Follow the evidence.

CVE-2023-32874: Mediatek Baseband Excessive Number of SDP rtpmap Entries Leads to Stack Buffer Overflow

An attacker sending a malformed SIP message over VoLTE to a device with a Mediatek baseband can trigger the vulnerability described here. The impact is stack buffer overflow in the baseband, triggered by malformed SDP data in VoLTE message such as SIP INVITE or MESSAGE request. The vulnerability described in this advisory affected a wide range of Mediatek devices. The January 2024 issue of the Med

[BugTales] REUnziP: Re-Exploiting Huawei Recovery With FaultyUSB

Last year we published UnZiploc, our research into Huawei’s OTA update implementation. Back then, we have successfully identified logic vulnerabilities in the implementation of the Huawei recovery image that allowed root privilege code execution to be achieved by remote or local attackers. After Huawei fixed the vulnerabilities we have reported, we decided to take a second look at the new and impr

Markdown Renderers: The XSS Factory Hiding in Every Modern App

You are not looking for a missed escape. You are looking at a component designed to generate markup from untrusted text.Continue reading on System Weakness »

The Easy Bug Series | #02

The $2 Million Ransomware Attack That Started With One Line of Code

Netmiko vs Paramiko vs NAPALM vs Ansible: Which Tool Does Your Network Need?

Your Oracle Traffic Is Readable on the Wire. Here’s the Proof, and the Fix.

THM - Jump

A writeup for “Jump” on TryHackMe.Continue reading on System Weakness »

URL https://tryhackme.com/room/theo365intrusionContinue

Indicator published by the cited source.

The API Wasn’t Hiding Anything. It Was Telling Me Exactly How the Application Worked.

How API endpoints, JSON objects, undocumented parameters, HTTP methods, and authorization boundaries expose an application’s real attack…Continue reading on System Weakness »

Easy Bug Series | #05

The O365 Intrusion-TryHackMe Wlkthrough

Link to the room https://tryhackme.com/room/theo365intrusionContinue reading on System Weakness »

The Login Worked. But What Actually Proved I Was Authenticated?

Understanding authentication flows, session cookies, tokens, login state, logout, and the security boundaries between themContinue reading on System Weakness »

What Customers Value in a Penetration Testing Partner: Insights from G2 Reviews

Synack was named a Leader in G2's Fall 2026 Grid® and Enterprise Grid® Reports for Penetration Testing. The reviews show what customers value in a pentesting partner: visibility into testing, access to experts, findings they can fix and verify, and a partner that acts on feedback. The post What Customers Value in a Penetration Testing Partner: Insights from G2 Reviews appeared first on Synack.

Penetration Testing for Third-Party Risk Management Programs

Penetration testing for third-party risk works best as a deeper assurance layer for suppliers whose compromise would meaningfully affect the enterprise, not as a blanket requirement. Tier vendors by data access, system access, operational weight, and external exposure, then match testing depth and cadence to that tier. Combine vendor-supplied reports, enterprise-commissioned tests, and shared plat

Build or Buy AI Pentesting? 5 Tests to Judge Production Readiness

Before you build an AI pentesting agent, run it through 5 tests for production readiness. Mark Kuhr breaks down what separates a prototype from a system. The post Build or Buy AI Pentesting? 5 Tests to Judge Production Readiness appeared first on Synack.

Penetration Testing for Compliance Officers: A Non-Technical Buyer’s Guide

Why Pentest Proposals Never Seem to Match A compliance officer receives a request for a penetration test, contacts several providers, and receives proposals that appear to describe completely different services. One covers external IP addresses, another includes applications and APIs, and a third promises audit-ready evidence without explaining what was tested. This guide to penetration […] The po

Unifying Security Testing and Exposure Management: Introducing the Synack and Wiz Integration

Security testing and exposure management have run on separate tracks for years, leaving a blind spot between what a scanner flags and what an attacker can exploit. Synack's new integration with Wiz closes that disconnect, feeding continuously validated pentest findings directly into Wiz's exposure management view. The post Unifying Security Testing and Exposure Management: Introducing the Synack a

Penetration Testing Vendor Comparison: What Enterprises Should Compare

Why Two “Penetration Testing” Quotes Rarely Mean the Same Thing Most comparisons of penetration testing vendors begin too late. Buyers shortlist several providers, collect proposals, and then try to compare services that were never equivalent in the first place. One vendor may quote for a single application and a final report, while another may include […] The post Penetration Testing Vendor Compa

AWS Penetration Testing for Enterprises: What to Scope and How to Budget

AWS penetration testing is scoped by accounts, identities, and exposed workloads, not IP ranges. AWS lets customers test a defined list of services without prior approval, but it prohibits flooding, DNS attacks, and takeovers, and it requires approval for command-and-control and simulated events. Budget follows two drivers: account and IAM complexity for the cloud control plane, and the number of

Turn Scanner Findings into Validated Risk with Synack and Qualys

A year since launching Synack’s integration with Qualys, the partnership now includes broader platform support, more AI-led testing, and a shared presence at Qualys ROCon Americas 2026. The post Turn Scanner Findings into Validated Risk with Synack and Qualys appeared first on Synack.

How to Scope an Enterprise Penetration Test: Free Scope-of-Work Template

A penetration testing scope defines the assurance an enterprise needs, not just the assets a vendor will touch. Start with the business or compliance objective, then map the system boundary before counting assets. List applications, APIs, infrastructure, roles and integrations separately, specify authenticated and unauthenticated testing, and clarify whether production, staging or both will be […]

Penetration Testing RFP: What to Include and How to Evaluate Responses

Most penetration testing RFPs ask vendors to price "one web application" or "an annual pentest" and leave the rest open to interpretation. This guide gives you a complete penetration testing scope-of-work template, a standard vendor response format, a weighted scorecard, and a pass/fail checklist, so every proposal answers the same questions and gets measured against the same bar. The post Penetra

What Is a Website Attack Surface? A Beginner’s Guide to Reducing Risk

Each feature that you add to a website results in a new element that has to be managed. The credentials are accepted by a login page, the data by a contact form, new code is introduced by a plugin, and an API is used to connect your website to another service. It is also possible that an old staging site or a forgotten backup may still be accessible from the internet. The collection of these expos