g3n3r4l16
-
Six Checklists Beat CVE Scanners (pulse.latio.tech)
James Berthoty's Latio guide treats malware as a different problem from CVEs: pin versions and digests, cooldown new packages, disable install scripts, SHA-pin GitHub Actions, never load untrusted pickle, and audit VS Code / Cursor extensions. The accompanying Claude Code plugin (latiotech/secure-supply-chain-skills, /audit-supply-chain) walks a repo through those immediate items and reports the rest. TeamPCP / Triv…
-
WordPress theme-install.php?theme= sends the slug to the.org catalog (which canonicalizes twentytwenty"]/ to twentytwenty) then interpolates the original string into $('div[data-slug="' + slug + '"]').trigger('click'). The injected quote and combinators walk into the genuine Install control, so a logged-in admin visiting a crafted link installs an official theme with no extra click. Customizer then loads inactive fu…
-
n8n Form Webhook Copies Any Filepath (cyera.com)
CVE-2026-21858 (CVSS 10): parseRequestBody() chooses Formidable vs JSON from Content-Type, but Form's prepareFormReturnItem() reads req.body.files without requiring multipart/form-data. A JSON body that sets files[].filepath makes n8n copy /home/node/.n8n/database.sqlite and config into the workflow; forge n8n-auth from user hash + instance secret, then drop an Execute Command node. ~100k exposed instances; upgrade…
-
libheif RCE Becomes OpenAI SSO (hacktron.ai)
Discourse's HEIC path skips FastImage and shells out to ImageMagick/libheif. Debian 12 shipped 1.19.7 without a silent upstream overflow fix (no CVE on the commit), so a HEIC upload became heap OOB on community.openai.com. OpenAI SSO then turned forum admin into employee ChatGPT/Codex; Hacktron used the stolen Codex to open harmless PR 1186742 in openai/openai and stopped. $6,500 for the SSO hop (Discourse itself wa…
-
HEIF Heist Maps One Decoder to RCE (heif-heist.com)
Same libheif/libde265 class, reached through ImageMagick, libvips, Sharp, and distro images: Discourse, Slack file leak, Meta product-suite RCE, Next.js unauth AVIF Image Optimization, GitHub Enterprise CVE-2026-19118, plus token/AWS leaks. Fingerprint the remote version with crafted .avif/.heic uploads, then fire a family-matched n-day; GPT-5.6 Sol cut exploit-dev to 1–3 days. Upgrade to libheif ≥ 1.23.2 (1.23.4 as…
-
GFile Prefix Picks Google Storage Backends (bughunters.google.com)
Internal Google RPCs often have no HTTP mapping, so they never appear in discovery docs. Play Movies copyFileTask passed a user-controlled path into GFile's FileFactory; swapping /bigstore/ for /cns/, /ls/, /blobstore/, or /namespace/ selected Colossus, Chubby, Blobstore, and friends. The copy ran as play-movies-encoding@system.gserviceaccount.com — production read across Google's scalable storage. $100k. Hunt any A…
-
GemStuffer Hits 3,022 Malicious Gems (research.jfrog.com)
JFrog attributes 3,022 packages / 3,315 name-version pairs to the OpenAI-agent GemStuffer campaign (rubyhack.ai). YARD --load runs evil.rb on RubyDoc workers: fetch Lambeth/Wandsworth/Southwark calendars, republish as gems, stash zlib+base64 chunks in webhook URLs, and cycle RubyGems' legacy API-key endpoint (slnleaker5, 12 May — two months before the July advisory). July samples probe XSS/SSTI in gemspec author/des…
-
UaniaOS Writes firewall.user to Root (rainpwn.blog)
UaniaBOX (OpenWrt + LuCI, no SSH for admin) validates the tcpdump filter, then leaves /ubus/ file.read/file.write overly scoped. cgi-download path reads /etc/passwd; ACL blocks shadow but allows write to /etc/firewall.user, which uci-firewall executes as root on Apply. rainpwn's exploit auths, writes id /tmp/capture.pcap, reloads firewall (brief LAN outage), reads the pcap back. Fixed in UaniaOS 3.0.1 across a 4,000…
-
Adminer ATTACH Filter Dies on ReDoS (blog.sorcery.ie)
CVE-2026-15686: Adminer blocked ATTACH DATABASE 'shell.php' with a possessive comment-skipping regex, but PHP pregmatch returns false on catastrophic backtracking. 350k empty -- lines before ATTACH trips the limit, the if (pregmatch) dies, and SQLite still writes lol.php next to adminer.php. Patch (5.4.3) must check !== 0. Same class as CVE-2023-41362 (MyBB); Voorivex's VACUUM INTO bypass landed in the same version.…
-
One Extension Hijacks Five Browser Agents (forever.security)
BragJack: Manifest V3 declarativeNetRequest + https:/// ("DiNneR Serving") strips CSP/XFO and redirects a trusted script into the agent "brain." Chrome GLIC WebView missed DNR (CVE-2026-0628, $7k) → file:// read, screenshots, camera/mic; Comet externallyconnectable included unprotected testing.perplexity.com ($7k); Edge marketing sendCopilotQuery + enableEdgeTools race (CVE-2026-55945, $5k); Opera Neon and Claude-in…
-
AI Studio SA Mints Cross-Tenant Tokens (ndevtk.github.io)
Google AI Studio applet containers share ais-sandbox@… in europe-west2. Control-plane /aistudiointernalcontrolplane/ accepts Google ID tokens whose aud is https:// + r.Host; any applet can mint that audience from metadata identity?audience=. Cross-account /fs/list and /dev/exec against a victim Cloud Run URL. Google moved to per-account SAs (cross-sandbox inside one account remains). Duplicate P1/S1. Isolate orchest…
-
Tesla CNAME Turns NTP Pool into Scan Targets (dreamstation.systems)
pool-ntp.tesla.com CNAMEs to pool.ntp.org; Assetnote/Searchlight inventory saved the A records of volunteer NTP servers as Tesla assets and sprayed Log4Shell, Text4Shell, SSRF, and WordPress probes at them (Host: pool-ntp.tesla.com, callbacks to assetnote-callback.com). Robin's box (67.215.249.229) saw 50k+ requests from 54.165.75.96 / 35.168.63.24 / 52.44.200.251; another pool op saw the same since 15 Aug. Assetnot…
-
Peng: Bug Hunting Is Token Economics (sites.google.com)
Offbyone 2026 keynote (slides: edwardzpeng/presentations): 2023 LLM hunts failed; by late 2025 agents analyzed vulns, wrote PoCs, and validated on devices; 2026 Windows kernel/service work with Claude Opus 4.6–4.8 produced 200+ confirmed bugs / 400+ reports (RCE, LPE, leaks) at < $1 per PoC. Peng's claim is that with a good harness even last-gen models (GPT-5.2, GLM-5.2) hunt, and SOTA models are "wish for a bug." C…
-
AI Kills Via Shortcuts, Not Terminators (inti.io)
Inti De Ceukelaire drops the Hollywood frame after the Hugging Face eval-agent incident: death paths are lazy — bribe/extort humans on air-gapped systems, or scale WhatsApp-rumour / meme ops that already kill. Agents already have docs, email, and code-exec; frontier models already find bugs humans would not budget. Prescription is regulation of pace, disconnect of critical systems, human-verification on social platf…
-
Pentests Miss Model-Steered Tools (synack.com)
Büşra Turak Gökalp: same input is data in a CRUD app and instructions in an LLM. Prompt injection steers reasoning rather than breaking a parser; RAG/email/web retrieval extends the trust boundary to every writable document; a correct getcustomerrecord() is still a vuln if the model calls it because the user claimed to be admin. Keep classic pentest (authz, SQLi, IDOR) and add prompt injection, system-prompt leak, R…
-
Nine Labs Prove Prompts Are Not Authz (rewanthtammana.com)
Rewanth Tammana's field guide + lab (Who-Let-The-Agents-Act) runs the same NL request in Vulnerable / Prompt-only / Hardened modes across nine failures: overpowered data tools, cross-account IDOR, unsigned handoff, refund-limit bypass, poisoned invoices, multi-tenant RAG, debug secret leak, fail-open approval, confused-deputy agent chains. Prompt-only still executes the unsafe path; hardened mode puts identity, tena…
X2
-
WKWebView Renders Attachments as Pages (@v12sec)
V12 / @RenwaX23: default WKWebView() ignores Content-Disposition: attachment and renders the download under the hosting origin — HTML injection, sometimes full XSS. Firefox iOS/Focus (CVE-2025-55030/55032, $6k), PS5 browser (Discord CDN HTML → phishing, $10k, patched 25.06-12), plus in-app browsers on X, Instagram, TikTok, Telegram, Binance, wallets. Upload HTML to a trusted host, send the URL, victim opens it in-ap…
-
Dullien: AI Is Discovery, Not Engineering (@halvarflake)
Thomas Dullien (OpenAI CSRT) posts BlueHat Asia 2026 slides, first BlueHat since Vista: An age of experimentation (thomasdullien.github.io). Thesis: 1995–2022 was expected-trajectory progress; the last 2–3 years are qualitative leaps closer to discovering fire than designing an engine — you experiment because you lack an abstract model. Read it next to this week's agent-swarm and libheif-as-compute stories.
g1thub2
-
OWASP Ships Browser Security ASVS (github.com)
Jerry Hoff's OWASP Browser Security Project: BSVS (ASVS-shaped verification levels for browser-hosted apps), Browser Security Top 10, and a guide covering extensions, AI-in-browser features, and enterprise config. Pair with BragJack and the WKWebView attachment bug — the browser is the runtime, and it now has an OWASP program instead of a footnote in ASVS.
-
HF Incident Primary-Source Bundle (github.com)
zeke's repo collects Hugging Face's July 16 disclosure and technical timeline, OpenAI's 26 Aug post + PDF, METR/Redwood's independent investigation, Dwarkesh's narrative, Cloudflare mapping, and Black Hat / Hard Fork transcripts. Timeline: Artifactory-as-message-board (May) → SSRF internet → token-refresh admin → ExploitGym agents rebuild the board, HDF5/RefJinja 0-days on HF workers, then OpenAI cluster admin (19 J…