Daily Writeups
@Daily_Writeups
3.56K subscribers
2 photos
130K links
Daily Bug Bounty / Cybersecurity Writeups
Source Code : https://github.com/Spix0r/writeup-miner
Download Telegram
About
Blog
Apps
Platform
Join
Daily Writeups
3.56K subscribers
Daily Writeups
⤷ Title: 25 Million Users at Risk: Fastify Publicly Discloses PoC Exploit for Single-Space Security Bypass
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 15 Apr 2026 02:15:41 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #25 Million Downloads #CVE_2026_33806 #Exploit Disclosure #Fastify #infosec #JavaScript Security #Node.js Security #Public PoC #Schema Validation Bypass #Web Framework Vulnerability
Daily CyberSecurity
25 Million Users at Risk: Fastify Publicly Discloses PoC Exploit for Single-Space Security Bypass
Fastify (25M+ downloads) reveals CVE-2026-33806. A public PoC exploit shows how a single space bypasses schema validation. Upgrade to v5.8.5 now to stay safe.
15 views
Daily Writeups
⤷ Title: North Korea’s “OtterCookie” Hides Inside Benign npm Wrappers
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Thu, 16 Apr 2026 06:45:27 +0000
════════════════════════
⌗ Tags: #Data Leak #big.js #cybersecurity #DPRK #Famous Chollima #Infostealer #Node.js #North Korea #npm #OtterCookie #Panther #ssh backdoor #supply chain attack
Daily CyberSecurity
North Korea’s "OtterCookie" Hides Inside Benign npm Wrappers
Panther uncovers "OtterCookie," a North Korean npm campaign hiding malware in benign wrappers. It steals crypto wallets and installs SSH backdoors. Audit now!
9 views
Daily Writeups
⤷ Title: 220 Million at Risk: Critical 9.4 CVSS Remote Code Execution Hits protobuf.js
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Fri, 17 Apr 2026 02:54:07 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Arbitrary Code Execution #CVSS 9.4 #infosec #JavaScript Security #Node.js Security #Patch Alert #protobuf.js #Protocol Buffers #rce #web development
Daily CyberSecurity
220 Million at Risk: Critical 9.4 CVSS Remote Code Execution Hits protobuf.js
A critical 9.4 CVSS vulnerability in protobuf.js puts 220 million monthly downloads at risk of RCE. Patch your Node.js and browser apps to version 8.0.1+.
25 views
Daily Writeups
⤷ Title: Paperclip Unclipped: The 9.8 CVSS Flaw Handing Your AI Agents to the Public
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Mon, 20 Apr 2026 12:17:30 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Agentic AI #AI security #Cross_Tenant #CVE_2026 #Cyber Security #infosec #Node.js #os command injection #Paperclip #rce #React #Vulnerability
Daily CyberSecurity
Paperclip Unclipped: The 9.8 CVSS Flaw Handing Your AI Agents to the Public
Paperclip’s 9.8 CVSS flaw and cross-tenant leaks expose AI agents to total takeover. Learn how a simple command could compromise your entire business.
18 views
Daily Writeups
⤷ Title: Workflow Warning: The n8n CVSS 10.0 Prototype Pollution Crisis
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Fri, 24 Apr 2026 12:01:16 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Automation #CVSS 10 #infosec #JavaScript Security #n8n #Node.js #Patch Alert #Prototype Pollution #rce #Webhook Security #XML parsing
Daily CyberSecurity
Workflow Warning: The n8n CVSS 10.0 Prototype Pollution Crisis
Critical CVSS 10 and 9.4 vulnerabilities hit n8n. Prototype pollution in XML nodes can lead to full RCE. Patch to v2.18.1 or v1.123.32 immediately.
17 views
Daily Writeups
⤷ Title: Apache Thrift Issues Massive Patch for Critical Cross-Language Flaws
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Tue, 28 Apr 2026 12:03:00 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Apache Thrift #C++ #CVE_2026_41603 #cybersecurity #go #infosec #java #memory corruption #mitm #Node.js #RPC Security #swift
Daily CyberSecurity
Apache Thrift Issues Massive Patch for Critical Cross-Language Flaws
Apache Thrift fixes critical cross-language vulnerabilities (MitM, memory corruption, DoS). Secure your Java, Go, and C++ stacks by upgrading to version 0.23.0.
10 views
Daily Writeups
⤷ Title: 5.7 Million Users at Risk: Multiple 9.8 CVSS Breakthroughs Enable Remote Code Execution in vm2 Sandbox
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 06 May 2026 01:33:32 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #CVE_2026_26956 #CVSS 9.8 #infosec #JavaScript Security #Node.js #Patch Alert #rce #Sandbox Escape #V8 Engine #vm2 #WebAssembly
Daily CyberSecurity
5.7 Million Users at Risk: Multiple 9.8 CVSS Breakthroughs Enable Remote Code Execution in vm2 Sandbox
Critical 9.8 CVSS flaws in vm2 affect 5.7M monthly users, allowing RCE via WASM and Promise bypasses. Upgrade to vm2 v3.11.0 immediately to secure your host.
22 views
Daily Writeups
⤷ Title: Critical Flaws in Apache Thrift Threaten Multi-Language
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 06 May 2026 01:00:24 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Apache Thrift #CVE_2026_43868 #CVE_2026_43869 #CVE_2026_43870 #Denial of Service #infosec #Java security #Man in the Middle #Microservices Security #Node.js #Rust Security
Daily CyberSecurity
Critical Flaws in Apache Thrift Threaten Multi-Language
Apache Thrift v0.23.0 fixes critical Rust DoS, Java MitM, and Node.js path traversal flaws. Secure your cross-language microservices and upgrade immediately!
26 views
Daily Writeups
⤷ Title: Iranian Seedworm Group Infiltrates South Korean Tech Titan in Global Espionage Surge
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Fri, 15 May 2026 02:13:22 +0000
════════════════════════
⌗ Tags: #Cybercriminals #ChromElevator #Credential Harvesting #DLL Sideloading #Industrial Espionage #Iranian MOIS #MuddyWater #Node.js Malware #Seedworm #South Korea Cyberattack #Symantec #threat intelligence
Penetration Testing Tools
Iranian Seedworm Group Infiltrates South Korean Tech Titan in Global Espionage Surge
The Iranian threat collective Seedworm maintained a clandestine presence within the infrastructure of a prominent South Korean electronics
21 views
Daily Writeups
⤷ Title: Stealth & Automation: Seedworm’s 2026 Global Campaign Hijacks Security Software to Deploy ChromElevator
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Fri, 15 May 2026 08:05:04 +0000
════════════════════════
⌗ Tags: #Cyber Security #ChromElevator #cyber_espionage #data exfiltration #DLL Sideloading #Espionage #infosec #Iranian APT #MuddyWater #Node.js Malware #Seedworm #SentinelOne #threat intelligence
Daily CyberSecurity
Stealth & Automation: Seedworm’s 2026 Global Campaign Hijacks Security Software to Deploy ChromElevator
Iranian group Seedworm infiltrates global firms using automated Node.js scripts and DLL sideloading via trusted binaries. Protect your credentials now!
31 views
Daily Writeups
⤷ Title: Five Critical vm2 Vulnerabilities Grant Instant Node.js Host RCE
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Fri, 22 May 2026 02:30:45 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #CVE_2026_47137 #CVE_2026_47140 #CVE_2026_47210 #Cyber Security #infosec #JSPI Promise #Node.js Sandbox Escape #patch bypass #Prototype Hijacking #Remote Code Execution #vm2 sandbox
Daily CyberSecurity
Five Critical vm2 Vulnerabilities Grant Instant Node.js Host RCE
Five critical sandbox escape flaws in vm2 (CVE-2026-47140 & more) allow unauthenticated remote code execution on the host server. Update now!
15 views
Daily Writeups
⤷ Title: Popular npm Package shell-quote Patches Critical Command Injection Bug
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Thu, 28 May 2026 01:32:55 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Command Injection #CVE_2026_9277 #Node.js Security #npm Package #Patch Update #shell_quote
Daily CyberSecurity
Popular npm Package shell-quote Patches Critical Command Injection Bug
Maintainers recently patched a critical flaw in a highly popular ecosystem component. Specifically, developers resolved a dangerous shell-quote command injection vulnerability tracking as CVE-2026…
16 views
Daily Writeups
⤷ Title: Liquidjs CVSS 10 RCE Threatens 7.3M Monthly Users
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Mon, 01 Jun 2026 02:30:01 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #CVSS 10 #Liquidjs #Node.js #rce #security patch
Daily CyberSecurity
Liquidjs CVSS 10 RCE Threatens 7.3M Monthly Users
A maximum-severity Liquidjs remote code execution flaw impacts millions. Learn about this template engine vulnerability and update now.
19 views
Daily Writeups
⤷ Title: New Patches Eradicate Dangerous Axios Proxy Vulnerabilities
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Thu, 04 Jun 2026 01:30:45 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Axios #CVE_2026_44492 #CVE_2026_44494 #infosec #Node.js #Prototype Pollution #Proxy Bypass
Daily CyberSecurity
New Patches Eradicate Dangerous Axios Proxy Vulnerabilities
New Axios proxy vulnerabilities expose apps. A critical prototype pollution gadget allows full traffic interception. Secure patches are now available.
12 views
Daily Writeups
⤷ Title: 53M Downloads At Risk: Critical 9.8 CVSS Vitest Remote Code Execution Vulnerabilities Disclosed
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Fri, 05 Jun 2026 01:30:20 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Browser Mode #CVE_2026_47428 #Node.js Security #Open Source Vulnerability #Test Framework Security #Vite #Vitest
Daily CyberSecurity
53M Downloads At Risk: Critical 9.8 CVSS Vitest Remote Code Execution Vulnerabilities Disclosed
Critical 9.8 CVSS flaws trigger Vitest remote code execution risks. Discover how to protect your testing environments and patch these bugs immediately.
7 views
Daily Writeups
⤷ Title: i18next Prototype Pollution Flaw (CVSS 9.1) Threatens 1M+ Weekly Downloads
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Thu, 18 Jun 2026 01:00:39 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #CVE_2026_48713 #CVE_2026_48714 #i18next #i18next_fs_backend #Node.js Security #npm Vulnerability #Prototype Pollution
Daily CyberSecurity
i18next Prototype Pollution Flaw (CVSS 9.1) Threatens 1M+ Weekly Downloads
CVE-2026-48713 exposes i18next prototype pollution in i18next-fs-backend, a CVSS 9.1 flaw threatening 1M+ weekly downloads. Update to 2.6.6 now.
14 views
Daily Writeups
⤷ Title: HackTheBox “Celestial” Walkthrough
════════════════════════
𐀪 Author: Abdullah Kareem
════════════════════════
ⴵ Time: Thu, 18 Jun 2026 13:06:25 GMT
════════════════════════
⌗ Tags: #penetration_testing #privilege_escalation #deserialization #hackthebox #node_js_deserialization
Medium
HackTheBox “Celestial” Walkthrough
Celestial is a medium difficulty machine which focuses on deserialization exploits. It is not the most realistic, however it provides a…
16 views
Daily Writeups
⤷ Title: Meteor 3.0 Migration Helped Rocket.Chat Move Off End-of-Life Node.js Runtime
════════════════════════
𐀪 Author: Owais Sultan
════════════════════════
ⴵ Time: Fri, 19 Jun 2026 16:57:09 +0000
════════════════════════
⌗ Tags: #Technology #Meteor 3.0 #Node.js #Rocket.Chat
Hackread
Meteor 3.0 Migration Helped Rocket.Chat Move Off End-of-Life Node.js Runtime
Meteor 3.0 helped Rocket.Chat move from Node.js 14 to Node.js 20, cutting runtime debt after Fibers removal and reducing supply-chain risk across federal users.
40 views