Blog
Wordpress Route Confusion To Unauthorized Access
Diving into Wordpress Security. The art of unauthorized access through Route confusion and SQLi - CVE-2026-63030 CVE-2026-60137
Read Blog
AirOverflow Blog
News and resources from the Airoverflow team - offensive security, threat research, and web application hacking.
Subscribe to our newsletter for weekly security insights
How Not to Write Insecure Infrastructure-as-Code
IaC promised us freedom from clicking around cloud consoles like cavemen. It delivered, and also handed us new and exciting ways to hand our entire infrastructure to a stranger. Here's how not to do that.
Fuzzing Menu-Based CTF Challenges with AFL++
Menu-driven heap challenges are stateful, so a raw byte fuzzer bounces off them. This guide builds a vulnerable heap note manager, then writes a structure-aware AFL++ harness that turns the fuzzer's bytes into menu operations and finds the bug for you.
Fuzzing the Linux Kernel Locally with AFL++
A hands-on guide to coverage-guided fuzzing with AFL++: building instrumented targets, writing harnesses, and driving the Linux kernel under a local syscall fuzzer without cloud infrastructure.