A heap overflow and SSO misconfiguration to compromise OpenAI internal repositories

A pre-authentication Theme Injection to RCE chain in WordPress Core that allows unauthenticated attackers to achieve remote code execution on any default WordPress installation through a single click.

Secret scanner for exposed Google Gemini API keys in JavaScript, source maps, Wayback snapshots and Android APKs. Validates keys, reports restrictions and bypasses. - devploit/geminiHunter

直接使用真机设备获取ROOT Shell 是一件很艰难的事情，退而求其次使用固件镜像+QEMU 模拟仿真实现获得ROOTShell

Pwn for fun

BragJack attack (discovered by Forever Security) allowed ordinary extensions to hijack the internal browser agent of Comet, Chrome, Edge, Opera, and Claude in Chrome

How one unchecked login token put 17 trillion rows in a Microsoft internal analytics service within reach.

The edge isn't the AI model, but how you assemble the system around it. We built a custom agentic harness that structures vulnerability research into distinct stages, from codebase exploration and analysis to validation and exploitation. Applied to FreeRDP…

Update iOS/iPadOS and macOS.

An in-the-wild iOS bug with a possible WhatsApp zero-click path.

A case study on discovering two email spoofing vulnerabilities in Apple iCloud.

We discovered an arbitrary file read vulnerability in Discourse's image pipeline by chaining a JPEG race condition with ImageMagick and Ghostscript.

A practical guide to setting up OpenCode, Claude-BugHunter, and Burp Suite MCP Server for automated HTTP history analysis and security…

Samsung Galaxy S26 hacked three times. OpenAI Codex falls to a single bug. Oracle AI Database chained with 5 zero-days. Here is the full Day 1 breakdown. #Pwn2Own #ZeroDay #ZeroHack

Watch me trying to find a Whatsapp nDay, thanks to Meta and inline compiling it's not that easy !

This post details an attack on Google’s internal APIs, bypassing authorization to exploit the GFile library to gain access to internal filesystems and storage.

A Flask cookie on developers.google.com was signed with a secret it carried inside itself. Pulling that secret out turned a forged session into code execution across Google's developer sites.

Team82 researched the attack surface of the Danfoss AK-SM 800A refrigeration controller platform and identified multiple vulnerabilities affecting the embedded web management interface. Team82 disclosed the vulnerabilities to Danfoss, which addressed them…

A single 32-bit multiplication is enough to turn a malicious PDF into memory corruption. We break down the integer overflow vulnerability behind CVE-2026-81983 and show exactly where Acrobat’s safety check fails.