Insights & Cybersecurity Stories

GitHub Actions Security Checklist 2026: 25 Controls to Stop CI/CD Supply-Chain Attacks

A pentester-led GitHub Actions hardening checklist for 2026. Twenty-five controls across five categories, anchored on verified CVEs (tj-actions, reviewdog, Ultralytics, Nx s1ngularity, Shai-Hulud), with MITRE ATT&CK mapping and a sprint-by-sprint roadmap.

The Kerberos Double Hop Problem Is Not a Problem

A technical deep dive into the Kerberos double hop problem: why WinRM second hops fail, how TGT vs TGS and Windows logon types shape a session's credentials, and the offensive workarounds operators rely on.

The Dark Side of Next.js Server Actions: How Hidden Actions Can Bypass Your Access Controls

This blog explores a critical security flaw in Next.js Server Actions. It explains how attackers use the next-action header to bypass permissions and provides a comprehensive guide on enforcing server-side authorization to protect your data.

Supabase: Powerful, but One Misconfiguration Away From Disaster

A deep dive into Supabase's critical security flaw: how exposed Anon keys can lead to data disaster. Learn why Row Level Security (RLS) is essential to protect your PostgreSQL database.

Build, Clone, Defend: Long-Range RFID Attacks Explained

Learn how we built a portable 125kHz RFID cloner with 1–2m range. Understand real-world risks and discover key strategies to prevent credential cloning.

How Gustavo Recovered a Hacked Account on X (formerly Twitter)

Gustavo Roberto, a penetration tester at Stingrai.io, shares how he recovered a hacked X account. Learn the attacker's methods, key recovery steps, and tips to secure your account.

Is Flipper Zero a Threat for Organizations?

Explore the Flipper Zero’s capabilities, potential risks, and how to protect your organization from misuse. Learn expert mitigation strategies from Stingrai.io to secure your systems against this versatile hacking tool.

PCI-DSS Audit Process: Best Practices

Learn best practices for navigating the PCI-DSS audit process, from scope definition to remediation, ensuring ongoing compliance and data security.

Adversary Simulation in Telecom: Case Study

Discover how adversary simulation uncovers real-world telecom vulnerabilities. Learn key tactics, results, and remediation strategies to boost network security.