Marcus White

Marcus is an Outpost24 cybersecurity specialist based in the UK, with 8+ years experience in the tech and cyber sectors. He writes about attack surface management, application security, threat intelligence, and compliance.

Homograph attacks: How hackers exploit look-alike domains

EASM 17 Apr 2025

Several years ago, a security researcher discovered a vulnerability in Google Chrome that allowed fake domains to bypass the browser's security measures. The researcher registered a domain that appeared as "xn--80ak6aa92e.com" but displayed as "apple.com" in the browser, demonstrating how…

Responsible vulnerability disclosure: Why it matters

Cybersecurity News 16 Apr 2025

The concept of responsible disclosure is a simple one. If you find a vulnerability, you let the affected organization or software vendor know before making the information public. This gives them time to patch the vulnerability before it can be…

CrushFTP auth bypass vulnerability: Disclosure mess leads to attacks

Application Security 02 Apr 2025

Outpost24 analysts recently discovered a critical authentication bypass vulnerability in CrushFTP, identified as CVE-2025-31161. The vulnerability has a CVSSv3.1 score of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8). We reached out to MITRE for a CVE on 13th March 2025 and were within an agreed…

white text on blue background visualizing the overwhelming amount of data in pen testing that can lead to false positives

How to reduce false positives when pen testing web apps

Application Security 12 Feb 2025

In the context of penetration (pen) testing, false positives are where the testing tools or methods identify a security vulnerability or issue that doesn’t actually exist. Essentially, a false alarm. This can happen for a few reasons, such as misconfigurations…