From Padding Oracle to Shell: Unauthenticated RCE in Telerik UI for ASP.NET AJAX
https://tantosec.com/blog/2026/09/telerik-padding-oracle-to-shell/
https://tantosec.com/blog/2026/09/telerik-padding-oracle-to-shell/
Tanto Security
From Padding Oracle to Shell: Unauthenticated RCE in Telerik UI for ASP.NET AJAX
TantoSec turned an unauthenticated AES-CBC padding oracle in Telerik UI for ASP.NET AJAX into remote code execution, chaining a decrypt-versus-parse oracle, a predictable HMAC key, and a type-name deserialisation gadget.
1❤7🔥6
RCE in mexc Android app via Bypass URL validation to access the WebView, JS-Bridge with Path Traversal leads to Native-Library Cache Overwrite.
https://itis911.github.io/writeups/RCE-Mexc-Andriod-App.html
https://itis911.github.io/writeups/RCE-Mexc-Andriod-App.html
Everyone Chains SSTI to RCE. I Chained It to Account Takeover.
https://medium.com/@HariHax/everyone-chains-ssti-to-rce-i-chained-it-to-account-takeover-c279188ff9ce
https://medium.com/@HariHax/everyone-chains-ssti-to-rce-i-chained-it-to-account-takeover-c279188ff9ce
Medium
Everyone Chains SSTI to RCE. I Chained It to Account Takeover.
Three attempts at code execution paid nothing. One template expression that just read a variable paid $1,000.
❤4👍2
$15k - CSPT to full account takeover, then 2FA bypass via the prototype chain
https://whoareme.com/blog/cspt-account-takeover-2fa-bypass/
https://whoareme.com/blog/cspt-account-takeover-2fa-bypass/
Whoareme
$15k - CSPT to full account takeover, then 2FA bypass via the prototype chain
A client-side path traversal in the front-end's URL builder turned into arbitrary PUT/DELETE on the API, then chained with an inherited-property lookup bug to bypass 2FA
❤10🔥3
GitHub issues $100,000 bounty for critical RCE vulnerability disclosed by @sagitz_
https://runtimewire.com/article/github-issues-100-000-bounty-for-critical-rce-vulnerability-disclosed-by-sagitz
https://runtimewire.com/article/github-issues-100-000-bounty-for-critical-rce-vulnerability-disclosed-by-sagitz
RuntimeWire
GitHub issues $100,000 bounty for critical RCE vulnerability disclosed by @sagitz_
Researcher @sagitz_ disclosed a remote code execution vulnerability in GitHub, earning a $100,000 bounty—the largest payout in the platform's bug bounty program.
❤20👎4
Breaking into Google's GFile for $100k
https://bughunters.google.com/blog/breaking-into-googles-gfile-for-100k
https://bughunters.google.com/blog/breaking-into-googles-gfile-for-100k
Google
Blog: Breaking into Google's GFile for $100k
This post details an attack on Google’s internal APIs, bypassing authorization to exploit the GFile library to gain access to internal filesystems and storage.
Ni8mare - Unauthenticated Remote Code Execution in n8n (CVE-2026-21858)
https://www.cyera.com/research/ni8mare-unauthenticated-remote-code-execution-in-n8n-cve-2026-21858
https://www.cyera.com/research/ni8mare-unauthenticated-remote-code-execution-in-n8n-cve-2026-21858
Cyera
Ni8mare - Unauthenticated Remote Code Execution in n8n (CVE-2026-21858)
Cyera Research Labs has discovered a "worst-case scenario" flaw in n8n, the industry-leading platform for AI and workflow automation. Dubbed "Ni8mare," this vulnerability (CVE-2026-21858) allows an unauthenticated remote attacker to gain full administrative…
❤2
Hacking OpenAI
A heap overflow and SSO misconfiguration to compromise OpenAI internal repositories
https://www.hacktron.ai/blog/hacking-openai
A heap overflow and SSO misconfiguration to compromise OpenAI internal repositories
https://www.hacktron.ai/blog/hacking-openai
Hacktron AI
Hacking OpenAI
A heap overflow and SSO misconfiguration to compromise OpenAI internal repositories
🔥10
Click2Shell: Preauth WordPress Core Theme Preview Injection to RCE Chain
https://pwn.ai/blog/click2shell
https://pwn.ai/blog/click2shell
PWN.AI
Click2Shell: Preauth WordPress Core Theme Preview Injection to RCE Chain
A pre-authentication Theme Injection to RCE chain in WordPress Core that allows unauthenticated attackers to achieve remote code execution on any default WordPress installation through a single click.
❤8👏2
geminiHunter
Find and assess exposed Google Gemini API keys in web assets and Android apps.
https://github.com/devploit/geminiHunter
Find and assess exposed Google Gemini API keys in web assets and Android apps.
https://github.com/devploit/geminiHunter
GitHub
GitHub - devploit/geminiHunter: Find and assess exposed Google Gemini API keys across web assets and Android apps.
Find and assess exposed Google Gemini API keys across web assets and Android apps. - devploit/geminiHunter
❤8
ROOT Tesla OS on QEMU Part 2 :Debugging + fixing
https://cn0xroot.wordpress.com/2026/09/20/root_tesla_os_on_qemu_part_2_debugging_fixing/
https://cn0xroot.wordpress.com/2026/09/20/root_tesla_os_on_qemu_part_2_debugging_fixing/
| 混沌通信| RadioHub | IoT RF Hardware Hacking | 博观而约取 厚积而薄发
ROOT Tesla OS on QEMU Part 2 :Debugging + fixing
Pwn for fun
🔥5
BragJack [Technical Overview]: How We Hijacked Top 5 Browsers' Internal Agents With Just One Single Extension
https://forever.security/blog/bragjack-attack-hijacks-every-browser-agent/
https://forever.security/blog/bragjack-attack-hijacks-every-browser-agent/
Forever
BragJack [Technical Overview]: How We Hijacked Top 5 Browsers' Internal Agents With Just One Single Extension · Forever Security
BragJack attack (discovered by Forever Security) allowed ordinary extensions to hijack the internal browser agent of Comet, Chrome, Edge, Opera, and Claude in Chrome
❤6🔥1
SharePoint CVE-2026-65660: From Anonymous Access to Pre-Auth RCE via EditingPageParser Type-Check Bypass
https://blog.viettelcybersecurity.com/sharepoint_cve-2026-65660/
https://blog.viettelcybersecurity.com/sharepoint_cve-2026-65660/
❤9
How I Could've Accessed 17 Trillion Microsoft Records
https://blog.faav.net/how-i-couldve-accessed-17-trillion-microsoft-records
https://blog.faav.net/how-i-couldve-accessed-17-trillion-microsoft-records
blog.faav.net
How I Could’ve Accessed 17 Trillion Microsoft Records
How one unchecked login token put 17 trillion rows in a Microsoft internal analytics service within reach.
❤4
From AI Agents to RCE - Building a Vulnerability Research Workflow
https://blog.quarkslab.com/from-ai-agents-to-rce-building-a-vulnerability-research-workflow.html
https://blog.quarkslab.com/from-ai-agents-to-rce-building-a-vulnerability-research-workflow.html
Quarkslab
From AI Agents to RCE - Building a Vulnerability Research Workflow - Quarkslab's blog
The edge isn't the AI model, but how you assemble the system around it. We built a custom agentic harness that structures vulnerability research into distinct stages, from codebase exploration and analysis to validation and exploitation. Applied to FreeRDP…
❤6
0-Day Alert: Apple CoreGraphics RCE exploited in targeted attacks
https://intelligence.zerodayengineering.com/0-day-alert-cve-2026-86950/
https://intelligence.zerodayengineering.com/0-day-alert-cve-2026-86950/
Light Intelligence – Zero Day Engineering
⚡️ 0-Day Alert: Apple CoreGraphics RCE exploited in targeted attacks
Update iOS/iPadOS and macOS.
❤3
CVE-2026-86950: The Great Glyph Grift
An in-the-wild iOS bug with a possible WhatsApp zero-click path.
https://calif.io/research/the-great-glyph-grift
An in-the-wild iOS bug with a possible WhatsApp zero-click path.
https://calif.io/research/the-great-glyph-grift
Calif
CVE-2026-86950: The Great Glyph Grift
An in-the-wild iOS bug with a possible WhatsApp zero-click path.
❤5
From: anyone@icloud.com - Spoofing Arbitrary Apple iCloud Identities
https://sec-consult.com/blog/detail/from-anyoneicloudcom-spoofing-arbitrary-apple-icloud-identities/
https://sec-consult.com/blog/detail/from-anyoneicloudcom-spoofing-arbitrary-apple-icloud-identities/
SEC Consult
From: anyone@icloud.com - Spoofing Arbitrary Apple iCloud Identities
A case study on discovering two email spoofing vulnerabilities in Apple iCloud.
❤5