Leaking Meta FXAuth Token leading to 2 click Account Takeover
https://ysamm.com/uncategorized/2026/01/16/leaking-fxauth-token.html
https://ysamm.com/uncategorized/2026/01/16/leaking-fxauth-token.html
❤5
Account Takeover in Facebook mobile app due to usage of cryptographically unsecure random number generator and XSS in Facebook JS SDK
https://ysamm.com/uncategorized/2026/01/17/math-random-facebook-sdk.html
https://ysamm.com/uncategorized/2026/01/17/math-random-facebook-sdk.html
❤12
Iframe Sandbox Trick
Triggering Authentication Dialogs Without allow-popups
https://phor3nsic.github.io/2026/01/21/trick-iframe-sandbox.html
Triggering Authentication Dialogs Without allow-popups
https://phor3nsic.github.io/2026/01/21/trick-iframe-sandbox.html
Phor3nsic Security Research
Iframe Sandbox Trick
Home About Posts
❤5👍2
GatewayToHeaven: Finding a Cross-Tenant Vulnerability in GCP's Apigee
https://omeramiad.com/posts/gatewaytoheaven-gcp-cross-tenant-vulnerability/
https://omeramiad.com/posts/gatewaytoheaven-gcp-cross-tenant-vulnerability/
Omeramiad
GatewayToHeaven: Finding a Critical Cross-Tenant Exploit in GCP's Apigee | Omer Amiad's Blog
A technical step-by-step writeup about finding CVE-2025-13292, a cross-tenant vulnerability in Google Cloud's Apigee. This vulnerability allowed an attacker to gain read/write access to verbose cross-tenant access logs and analytics data that could contain…
❤10👍3
Evaluating and mitigating the growing risk of LLM-discovered 0-days
https://red.anthropic.com/2026/zero-days/
https://red.anthropic.com/2026/zero-days/
❤4👎1🤔1
Forwarded from Android Security & Malware
Understanding and Experimenting with Apple's Pointer Authentication Codes (PAC) on iOS
https://blog.reversesociety.co/blog/2026/pointer-authentication-code-for-ios
https://blog.reversesociety.co/blog/2026/pointer-authentication-code-for-ios
❤3
TRUSTING CLAUDE WITH A KNIFE: UNAUTHORIZED PROMPT INJECTION TO RCE IN ANTHROPIC’S CLAUDE CODE ACTION
https://johnstawinski.com/2026/02/05/trusting-claude-with-a-knife-unauthorized-prompt-injection-to-rce-in-anthropics-claude-code-action/
https://johnstawinski.com/2026/02/05/trusting-claude-with-a-knife-unauthorized-prompt-injection-to-rce-in-anthropics-claude-code-action/
John Stawinski IV
Trusting Claude With a Knife: Unauthorized Prompt Injection to RCE in Anthropic’s Claude Code Action
An external attacker could submit a pull request to any repository using Claude Code Action, wait for a reviewer to trigger the action, and then replace the PR title with a prompt injection payload…
❤10👍2
RCE in Google's AI code editor Antigravity - $10000 Bounty
https://www.hacktron.ai/blog/hacking-google-antigravity
https://www.hacktron.ai/blog/hacking-google-antigravity
Hacktron AI
RCE in Google's AI code editor Antigravity - $10000 Bounty
Hacktron AI Research Team discovered a critical RCE in Google’s Antigravity IDE that lets attackers take over your system just by opening a malicious website.
❤8👏8
When Audits Fail Part 2: From Pre-Auth SSRF to RCE in TRUfusion Enterprise
https://www.rcesecurity.com/2026/02/when-audits-fail-from-pre-auth-ssrf-to-rce-in-trufusion-enterprise/
https://www.rcesecurity.com/2026/02/when-audits-fail-from-pre-auth-ssrf-to-rce-in-trufusion-enterprise/
RCE Security GmbH - Your European Partner for Offensive Security
When Audits Fail Part 2: From Pre-Auth SSRF … | RCE Security
A pre-auth SSRF in TRUfusion Enterprise (CVE-2025-32355) allows external attackers to reach internal-only services via a misconfigured reverse proxy. This …
❤12
GraphQL Pentesting for Bug Bounty Hunters: From Endpoint Discovery to High-Impact Exploits…!
https://medium.com/@mpjani294/graphql-pentesting-for-bug-bounty-hunters-from-endpoint-discovery-to-high-impact-exploits-821f64a953b5
https://medium.com/@mpjani294/graphql-pentesting-for-bug-bounty-hunters-from-endpoint-discovery-to-high-impact-exploits-821f64a953b5
Medium
GraphQL Pentesting for Bug Bounty Hunters: From Endpoint Discovery to High-Impact Exploits…!
Here is the mind map for reference LINK
🔥11👍2
How I Cured My Bug Hunting AI's Goldfish Memory
https://labs.trace37.com/blog/mastermind-hooks-architecture/
https://labs.trace37.com/blog/mastermind-hooks-architecture/
trace37 labs — offensive security research & services
How I Cured My Bug Hunting AI's Goldfish Memory
An interactive look at the 6 Claude Code hooks that give my autonomous bug bounty system persistent memory, triage gates, and the ability to pick up exactly where it left off.
❤9
New Burp Bounty Pro v3.0.0 release:
* Multi-Step Scanning: Chain Attacks That Single Requests Can't
* Time-Based Detection Engine: Catch What String Matching Misses
* Global Variables System: Write Profiles Once, Reuse Everywhere
* Per-Scan Performance Control: Different Settings for Different Targets
* True Pause & Resume: No More Lost Scan State
* UI Improvements: Faster Profile Workflow
* Tag-Based Passive Scan Launching
https://bountysecurity.ai/blogs/news/new-burp-bounty-pro-v3-0-0-release
* Multi-Step Scanning: Chain Attacks That Single Requests Can't
* Time-Based Detection Engine: Catch What String Matching Misses
* Global Variables System: Write Profiles Once, Reuse Everywhere
* Per-Scan Performance Control: Different Settings for Different Targets
* True Pause & Resume: No More Lost Scan State
* UI Improvements: Faster Profile Workflow
* Tag-Based Passive Scan Launching
https://bountysecurity.ai/blogs/news/new-burp-bounty-pro-v3-0-0-release
Bounty Security
New Burp Bounty Pro v3.0.0 release
By Eduardo Garcia — Founder, Bounty Security
After months of development driven directly by user feedback, Burp Bounty Pro 3.0.0 is live. This isn't an incremental update — it's a ground-up rebuild of the scanning engine with four major features that change…
After months of development driven directly by user feedback, Burp Bounty Pro 3.0.0 is live. This isn't an incremental update — it's a ground-up rebuild of the scanning engine with four major features that change…
❤10🔥6
Hacking Gemini Enterprise for a $15,000 bounty
https://x.com/behi_sec/status/2029219439028171210?s=46&t=RUHDSSKAhWrUfYiwLCvA2w
https://x.com/behi_sec/status/2029219439028171210?s=46&t=RUHDSSKAhWrUfYiwLCvA2w
X (formerly Twitter)
Behi (@Behi_Sec) on X
Hacking Gemini Enterprise for a $15,000 bounty
❤10
LeakyLooker: Hacking Google Cloud’s Data via Dangerous Looker Studio Vulnerabilities
https://www.tenable.com/blog/leakylooker-google-cloud-looker-studio-vulnerabilities
https://www.tenable.com/blog/leakylooker-google-cloud-looker-studio-vulnerabilities
Tenable®
LeakyLooker: Hacking Google Cloud’s Data via Dangerous Looker Studio Vulnerabilities
Tenable Research revealed "LeakyLooker," a set of nine novel cross-tenant vulnerabilities in Google Looker Studio. These flaws could have let attackers exfiltrate or modify data across Google services like BigQuery and Google Sheets. Google has since remediated…
❤3👍1
Needle in the haystack: LLMs for vulnerability research
https://devansh.bearblog.dev/needle-in-the-haystack/
https://devansh.bearblog.dev/needle-in-the-haystack/
devansh
Needle in the haystack: LLMs for vulnerability research
Table of Contents
Intro Lore
Why "Find All The Vulnerabilities" does not work
Minimal Scaffolding That Actually Helps
Case Study: Claude Opus 4...
Intro Lore
Why "Find All The Vulnerabilities" does not work
Minimal Scaffolding That Actually Helps
Case Study: Claude Opus 4...
❤10
ALMOST IMPOSSIBLE: JAVA DESERIALIZATION THROUGH BROKEN CRYPTO IN OPENTEXT DIRECTORY SERVICES
https://slcyber.io/research-center/almost-impossible-java-deserialization-through-broken-crypto-in-opentext-directory-services/
https://slcyber.io/research-center/almost-impossible-java-deserialization-through-broken-crypto-in-opentext-directory-services/
www.slcyber.io
We recently found ourselves looking into OpenText Directory Services (OTDS). We had seen it present on our customer's attack surface…
Almost Impossible: Java Deserialization Through Broken Crypto in OpenText Directory Services
🔥5❤3