HackingPassion.com
👻 home posts ethical hacking course newsletter shop whoami github youtube
HackingPassion.com
Hacking is not a hobby but a way of life

Ethical hacking,
zero to expert.

Hack like black hat hackers.
Penetration testing, Kali Linux, cybersecurity,
WiFi and web hacking,
and the mindset behind it.

View the course → The book
Ethical Hacking Complete Course Zero to Expert
The Book

Hacking Book

Everything I wish I had when I started. More than the course. Deeper explanations, real examples, the hacker mindset, and things I have never put online.

Coming soon Get notified when it drops → ← back to the course
SECURITY NEWS

Latest from the front line:

The newest CVEs, zero-days, malware, and breaches, taken apart so you can see how the attack works. I dig into the technical details, attack chains, and mistakes that made them possible.

All posts
You typed npm install. Before it finished, a worm had your SSH keys, your tokens and your cloud credentials, and 1,300 developers got the same.
August 5, 2026

ChainDrop Worm Steals Your Keys the Moment You Run npm Install

Malware on Windows can pull the 32-byte master key from Chrome and sign into passkey accounts with no fingerprint. Google cannot revoke it.
August 4, 2026

Google Password Manager Passkeys Hijacked by Malware on Windows

Hidden white text in a Word document can make Copilot rewrite your files and plant the same attack in new documents, and Microsoft has not stopped it.
August 3, 2026

Microsoft Copilot Can Turn a Word File Into an AI Worm That Spreads by Itself

On July 30 an attacker emptied 1,196 Coldcard wallets in 41 minutes and took 1,082 BTC, about 70 million dollars, rebuilt from a guessable seed.
August 2, 2026

Coldcard Wallets Built Guessable Keys and Lost 70 Million Dollars in 41 Minutes

Two heap memory flaws in the Linux kernel NTFS3 driver, both rated 7.8 high, found by sixteen year old Pavitra Jha and fixed upstream.
August 1, 2026

NTFS3 Kernel Bugs Let a Malicious Disk Corrupt Linux Memory

A 20 year old IPMI flaw lets 24,650 exposed server BMCs leak their password hash before anyone logs in, and there is no patch for it.
July 30, 2026

IPMI Flaw Leaks Password Hashes From 24,650 Exposed Servers

MedusaHVNC is rented malware that opens an invisible Windows desktop and drives your own logged in browser, so your bank sees a normal, trusted session.
July 28, 2026

MedusaHVNC Hijacks Your Bank From a Hidden Windows Desktop You Never See

A share link on Claude, ChatGPT, Grok, Gemini or Copilot makes a public page that search engines can list. See how it happens and how to lock it down.
July 27, 2026

Shared AI Chats Are Sitting Exposed on Search Engines

How Bitchat passes messages phone to phone over Bluetooth with no internet or servers, and the identity flaw that let attackers pose as your contacts.
July 26, 2026

Bitchat Is a Bluetooth Mesh Chat That Needs No Internet

OPEN SOURCE

My Arsenal: from recon to root

I like building my own tools instead of waiting for someone else to. Then I put them on GitHub for free. Now hundreds of thousands of hackers and researchers use them.

THE LAB

More from the lab:

Tutorials, tools and deep dives. The evergreen stuff, from Linux and labs to hands-on hacking guides.

All posts
Researchers hid a working exploit in a strand of DNA for 89 dollars. When a sequencer read it, the computer running it opened a shell back to them.
July 14, 2026

DNA Carried Malware Into a Computer for 89 Dollars

Windows trusts any signed driver. Attackers abuse that trust to reach the kernel and shut down your antivirus, sometimes with malware Microsoft signed.
July 11, 2026

Signed by Microsoft Does Not Mean Safe

A VPN does not make you private. It hands the record of every site you visit to a company you know far less about. Here is what really happens.
July 6, 2026

Why a Vpn Is Not Privacy

NEWSLETTER

Stay updated

New posts in your inbox, about once a week when I find the time. Ethical hacking, security news, the tools I build, and now and then something I can't stop digging into.