A hands-on tour of Linux privilege escalation — SUID, capabilities, race conditions, and kernel memory bugs explained through 16 famous LPE CVEs, from Dirty COW and Dirty Pipe to PwnKit, Januscape, and RefluXFS.

XSS2Shell (CVE-2026-64638) explained: how a parser-disagreement XSS on the WordPress login page chains through the REST API and a fake plugin to achieve full Remote Code Execution.

TryHackMe Beach Bar walkthrough: DJ credentials in page source, YAML deserialization RCE for the user flag, and the root flag leaked in a process command line.

A comprehensive guide to JSON Web Tokens, covering how they work, common vulnerabilities, and how attackers exploit weak implementations.

A practical analysis of agentic pentesting capabilities, current tools, operational risks, guardrails, and the continuing need for human oversight.