Daily Writeups
@Daily_Writeups
3.56K subscribers
2 photos
130K links
Daily Bug Bounty / Cybersecurity Writeups
Source Code : https://github.com/Spix0r/writeup-miner
Download Telegram
About
Blog
Apps
Platform
Join
Daily Writeups
3.56K subscribers
Daily Writeups
⤷ Title: Upbit Solana Hack: 100 Billion Tokens Stolen, Exchange Delay Avoids Penalties
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Tue, 09 Dec 2025 03:46:06 +0000
════════════════════════
⌗ Tags: #Cybercriminals #BONK #Crypto Exchange #Financial Supervisory Service #Regulatory Gap #Solana #Solana Exploit #Token Hack #Upbit
Penetration Testing Tools
Upbit Solana Hack: 100 Billion Tokens Stolen, Exchange Delay Avoids Penalties
Hackers siphoned more than 100 billion tokens from Upbit in just 54 minutes, exploiting a flaw in Solana
12 views
Daily Writeups
⤷ Title: API Keys, Tokens, and Secrets: How They Leak and How Developers Can Avoid It
════════════════════════
𐀪 Author: Anishamudani
════════════════════════
ⴵ Time: Wed, 17 Dec 2025 21:38:20 GMT
════════════════════════
⌗ Tags: #api_token #api_security #config_json #token_mismanagement
Medium
API Keys, Tokens, and Secrets: How They Leak and How Developers Can Avoid It
Welcome back to NINI’S SIMPLE GUIDE TO API SECURITY.
24 views
Daily Writeups
⤷ Title: Hackers Abuse “Device Codes” to Bypass Security and Seize Microsoft 365 Accounts
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Mon, 22 Dec 2025 00:50:41 +0000
════════════════════════
⌗ Tags: #Cybercriminals #Account Takeover #cybersecurity #Device Authorization #MFA Bypass #Microsoft 365 #OAuth 2.0 #phishing #Proofpoint #social engineering #Token Theft
Daily CyberSecurity
Hackers Abuse "Device Codes" to Bypass Security and Seize Microsoft 365 Accounts
Proofpoint warns of a surge in device code phishing where attackers abuse Microsoft 365 OAuth flows to hijack accounts and bypass MFA.
20 views
Daily Writeups
⤷ Title: One Click to “God Mode”: The Critical OpenClaw Flaw That Handed Attackers Your Master Keys
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Mon, 02 Feb 2026 08:54:17 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #AI agent safety #Clawdbot #cybersecurity news #depthfirst security #Moltbot #OpenClaw #RCE vulnerability #Remote Code Execution #token exfiltration #v2026.1.29 patch
Daily CyberSecurity
One Click to "God Mode": The Critical OpenClaw Flaw That Handed Attackers Your Master Keys
A high-severity flaw in OpenClaw (formerly Clawdbot) allows 1-click Remote Code Execution. Update to v2026.1.29 immediately to prevent total account takeover.
44 views
Daily Writeups
⤷ Title: GitLab Patch Alert: High-Severity Web IDE Flaw Exposes Private Repos
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 11 Feb 2026 01:58:57 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #CI/CD #CVE_2025_7659 #Denial of Service #DevOps Security #gitlab #graphql #Markdown Vulnerability #Patch Alert #Token Theft #Web IDE
Daily CyberSecurity
GitLab Patch Alert: High-Severity Web IDE Flaw Exposes Private Repos
GitLab fixes critical CVE-2025-7659 (CVSS 8.0). Unauthenticated attackers can steal tokens via Web IDE. Update to v18.8.4 now to secure your code.
21 views
Daily Writeups
⤷ Title: Stealing the Keys to the Cloud: SpecterBroker Unveils the Secrets of Windows Token Broker
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Tue, 03 Mar 2026 04:42:22 +0000
════════════════════════
⌗ Tags: #Open Source Tool #Azure #Credential Theft #DPAPI #EntraID #NGC tokens #post_exploitation #red teaming #SpecterBroker #Tech News 2026 #Token Broker #WAM #Windows Authentication Manager
Penetration Testing Tools
Stealing the Keys to the Cloud: SpecterBroker Unveils the Secrets of Windows Token Broker
SpecterBroker is a new post-exploitation powerhouse that extracts and decrypts Windows authentication tokens (WAM/TBRes) for full EntraID and Azure takeover.
23 views
Daily Writeups
⤷ Title: The Double-Mint Disaster: How a 2.7 Million Dollar Reentrancy Attack Pierced the Solv Protocol
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Tue, 10 Mar 2026 04:08:04 +0000
════════════════════════
⌗ Tags: #Vulnerability #Bitcoin DeFi #Blockchain Security #Crypto News 2026 #ERC_3525 #ERC_721 #Reentrancy Attack #Smart Contract Hack #Solv Protocol #SolvBTC #Token Minting Error #Web3 Exploits
Penetration Testing Tools
The Double-Mint Disaster: How a 2.7 Million Dollar Reentrancy Attack Pierced the Solv Protocol
The Solv protocol, operating atop the Bitcoin blockchain, has endured a devastating smart contract attack. A malefactor exploited
10 views
Daily Writeups
⤷ Title: Windows Security Tokens (Part 2) — Token Groups and Privileges
════════════════════════
𐀪 Author: Indigo Shadow
════════════════════════
ⴵ Time: Fri, 13 Mar 2026 04:05:21 GMT
════════════════════════
⌗ Tags: #windows_privilege #windows_security_tokens #windows_integrity_levels #token_groups #ethical_hacking
Medium
Windows Security Tokens (Part 2) — Token Groups and Privileges
How are Groups and Privileges used by Windows in granting access? What about Integrity Levels?
35 views
Daily Writeups
⤷ Title: Principal | Medium | Linux
════════════════════════
𐀪 Author: Mkirahmet
════════════════════════
ⴵ Time: Sat, 14 Mar 2026 14:57:29 GMT
════════════════════════
⌗ Tags: #token #javascript #hackthebox_writeup #linux
Medium
Principal | Medium | Linux
From Zero to Root: Exploiting a JWT Design Flaw and Abusing SSH Certificate Trust
27 views
Daily Writeups
⤷ Title: Keycloak Under Siege: Patch Now to Stop Token Theft and Account Takeovers
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Mon, 06 Apr 2026 14:30:47 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Access Management #CVE_2026_3429 #CVE_2026_4636 #cybersecurity #IAM Security #infosec #Keycloak #MFA Bypass #Open Source Security #Token Theft #UMA #Vert.x
Daily CyberSecurity
Keycloak Under Siege: Patch Now to Stop Token Theft and Account Takeovers
Keycloak 26.5.7 fixes critical flaws including MFA bypass (CVE-2026-3429) and UMA token theft. Protect your IAM infrastructure—upgrade to the latest version.
22 views
Daily Writeups
⤷ Title: The “EvilTokens” Surge: Why Device Code Phishing Exploded 37-Fold in 2026
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Tue, 07 Apr 2026 07:46:02 +0000
════════════════════════
⌗ Tags: #Cybercriminals #Account Takeover #Cybersecurity 2026 #Device Code Phishing #EvilTokens #Infosec #Microsoft 365 #OAuth 2.0 #Phishing_as_a_Service #Push Security #Token Theft
Penetration Testing Tools
The "EvilTokens" Surge: Why Device Code Phishing Exploded 37-Fold in 2026
The architecture of account exploitation is undergoing a profound metamorphosis, as adversaries increasingly eschew traditional subversion in favor
9 views
Daily Writeups
⤷ Title: Reducing token burn, Anthropic Mythos, How I use AI for pentesting
════════════════════════
𐀪 Author: Teri Radichel
════════════════════════
ⴵ Time: Sun, 19 Apr 2026 18:01:32 GMT
════════════════════════
⌗ Tags: #ai #penetration_testing #cybersecurity #artificial_intelligence #token
Medium
Reducing token burn, Anthropic Mythos, How I use AI for pentesting
Latest stories on AI, vibe coding, AI security, and AI for security research
16 views
Daily Writeups
⤷ Title: The End of Unlimited AI: GitHub Copilot Shifts to “Pay-as-You-Go” Credits to Power the Agentic Era
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Tue, 28 Apr 2026 07:08:17 +0000
════════════════════════
⌗ Tags: #Technology #2026 Tech News #AI Agents #AI Credits #Claude 3.7 Opus #DevTools #FinTech #GitHub Copilot #GitHub Enterprise #software development #Token Throughput #Usage_Based Billing
Daily CyberSecurity
The End of Unlimited AI: GitHub Copilot Shifts to "Pay-as-You-Go" Credits to Power the Agentic Era
Effective June 1, 2026, GitHub Copilot transitions to usage-based billing. Learn how AI credits, token throughput, and model multipliers will impact your workflow.
20 views
Daily Writeups
⤷ Title: DarkZero Walkthrough (Unintended path)
════════════════════════
𐀪 Author: Xotourlif33
════════════════════════
ⴵ Time: Wed, 29 Apr 2026 09:28:18 GMT
════════════════════════
⌗ Tags: #token_theft #darkzero #hackthebox #hackthebox_writeup
Medium
DarkZero Walkthrough (Unintended path)
DarkZero is a hard-difficulty Windows machine designed around an assumed breach scenario in which the attacker is provided with…
31 views
Daily Writeups
⤷ Title: Ecosystem Poisoned: Mini Shai-Hulud Worm Hijacks @antv npm Packages to Target CI/CD Pipelines
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Thu, 21 May 2026 02:59:48 +0000
════════════════════════
⌗ Tags: #Malware #AntV Ecosystem #CI/CD Pipeline Security #Cyber Security #echarts_for_react #GitHub Actions Memory Scraping #infosec #Mini Shai_Hulud #npm Supply Chain Attack #Sigstore Forgery #TeamPCP #Token Theft
Daily CyberSecurity
Ecosystem Poisoned: Mini Shai-Hulud Worm Hijacks @antv npm Packages to Target CI/CD Pipelines
Microsoft warns of an aggressive Mini Shai-Hulud worm attack targeting the @antv npm ecosystem and stealing secrets from cloud-connected CI/CD pipelines.
25 views
Daily Writeups
⤷ Title: Signature Bypass Alert: Critical Coder Flaw (CVE-2026-46354) Exposes Git Keys and Developer Tokens
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Thu, 21 May 2026 02:10:07 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Azure IMDS #Cloud Development Environments #Coder #CVE_2026_46354 #Cyber Security #infosec #OAuth exploitation #Patch Alert #Signature Bypass #Terraform Workspace #Token Theft
Daily CyberSecurity
Signature Bypass Alert: Critical Coder Flaw (CVE-2026-46354) Exposes Git Keys and Developer Tokens
Coder patches a critical 9.1 CVSS signature bypass (CVE-2026-46354) in Azure identities that allows unauthenticated workspace token theft. Patch now!
11 views
Daily Writeups
⤷ Title: State-Sponsored Actors Operationalize ROADtools Framework in Cloud Campaigns
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Thu, 28 May 2026 09:41:28 +0000
════════════════════════
⌗ Tags: #Cybercriminals #Azure Security #Cloud Security #Entra ID #Incident Response #ROADtools #threat intelligence #Token Manipulation
Daily CyberSecurity
State-Sponsored Actors Operationalize ROADtools Framework in Cloud Campaigns
Discover how nation-state hackers leverage the ROADtools cloud attack toolkit to compromise Entra ID environments and bypass MFA controls.
34 views
Daily Writeups
⤷ Title: The Compute Crisis: Developers Revolt Against GitHub Copilot’s Metered Pricing
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Wed, 03 Jun 2026 03:31:26 +0000
════════════════════════
⌗ Tags: #Technology #AI coding agent costs #Copilot Pro+ billing changes #developer credit depletion #GitHub Copilot usage billing #open_source IDE alternatives #token_based pricing controversy
Information Security News
GitHub Copilot Usage Billing: Developer Protests
Discover why developers are protesting the new GitHub Copilot usage billing model. Learn about credit depletion rates and platform alternatives.
29 views
Daily Writeups
⤷ Title: Critical GitHub Token Stealing Bug Exploits Web-Based Code Editors
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 03 Jun 2026 02:18:15 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Ammar Askar #Browser Sandbox #github.dev #token exfiltration #VSCode vulnerability
Daily CyberSecurity
Critical GitHub Token Stealing Bug Exploits Web-Based Code Editors
A critical GitHub token stealing bug targets github.dev web spaces. Learn how it exploits the VSCode webview security model to hijack private repositories.
13 views