Daily Writeups
@Daily_Writeups
3.56K subscribers
2 photos
130K links
Daily Bug Bounty / Cybersecurity Writeups
Source Code : https://github.com/Spix0r/writeup-miner
Download Telegram
About
Blog
Apps
Platform
Join
Daily Writeups
3.56K subscribers
Daily Writeups
⤷ Title: “LotusBail” Trap: 56,000 Developers Downloaded a Fake WhatsApp API That Works perfectly—While Stealing Everything
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Thu, 25 Dec 2025 00:41:07 +0000
════════════════════════
⌗ Tags: #Malware #@whiskeysockets/baileys #backdoor #data exfiltration #JavaScript Security #KOI Security #lotusbail #malware #npm #Open Source Security #supply chain attack #WhatsApp API
Daily CyberSecurity
“LotusBail” Trap: 56,000 Developers Downloaded a Fake WhatsApp API That Works perfectly—While Stealing Everything
A new investigation by Koi Security has exposed a highly sophisticated supply chain attack lurking in the npm registry. For six months, a package named lotusbail masqueraded as a legitimate WhatsA…
25 views
Daily Writeups
⤷ Title: CVE-2025-68428: Critical Flaw in jsPDF Library Allows Server-Side File Theft
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Tue, 06 Jan 2026 03:18:14 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #CVE_2025_68428 #data exfiltration #Information Disclosure #JavaScript Security #jsPDF #lfi #local file inclusion #Node.js #Patch Alert #Path Traversal #PDF Generation
Daily CyberSecurity
CVE-2025-68428: Critical Flaw in jsPDF Library Allows Server-Side File Theft
A critical vulnerability has been discovered in jsPDF, one of the most popular JavaScript libraries for generating PDF documents. The flaw, assigned a scorching CVSS score of 9.2, allows attackers…
13 views
Daily Writeups
⤷ Title: Critical Deno Flaws Risk Secrets (CVE-2026-22863) & Execution (CVE-2026-22864)
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Mon, 19 Jan 2026 00:14:29 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Command Injection #cryptography #CVE_2026_22863 #CVE_2026_22864 #Deno #JavaScript Security #Node.js Compatibility #Patch Alert #Windows Security
Daily CyberSecurity
Critical Deno Flaws Risk Secrets (CVE-2026-22863) & Execution (CVE-2026-22864)
Deno, CVE-2026-22863, CVE-2026-22864, JavaScript Security, Cryptography, Command Injection, Windows Security, Node.js Compatibility, Patch Alert
31 views
Daily Writeups
⤷ Title: The Async Escape: Critical 9.8 Flaw in vm2 Turns JavaScript Sandboxes Into Open Gateways
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Tue, 03 Feb 2026 07:46:58 +0000
════════════════════════
⌗ Tags: #Vulnerability #async/await exploit #CVE_2026_22709 #JavaScript security #Node.js #npm security #Promise sanitization #RCE vulnerability #Sandbox Escape #Tech News #vm2
Penetration Testing Tools
The Async Escape: Critical 9.8 Flaw in vm2 Turns JavaScript Sandboxes Into Open Gateways
A critical sandbox escape vulnerability has been unearthed within the vm2 library—a utility frequently employed as a JavaScript
10 views
Daily Writeups
⤷ Title: Poisoned Comments: Critical Orval Flaw (CVE-2026-25141) Injects Code
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 04 Feb 2026 00:36:11 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #code_injection #CVE_2026_23947 #CVE_2026_25141 #Developer Tools #JavaScript Security #OpenAPI #Orval #Supply Chain Security #TypeScript #web development
Daily CyberSecurity
Poisoned Comments: Critical Orval Flaw (CVE-2026-25141) Injects Code
Critical Orval flaw CVE-2026-25141 (CVSS 9.3) allows code injection via OpenAPI comments. 2.8M+ downloads affected. Update to v7.21.0 now.
13 views
Daily Writeups
⤷ Title: Code Red: 4 Critical SandboxJS Flaws (CVSS 10.0) Allow Host Takeover
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Mon, 09 Feb 2026 00:46:57 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Arbitrary Code Execution #CVE_2026_25520 #CVE_2026_25586 #CVSS 10.0 #Host Prototype Pollution #JavaScript Security #Patch Alert #Sandbox Escape #SandboxJS #Web Security
Daily CyberSecurity
Code Red: 4 Critical SandboxJS Flaws (CVSS 10.0) Allow Host Takeover
Critical SandboxJS flaws (CVSS 10.0) allow sandbox escape & host takeover via prototype pollution. Update to v0.8.29 immediately to stop code execution.
18 views
Daily Writeups
⤷ Title: HTTP Down: High-Severity Axios Flaw (CVSS 7.5) Crashes Node.js Servers
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Tue, 10 Feb 2026 03:54:53 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Axios #CVE_2026_25639 #Denial of Service #HTTP Client #JavaScript Security #JSON Parsing #Node.js #Patch Alert #Prototype Pollution #web development
Daily CyberSecurity
HTTP Down: High-Severity Axios Flaw (CVSS 7.5) Crashes Node.js Servers
A high-severity vulnerability has been discovered in Axios, the immensely popular HTTP client used by millions of developers for Node.js and browser-based applications. The flaw, tracked as CVE-20…
25 views
Daily Writeups
⤷ Title: Sandbox Breakout: Critical SandboxJS Flaw (CVE-2026-25881) Allows Host Takeover
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 11 Feb 2026 00:37:56 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Array Taint Bypass #CVE_2026_25881 #JavaScript Security #Patch Alert #Prototype Pollution #Remote Code Execution #Sandbox Escape #SandboxJS #Web Security
Daily CyberSecurity
Sandbox Breakout: Critical SandboxJS Flaw (CVE-2026-25881) Allows Host Takeover
Critical SandboxJS flaw CVE-2026-25881 allows sandbox escape via prototype pollution. Malicious code can modify host logic & execute RCE. Update to v0.8.31.
21 views
Daily Writeups
⤷ Title: Sandbox Bypassed: jsPDF Flaw Exposes Millions to Object Injection
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Mon, 23 Feb 2026 00:17:17 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #AcroJS Bypass #AppSec #CVE_2026_25755 #Cyber Security #infosec #JavaScript Security #jsPDF #npm Vulnerability #Patch Alert #PDF Object Injection
Daily CyberSecurity
Sandbox Bypassed: jsPDF Flaw Exposes Millions to Object Injection
A critical PDF Object Injection flaw (CVE-2026-25755) in jsPDF allows attackers to bypass AcroJS sandboxes. Update to version 4.2.0 immediately.
9 views
Daily Writeups
⤷ Title: CVE-2026-27212: Critical Swiper Prototype Pollution Flaw (CVSS 9.4) Exposes Global Apps
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Tue, 24 Feb 2026 00:12:32 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #AppSec #CVE_2026_27212 #Cyber Security #infosec #JavaScript Security #npm Vulnerability #Patch Alert #Prototype Pollution #Remote Code Execution #Swiper
Daily CyberSecurity
CVE-2026-27212: Critical Swiper Prototype Pollution Flaw (CVSS 9.4) Exposes Global Apps
Critical prototype pollution flaw (CVE-2026-27212) in the Swiper npm package allows RCE, DoS, and auth bypass. Update to version 12.1.2 immediately.
15 views
Daily Writeups
⤷ Title: The 50,000-Download Trap: How ‘ambar-src’ Typosquatting Compromised Windows, Linux, and macOS Devs
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Fri, 27 Feb 2026 00:06:30 +0000
════════════════════════
⌗ Tags: #Malware #ambar_src #Apfell malware #infosec #JavaScript Security #Malicious packages #npm malware #reverse shell #supply chain attack #Tenable Research #Typosquatting
Daily CyberSecurity
The 50,000-Download Trap: How 'ambar-src' Typosquatting Compromised Windows, Linux, and macOS Devs
Tenable uncovers "ambar-src," a malicious npm package mimicking "ember-source." It uses preinstall scripts to deploy reverse shells and Apfell malware.
50 views
Daily Writeups
⤷ Title: The Internet Is Full of Vulnerabilities — TrinetLayer Helps You Find Them
════════════════════════
𐀪 Author: Researchbynidhi
════════════════════════
ⴵ Time: Wed, 04 Mar 2026 13:09:53 GMT
════════════════════════
⌗ Tags: #cybersecurity #javascript_security #bug_bounty #ethical_hacking #security_research
Medium
The Internet Is Full of Vulnerabilities — TrinetLayer Helps You Find Them
Exploring how TrinetLayer helps security researchers analyze attack surfaces, uncover hidden vulnerabilities, and experiment with…
22 views
Daily Writeups
⤷ Title: Critical 10.0 CVSS SandboxJS Flaw Grants Complete Remote Code Execution
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Mon, 16 Mar 2026 12:19:03 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #CVE_2026_26954 #CVSS 10 #cybersecurity #JavaScript Security #Node.js vulnerability #Patch Alert #Remote Code Execution #Sandbox Escape #SandboxJS #supply chain attack
Daily CyberSecurity
Critical 10.0 CVSS SandboxJS Flaw Grants Complete Remote Code Execution
Critical 10.0 CVSS flaw in SandboxJS (CVE-2026-26954) allows attackers to escape the sandbox and achieve Remote Code Execution. Patch to version 0.8.34 now.
16 views
Daily Writeups
⤷ Title: Invisible Ink: Critical 9.6 CVSS jsPDF Flaw Turns Generated Documents into XSS Traps
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Thu, 19 Mar 2026 13:30:38 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Cross_Site Scripting #CVE_2026_31938 #cybersecurity #HTML Injection #infosec #JavaScript Security #jsPDF #Vulnerability #web development #XSS
Daily CyberSecurity
Invisible Ink: Critical 9.6 CVSS jsPDF Flaw Turns Generated Documents into XSS Traps
A critical 9.6 CVSS vulnerability in jsPDF (CVE-2026-31938) allows attackers to inject malicious scripts via XSS. Update to version 4.2.1 immediately.
22 views
Daily Writeups
⤷ Title: CVE-2026-34208 (CVSS 10): Critical Sandbox Escape Uncovered in SandboxJS
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 08 Apr 2026 13:07:55 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #CVE_2026_34208 #cybersecurity #Host Poisoning #infosec #JavaScript Security #Node.js #rce #Sandbox Breach #Sandbox Escape #SandboxJS #supply chain attack
Daily CyberSecurity
CVE-2026-34208 (CVSS 10): Critical Sandbox Escape Uncovered in SandboxJS
CVE-2026-34208: A critical 10.0 flaw in SandboxJS allows code to escape and poison host objects like Math.random. Secure your environment—update immediately!
19 views
Daily Writeups
⤷ Title: Denial of Service Alert: React Server Components Vulnerability Causes CPU Spikes
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Thu, 09 Apr 2026 09:44:46 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #CVE_2026_23869 #Denial of Service #dos #infosec #JavaScript Security #Node.js #React #React Server Components #RSC #web development #Webpack
Daily CyberSecurity
Denial of Service Alert: React Server Components Vulnerability Causes CPU Spikes
React patches a 7.5 CVSS DoS vulnerability in Server Components (CVE-2026-23869). Stop CPU exhaustion attacks—update your 19.x dependencies now!
17 views
Daily Writeups
⤷ Title: 25 Million Users at Risk: Fastify Publicly Discloses PoC Exploit for Single-Space Security Bypass
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 15 Apr 2026 02:15:41 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #25 Million Downloads #CVE_2026_33806 #Exploit Disclosure #Fastify #infosec #JavaScript Security #Node.js Security #Public PoC #Schema Validation Bypass #Web Framework Vulnerability
Daily CyberSecurity
25 Million Users at Risk: Fastify Publicly Discloses PoC Exploit for Single-Space Security Bypass
Fastify (25M+ downloads) reveals CVE-2026-33806. A public PoC exploit shows how a single space bypasses schema validation. Upgrade to v5.8.5 now to stay safe.
15 views
Daily Writeups
⤷ Title: 220 Million at Risk: Critical 9.4 CVSS Remote Code Execution Hits protobuf.js
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Fri, 17 Apr 2026 02:54:07 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Arbitrary Code Execution #CVSS 9.4 #infosec #JavaScript Security #Node.js Security #Patch Alert #protobuf.js #Protocol Buffers #rce #web development
Daily CyberSecurity
220 Million at Risk: Critical 9.4 CVSS Remote Code Execution Hits protobuf.js
A critical 9.4 CVSS vulnerability in protobuf.js puts 220 million monthly downloads at risk of RCE. Patch your Node.js and browser apps to version 8.0.1+.
25 views