BestHub
Sign in
Black & White Path
Author

Black & White Path

We are the beacon of the cyber world, a stepping stone on the road to security.

219
Articles
0
Likes
7
Views
0
Comments
Recent Articles

Latest from Black & White Path

100 recent articles max
Black & White Path
Black & White Path
Apr 12, 2026 · Information Security

How an APT Hijacked Apple Accounts in 30 Seconds to Spy on Middle‑East Journalists

A three‑year investigation by Access Now, SMEX and Lookout reveals that the Indian APT group BITTER conducted rapid Apple‑ID phishing, 2FA‑relay attacks and Android spyware deployments to fully compromise the accounts of journalists across the Middle East and North Africa, often within 30 seconds of credential entry.

2FA bypassAPTAndroid spyware
0 likes · 9 min read
How an APT Hijacked Apple Accounts in 30 Seconds to Spy on Middle‑East Journalists
Black & White Path
Black & White Path
Apr 12, 2026 · Information Security

How a Global Ad System Turns Everyday Ads into Government Surveillance

Citizen Lab’s investigation reveals that the Webloc platform harvests advertising IDs and real‑time bidding data from billions of mobile devices, enabling law‑enforcement agencies in the US, EU and elsewhere to track half a billion users worldwide, while most users remain unaware of the privacy risks.

Citizen LabWeblocadvertising ID
0 likes · 16 min read
How a Global Ad System Turns Everyday Ads into Government Surveillance
Black & White Path
Black & White Path
Apr 12, 2026 · Information Security

How Prototype Pollution in React Server Functions Enables Remote Code Execution (CVE‑2025‑55182)

The article analyzes the critical CVE‑2025‑55182 vulnerability affecting React Server Functions in Next.js, detailing how prototype‑pollution during serialization between server components and the client runtime allows attackers to inject __proto__ or constructor.prototype payloads and achieve remote code execution.

CVE-2025-55182Next.jsPrototype Pollution
0 likes · 2 min read
How Prototype Pollution in React Server Functions Enables Remote Code Execution (CVE‑2025‑55182)
Black & White Path
Black & White Path
Apr 11, 2026 · Information Security

Inside the Exposed TheGentlemen Ransomware Toolkit on Proton66

In March 2026 Hunt.io researchers uncovered an open directory on the Russian bullet‑proof host Proton66 that contains the full TheGentlemen ransomware toolkit, complete with Mimikatz credential logs, ngrok tokens, and 21 MITRE ATT&CK techniques, providing a detailed view of the attackers' reconnaissance, privilege‑escalation, defense‑evasion, credential‑access, persistence, and encryption‑preparation stages.

MITRE ATT&CKMimikatzProton66
0 likes · 22 min read
Inside the Exposed TheGentlemen Ransomware Toolkit on Proton66
Black & White Path
Black & White Path
Apr 11, 2026 · Information Security

A Beginner’s Struggle: Securing a Compromised ThinkPHP Site Over Several Days

The author recounts a multi‑day incident response to a ThinkPHP website that was compromised via a weak admin password, detailing how repeated data tampering, hidden scheduled‑task scripts, and a ransom message were investigated, mitigated, and finally contained through systematic hardening and monitoring.

MalwarePHPServer Hardening
0 likes · 7 min read
A Beginner’s Struggle: Securing a Compromised ThinkPHP Site Over Several Days
Black & White Path
Black & White Path
Apr 11, 2026 · Information Security

Why Network Security Professionals Must Reject AI‑Driven Automation

It warns that over‑reliance on AI‑based automatic penetration tools erodes manual reverse‑engineering skills, jeopardizes national cyber defense, and endangers colleagues, urging security experts to retain hands‑on expertise and avoid becoming dependent on AI.

AI ethicsCyber DefenseInformation Security
0 likes · 3 min read
Why Network Security Professionals Must Reject AI‑Driven Automation
Black & White Path
Black & White Path
Apr 10, 2026 · Information Security

AI as a Compliance Fraud Tool: Delve’s Fake Compliance-as-a-Service Case

The article dissects the Delve incident, revealing how an AI‑driven compliance platform fabricated evidence and reports, the technical workflow behind the deception, associated legal and security risks, and broader lessons for responsible AI use in high‑stakes governance and information security.

AI complianceGenerative AIInformation Security
0 likes · 14 min read
AI as a Compliance Fraud Tool: Delve’s Fake Compliance-as-a-Service Case
Black & White Path
Black & White Path
Apr 10, 2026 · Information Security

How the M6Plus Bluetooth POS Can Reverse‑Hijack Your PC via CVE‑2026‑4583

A deep security analysis reveals that the M6Plus Bluetooth payment terminal suffers from a protocol flaw—CVE‑2026‑4583—that lacks encryption, replay protection, and uses a weak XOR checksum, enabling attackers to spoof the device, inject malicious packets, and gain admin control of paired computers or phones.

BLEBluetoothCVE-2026-4583
0 likes · 7 min read
How the M6Plus Bluetooth POS Can Reverse‑Hijack Your PC via CVE‑2026‑4583