Daily Writeups
@Daily_Writeups
3.52K subscribers
2 photos
129K links
Daily Bug Bounty / Cybersecurity Writeups
Source Code : https://github.com/Spix0r/writeup-miner
Download Telegram
About
Blog
Apps
Platform
Join
Daily Writeups
3.52K subscribers
Daily Writeups
⤷ Title: “Fiber” Optic Failure: Predictable UUIDs Expose Go Web Framework to Hijacking
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 11 Feb 2026 00:48:59 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Backend Development #CSRF #CVE_2025_66630 #Fiber Framework #go #Golang #Patch Alert #Session Hijacking #UUID #Web Security
Daily CyberSecurity
"Fiber" Optic Failure: Predictable UUIDs Expose Go Web Framework to Hijacking
Critical Fiber framework vulnerability CVE-2025-66630 (CVSS 9.2) causes silent UUID failures, leading to session hijacking. Update to v2.52.11 now.
9 views
Daily Writeups
⤷ Title: Sleeping with the Enemy: Dormant Backdoors Found in Ivanti EPMM
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 11 Feb 2026 00:42:55 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #CVE_2026_1281 #CVE_2026_1340 #cyber_espionage #Defused #Fileless Malware #In_Memory Backdoor #initial access broker #Ivanti EPMM #Java Class Loader #Patch Alert
Daily CyberSecurity
Sleeping with the Enemy: Dormant Backdoors Found in Ivanti EPMM
New campaign targets Ivanti EPMM with dormant in-memory backdoors. Attackers use CVE-2026-1281 to plant "sleeper" agents. Restart servers immediately.
11 views
Daily Writeups
⤷ Title: Unmasking the Proxy: Silent Push “Traffic Origin” Exposes True Actor Locations
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 11 Feb 2026 00:42:34 +0000
════════════════════════
⌗ Tags: #Cybercriminals #cyber_espionage #geolocation #Insider Threats #IP Analysis #North Korean IT workers #residential proxies #Silent Push #threat intelligence #Traffic Origin #VPN Detection
Daily CyberSecurity
Unmasking the Proxy: Silent Push "Traffic Origin" Exposes True Actor Locations
Silent Push's Traffic Origin technology strips away VPN masks to reveal the true location of threat actors. Detect North Korean & Russian proxies now.
26 views
Daily Writeups
⤷ Title: Sandbox Breakout: Critical SandboxJS Flaw (CVE-2026-25881) Allows Host Takeover
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 11 Feb 2026 00:37:56 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Array Taint Bypass #CVE_2026_25881 #JavaScript Security #Patch Alert #Prototype Pollution #Remote Code Execution #Sandbox Escape #SandboxJS #Web Security
Daily CyberSecurity
Sandbox Breakout: Critical SandboxJS Flaw (CVE-2026-25881) Allows Host Takeover
Critical SandboxJS flaw CVE-2026-25881 allows sandbox escape via prototype pollution. Malicious code can modify host logic & execute RCE. Update to v0.8.31.
21 views
Daily Writeups
⤷ Title: Fake CEO, Real Hack: North Korea Uses AI Deepfakes to Steal Crypto
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 11 Feb 2026 00:32:29 +0000
════════════════════════
⌗ Tags: #Cyber Security #Malware #AI Threat #CHROMEPUSH #Cryptocurrency Theft #DEEPBREATH #Deepfake Attack #macOS Malware #Mandiant #SILENCELIFT #social engineering #UNC1069
Daily CyberSecurity
Fake CEO, Real Hack: North Korea Uses AI Deepfakes to Steal Crypto
North Korean hackers (UNC1069) use AI deepfakes & "ClickFix" tactics to deploy SILENCELIFT malware. Learn how they target crypto firms via Zoom.
12 views
Daily Writeups
⤷ Title: Factory Flaw: Critical WAGO Switch Vulnerabilities (CVSS 9.8) Allow Remote Takeover
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 11 Feb 2026 00:27:08 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #buffer overflow #CERT@VDE #CVE_2026_22904 #CVE_2026_22906 #Hardcoded Encryption Key #ICS security #Industrial Managed Switch #OT Security #SCADA #WAGO 852 Series
Daily CyberSecurity
Factory Flaw: Critical WAGO Switch Vulnerabilities (CVSS 9.8) Allow Remote Takeover
Critical flaws in WAGO 852 switches (CVSS 9.8) allow remote takeover via hardcoded keys & buffer overflows. Update firmware 2.64 immediately.
11 views
Daily Writeups
⤷ Title: Hiding in the Cloud: GuLoader Malware Evolves to Evade Detection
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 11 Feb 2026 00:22:09 +0000
════════════════════════
⌗ Tags: #Malware #CloudEye #cybersecurity #Downloader #Google Drive Malware #GuLoader #infosec #Malware Analysis #Obfuscation #Polymorphic Code #Zscaler ThreatLabz
Daily CyberSecurity
Hiding in the Cloud: GuLoader Malware Evolves to Evade Detection
Zscaler analyzes GuLoader's evolution. The malware uses Google Drive, polymorphic code, and exception-based obfuscation to evade detection.
13 views
Daily Writeups
⤷ Title: CVE-2026-23906: Authentication Bypass Flaw Hits Apache Druid Analytics Clusters
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 11 Feb 2026 00:17:59 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Anonymous Bind #Apache Druid #Authentication Bypass #big data #CVE_2026_23906 #database security #LDAP Authentication #Patch Alert #Real_Time Analytics
Daily CyberSecurity
CVE-2026-23906: Authentication Bypass Flaw Hits Apache Druid Analytics Clusters
Critical Apache Druid flaw (CVE-2026-23906) allows login with no password via LDAP anonymous binds. Update to v36.0.0 or disable anonymous binds now.
16 views
Daily Writeups
⤷ Title: 5 Benefits of Using Automation to Stay in Touch With Customers
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 11 Feb 2026 00:13:21 +0000
════════════════════════
⌗ Tags: #Technology
Daily CyberSecurity
5 Benefits of Using Automation to Stay in Touch With Customers
15 views
Daily Writeups
⤷ Title: Signed” Sealed, Delivered: Cybercriminals Abuse PayPal and Apple to Bypass Email Security
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 11 Feb 2026 00:11:33 +0000
════════════════════════
⌗ Tags: #Cybercriminals #business email compromise #DKIM replay #DMARC #Email Security #INKY #Invoice Fraud #Kaseya #PayPal Scam #phishing #social engineering
Daily CyberSecurity
Signed" Sealed, Delivered: Cybercriminals Abuse PayPal and Apple to Bypass Email Security
Hackers abuse PayPal & Apple to send "perfect" phishing emails. Learn how DKIM Replay attacks bypass security filters & DMARC checks.
7 views
Daily Writeups
⤷ Title: Handshake Halt: GnuTLS 3.8.12 Fixes TLS 1.3 Crash & CPU Exhaustion
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 11 Feb 2026 00:06:40 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Certificate Verification #CVE_2025_14831 #CVE_2026_1584 #Denial of Service #GnuTLS #network_security #Patch Alert #PSK Binder #SSL/TLS #TLS 1.3
Daily CyberSecurity
Handshake Halt: GnuTLS 3.8.12 Fixes TLS 1.3 Crash & CPU Exhaustion
GnuTLS v3.8.12 fixes high-severity DoS flaws (CVE-2026-1584). Malicious TLS 1.3 handshakes can crash servers. Update now to prevent outages.
11 views
Daily Writeups
⤷ Title: CVE-2026-24343: Apache HertzBeat Flaw Opens Door to Resource Exhaustion
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 11 Feb 2026 00:00:20 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Apache HertzBeat #CVE_2026_24343 #Denial of Service #DevOps #Monitoring Tools #Observability #Patch Alert #Resource Exhaustion #Xpath injection
Daily CyberSecurity
CVE-2026-24343: Apache HertzBeat Flaw Opens Door to Resource Exhaustion
Apache HertzBeat flaw CVE-2026-24343 allows DoS via XPath injection. Vulnerable versions 1.7.1-1.7.9. Update to v1.8.0 immediately.
14 views
Daily Writeups
⤷ Title: Firewall and IDS/IPS: Hard Lab — HackTheBox
════════════════════════
𐀪 Author: William Shively
════════════════════════
ⴵ Time: Wed, 11 Feb 2026 01:25:17 GMT
════════════════════════
⌗ Tags: #hackthebox #nmap #hacking #penetration_testing
Medium
Firewall and IDS/IPS: Hard Lab — HackTheBox
If you’re here, then you are on the last section of the Network Enumeration with Nmap module in HTB. Congratulations! You’re almost done…
19 views
Daily Writeups
⤷ Title: NOTICE: Date/Time Normalization Maintenance of Historical CVE Records to Occur February 16–25, 2026
════════════════════════
𐀪 Author: CVE Program Blog
════════════════════════
ⴵ Time: Tue, 10 Feb 2026 23:53:27 GMT
════════════════════════
⌗ Tags: #infosec #vulnerability #cybersecurity #information_security #technology
Medium
NOTICE: Date/Time Normalization Maintenance of Historical CVE Records to Occur February 16–25, 2026
The CVE™ Program will normalize the formatting of date/time fields across historical CVE Records from February 16, 2026, through February…
21 views
Daily Writeups
⤷ Title: PicoCTF.org CTF Challenge Write Up
Category: Web Exploitation
════════════════════════
𐀪 Author: Damian Robert Moore
════════════════════════
ⴵ Time: Wed, 11 Feb 2026 03:51:40 GMT
════════════════════════
⌗ Tags: #capture_the_flag #no_ai_here #web_exploitation #bug_bounty #picoctf
Medium
PicoCTF.org CTF Challenge Write Up Category: Web Exploitation
Challenge Name: <head-dump>
18 views
Daily Writeups
⤷ Title: Blind OS Command Injection with Out-of-Band DNS Interaction
════════════════════════
𐀪 Author: Bash Overflow
════════════════════════
ⴵ Time: Wed, 11 Feb 2026 03:17:23 GMT
════════════════════════
⌗ Tags: #command_injection #blind_os_injection #os_command_injection #bug_bounty #dns_data_exfiltration
Medium
Blind OS Command Injection with Out-of-Band DNS Interaction
Exploiting Blind OS Command Injection via Out-of-Band DNS.
29 views
Daily Writeups
⤷ Title: Logic Poisoning: How One Bad Review Broke Ratings
════════════════════════
𐀪 Author: Parth Narula
════════════════════════
ⴵ Time: Wed, 11 Feb 2026 02:52:13 GMT
════════════════════════
⌗ Tags: #bug_bounty #bug_bounty_tips #web_application_security #bug_bounty_writeup #vulnerability
Medium
Logic Poisoning: How One Bad Review Broke Ratings
Hey Hackers, I am Parth Narula. A penetration tester, bug hunter, red teamer and overall a security researcher. I live for those moments…
29 views
Daily Writeups
⤷ Title: How To Hack Part 3
════════════════════════
𐀪 Author: Red
════════════════════════
ⴵ Time: Wed, 11 Feb 2026 02:11:00 GMT
════════════════════════
⌗ Tags: #education #cybersecurity #infosec #linux #hacking
Medium
How To Hack Part 3
Linux Capture The Flag Bandit Levels 7 to 11
26 views
Daily Writeups
⤷ Title: CSRF Vulnerability Analysis in DVWA (Low to Impossible)
════════════════════════
𐀪 Author: Narathama Firmansyah Putra
════════════════════════
ⴵ Time: Wed, 11 Feb 2026 03:05:11 GMT
════════════════════════
⌗ Tags: #csrf_attack #web_penetration_testing #penetration_testing #dvwa #cybersecurity
Medium
CSRF Vulnerability Analysis in DVWA (Low to Impossible)
Introduction CSRF (Cross Site Request Forgery) adalah serangan yang memanfaatkan akun korban yang sedang login untuk menjalankan aksi tanpa…
48 views
Daily Writeups
⤷ Title: Sideloading Sidestepped: The UK’s “Light-Touch” Gamble on the Apple-Google Duopoly
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 11 Feb 2026 04:56:03 +0000
════════════════════════
⌗ Tags: #Technology #App Store #Apple #CMA #digital regulation #DMA vs UK policy #google #mobile duopoly #Sideloading #Strategic Market Status #tech monopoly #Tech News 2026
Daily CyberSecurity
Sideloading Sidestepped: The UK’s "Light-Touch" Gamble on the Apple-Google Duopoly
The UK's CMA breaks from the EU, opting for "voluntary commitments" over forced sideloading for Apple and Google. Is this pragmatism or a lack of teeth?
22 views
Daily Writeups
⤷ Title: Beyond the Screen: Samsung’s Galaxy S26 Ultra Debuts “Magic Flex” Privacy and Agentic AI
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 11 Feb 2026 04:51:56 +0000
════════════════════════
⌗ Tags: #Android #Technology #60W charging #Agentic AI #Galaxy S26 Ultra #Galaxy Unpacked 2026 #Magic Flex Pixel #One UI 8.5 #privacy display #samsung #Snapdragon 8 Elite Gen 5 #Tech News 2026
Daily CyberSecurity
Beyond the Screen: Samsung’s Galaxy S26 Ultra Debuts "Magic Flex" Privacy and Agentic AI
Galaxy Unpacked 2026 is officially set for Feb 25! Discover the Galaxy S26 Ultra's "Magic Flex" privacy screen and the autonomous power of Agentic AI.
17 views