Aliz Hammond

There are few packages as ubiquitous as the venerable cURL project. With over 25 years of development, and boasting “over ten billion installations”, it’s easy to see why a major security flaw could bring the Internet to a standstill - it’s on our endpoints, it’s on our

A few days ago, ZDI went public with no less than six 0days in the popular mail server Exim. Ranging from ‘potentially world-ending' through to ‘a bit of a damp squib’, these bugs were apparently discovered way back in June 2022 (!) - but naturally got caught up in the

As part of our Continuous Automated Red Teaming and Attack Surface Management technology - the watchTowr Platform - we're incredibly proud of our ability to discover nested, exploitable vulnerabilities across huge attack surfaces. Through our rapid PoC process, we enable our clients to understand if they are vulnerable

When Lexfo Security teased a critical pre-authentication RCE bug in FortiGate devices on Saturday 10th, many people speculated on the practical impact of the bug. Would this be a true, sky-is-falling level vulnerability like the recent CVE-2022-42475? Or was it some edge-case hole, requiring some unusual and exotic requisite before

As part of our Continuous Automated Red Teaming and Attack Surface Management capabilities delivered through the watchTowr Platform, we see a lot of different bugs in a lot of different applications through a lot of different device types. We're in a good position to remark on these bugs

In our latest blog post, we'll be discussing a vulnerability that - while not new - is shrouded in mystery. Ranging from bizarre and false PoCs circulating on Twitter, to incomplete analysis on dark corners of the web. As part of our Attack Surface Management capabilities delivered through

This post is the fourth part of a series on our recent adventures into DockerHub. Before you read it, you may be interested in the previous instalments, which are: * "I don't need no zero-dayz" - Docker Container Images (1/4) * Layer Cake: How Docker Handles Filesystem

This post is the third part of a series on our recent adventures into DockerHub. Before you read it, you are advised to look at the part other parts of this series: * "I don't need no zero-dayz" - Docker Container Images (1/4) * Layer Cake: How

This post is the second part of a series on our recent adventures in DockerHub. Before you read it, you may want to check out the other posts of this series: * "I don't need no zero-dayz" - Docker Container Images (1/4) * Learning To Crawl (For

This post is the first part of a series on our recent adventures into DockerHub. You may be interested in the next instalments, which are: * Layer Cake: How Docker Handles Filesystem Access (2/4) * Learning To Crawl (For DockerHub Enthusiasts, Not Toddlers) (3/4) * What Does This Key Open? -