s largest marketplace app **Industry:** E-commerce, FinTech, Mobile Marketplace **Challenge:** Securing mobile applications handling cryptocurrency, […]

# Auditing Outline. Firsthand lessons from comparing manual testing and AI security platforms 03 Feb 2026 – Posted by Luca Carettoni In July 2025, we performed a brief audit of Outline – an OSS wiki similar in many ways to Notion. This activity was meant to evaluate the overall posture […]