Not Your Average Bug Bounty: How an Email, a Shirt, and a Sticker Compromised a High Security Datacenter

Describes how attackers can submit phishing domains to web content filter categorization services so corporate filters whitelist the sites, improving success rates in phishing engagements.

ClickOnce deployment, built for easy Windows app installs, doubles as a phishing vector: one click can grant a malicious payload temporary admin privileges, controlled by registry trust settings.

Describes embedding a Base64 Meterpreter payload in an Office VBA macro so a legitimate emailed document can be re-sent as a backdoor after harvesting domain credentials.

Affects all WordPress installations from version 4.7.0 through 7.1.0 without requiring credentials or interaction beyond opening a post. Administrators should verify upgrading to 7.1.1 or backported releases, and monitor server logs for suspicious comment payloads and unexpected plugin uploads.

Nuclei Templates v10.4.2 and v10.4.3 ship 226 new templates covering 123 CVEs—about 10 actively exploited KEV entries—and push deeper into AI/LLM attack surface with 27 first-time contributors joining.

Paddle consolidated scattered Nuclei and Subfinder scans onto ProjectDiscovery, centralizing attack surface visibility, cutting discovery from days to hours, and supporting PCI DSS and SOC 2 audits.