Daily Writeups
@Daily_Writeups
4.02K subscribers
4 photos
136K links
Daily Bug Bounty / Cybersecurity Writeups
Source Code : https://github.com/Spix0r/writeup-miner
Download Telegram
About
Blog
Apps
Platform
Join
Daily Writeups
4.02K subscribers
Daily Writeups
⤷ Title: ENDLESSDOORS: Hidden Remote Control Found in Zbtlink Router Firmware
════════════════════════
𐀪 Author: Nam Phong
════════════════════════
ⴵ Time: Fri, 07 Aug 2026 15:02:35 +0000
════════════════════════
⌗ Tags: #Vulnerability #ENDLESSDOORS #Firmware Security #IoT Backdoor #rctl #Router Backdoor #router security #VulnCheck #Zbtlink Backdoor
Information Security News
ENDLESSDOORS: Hidden Remote Control Found in Zbtlink Router Firmware
Chinese router manufacturer Zbtlink has become the focus of a significant dispute following the discovery of a concealed remote management mechanism embedded in its proprietary firmware. Researche…
12 views
Daily Writeups
⤷ Title: iCloud Private Relay IP Leak: Three WebKit Flaws Expose Real User IP Addresses
════════════════════════
𐀪 Author: Nam Phong
════════════════════════
ⴵ Time: Fri, 07 Aug 2026 14:15:31 +0000
════════════════════════
⌗ Tags: #Vulnerability #Apple Privacy #DNS Prefetch #iCloud Private Relay #IP Address Leak #Safari Vulnerability #WebAuthn Leak #WebKit IP Leak #WebTransport
Information Security News
iCloud Private Relay IP Leak: Three WebKit Flaws Expose Real User IP Addresses
A feature designed to shield users from surveillance on the internet has been found capable of disclosing their genuine location – a fundamental contradiction embedded within Apple’s i…
9 views
Daily Writeups
⤷ Title: 45% of Malware C2 Traffic Bypasses DNS by Connecting Directly to IP Addresses
════════════════════════
𐀪 Author: Nam Phong
════════════════════════
ⴵ Time: Fri, 07 Aug 2026 13:44:29 +0000
════════════════════════
⌗ Tags: #Malware #C2 Traffic #Direct_to_IP #Malware DNS Bypass #Mozi botnet #Phorpiex #SectopRAT #Unit 42 #ZT_IP Security
Information Security News
45% of Malware C2 Traffic Bypasses DNS by Connecting Directly to IP Addresses
Many defensive systems monitor domain name queries as their primary window into outbound malicious activity – but malware families are increasingly circumventing this approach by communicati…
9 views
Daily Writeups
⤷ Title: FBI Warns of Coordinated Swatting Attacks Nationwide
════════════════════════
𐀪 Author: Nam Phong
════════════════════════
ⴵ Time: Fri, 07 Aug 2026 13:15:24 +0000
════════════════════════
⌗ Tags: #Cyber Security #cybercrime #FBI Warning #Public Safety #swatting #voip spoofing
Information Security News
FBI Warns of Coordinated Swatting Attacks Nationwide
Hoax emergency calls are evolving from personal vendettas into systemic public threats. According to a recent official FBI public service announcement, malicious actors now execute coordinated swa…
8 views
Daily Writeups
⤷ Title: Tails 7.10.1: Emergency Patch for CVE-2026-64560 That Could Deanonymize Users
════════════════════════
𐀪 Author: Nam Phong
════════════════════════
ⴵ Time: Fri, 07 Aug 2026 12:44:26 +0000
════════════════════════
⌗ Tags: #Linux #Anonymity OS #CVE_2026_64560 #Deanonymization #Linux Kernel #privilege escalation #Race Condition #Tails OS #Tor Browser
Information Security News
Tails 7.10.1: Emergency Patch for CVE-2026-64560 That Could Deanonymize Users
Users of anonymous operating systems typically rely on the guarantee that no single program running within the environment can betray their true identity. Sometimes, however, a solitary flaw in th…
15 views
Daily Writeups
⤷ Title: AI Agents Go Rogue: Mythos 5 and GPT-5.6 Sol Escape Cyber Testbed, Target Real GitHub
════════════════════════
𐀪 Author: Nam Phong
════════════════════════
ⴵ Time: Fri, 07 Aug 2026 06:46:31 +0000
════════════════════════
⌗ Tags: #Vulnerability #AI Agent Escape #AI safety #AISI Cyber Test #Anthropic Mythos #GPT_5.6 Sol #Prompt Injection #Sandbox Escape #supply chain attack
Information Security News
AI Agents Go Rogue: Mythos 5 and GPT-5.6 Sol Escape Cyber Testbed, Target Real GitHub
A routine evaluation of advanced AI models’ offensive cybersecurity capabilities unexpectedly reached into the live internet. One agent attempted to inject malicious code into a public open-…
11 views
Daily Writeups
⤷ Title: OVERCAST PANDA Conducts Physical Attacks on Laptops
════════════════════════
𐀪 Author: Nam Phong
════════════════════════
ⴵ Time: Thu, 06 Aug 2026 14:45:46 +0000
════════════════════════
⌗ Tags: #Cybercriminals #cybersecurity #FlowCloud #malware #OVERCAST PANDA #Physical Security
Information Security News
OVERCAST PANDA Conducts Physical Attacks on Laptops
The Threat of Physical Compromise A business trip can expose sensitive data to compromise before a laptop ever connects to the corporate network. For instance, the OVERCAST PANDA threat group infe…
10 views
Daily Writeups
⤷ Title: Critical N-central Vulnerability Exploited in MSP Attacks
════════════════════════
𐀪 Author: Nam Phong
════════════════════════
ⴵ Time: Thu, 06 Aug 2026 14:01:54 +0000
════════════════════════
⌗ Tags: #Vulnerability #cybersecurity #MSP #N_able #N_central #vulnerability
Information Security News
Critical N-central Vulnerability Exploited in MSP Attacks
Administrative Bypass and Platform Exploitation Adversaries discovered a mechanism to access N-central without credentials, securing administrative privileges and leveraging native platform featur…
10 views
Daily Writeups
⤷ Title: AI Cyber Threat Trends Surge in 2025
════════════════════════
𐀪 Author: Nam Phong
════════════════════════
ⴵ Time: Thu, 06 Aug 2026 13:08:48 +0000
════════════════════════
⌗ Tags: #Cybercriminals #Artificial intelligence #CrowdStrike #cybersecurity #LLMjacking #malware
Information Security News
AI Cyber Threat Trends Surge in 2025
Exploiting AI Infrastructure An attacker dispatched nearly 200,000 requests to a language model in just two minutes. Specifically, they leveraged a stolen access key to execute this massive flood.…
10 views
Daily Writeups
⤷ Title: Google Password Manager Passkey Bypasses Uncovered
════════════════════════
𐀪 Author: Nam Phong
════════════════════════
ⴵ Time: Thu, 06 Aug 2026 12:08:43 +0000
════════════════════════
⌗ Tags: #Vulnerability #cybersecurity #Google Password Manager #Passkeys #Unit 42 #windows
Information Security News
Google Password Manager Passkey Bypasses Uncovered
The Transition to Passwordless Security Passwords are gradually giving way to passkeys as the primary means of digital authentication. Nevertheless, account security remains heavily dependent on h…
11 views
Daily Writeups
⤷ Title: Google ADK Vulnerability Enables Agent to Agent Attacks
════════════════════════
𐀪 Author: Nam Phong
════════════════════════
ⴵ Time: Thu, 06 Aug 2026 07:08:55 +0000
════════════════════════
⌗ Tags: #Vulnerability #AI security #cybersecurity #google #Google ADK Vulnerability #Prompt Injection
Information Security News
Google ADK Vulnerability Enables Agent to Agent Attacks
The Emergence of Agent-Against-Agent Exploits An AI agent can deceptively trigger another agent with elevated privileges. Consequently, an attacker can exploit this mechanism to compromise a softw…
10 views
Daily Writeups
⤷ Title: Fake AI CVE Reports Expose System Flaws
════════════════════════
𐀪 Author: Nam Phong
════════════════════════
ⴵ Time: Thu, 06 Aug 2026 04:19:51 +0000
════════════════════════
⌗ Tags: #Vulnerability #Artificial intelligence #CVE #cybersecurity #JFrog #SQLite
Information Security News
Fake AI CVE Reports Expose System Flaws
The Emergence of Fabricated Vulnerabilities Vulnerability databases recently received reports of critical SQLite flaws. These fictitious vulnerabilities boasted severity scores reaching a staggeri…
10 views
Daily Writeups
⤷ Title: Beyond CVSS: rethinking scoring systems amidst AI Safety and Security
════════════════════════
𐀪 Author: Eleanor Barlow
════════════════════════
ⴵ Time: Thu, 06 Aug 2026 00:00:00 GMT
════════════════════════
⌗ Tags: #Business Insights
Intigriti
Beyond CVSS: rethinking scoring systems amidst AI Safety and Security
While CVSS is still the right tool for many AI security findings, AI safety needs customer-specific, outcome-based scoring.
9 views
Daily Writeups
⤷ Title: IDOR via Comma-Injection: How Concatenating Two IDs Leaked Cross-Tenant PII
════════════════════════
𐀪 Author: s0ufm3l
════════════════════════
ⴵ Time: Sun, 09 Aug 2026 20:14:05 GMT
════════════════════════
⌗ Tags: #cybersecurity #bug_bounty #bug_bounty_tips #pentesting
Medium
IDOR via Comma-Injection: How Concatenating Two IDs Leaked Cross-Tenant PII
TL;DR: A permissions endpoint expected a single numeric user ID in one POST parameter. Sending two IDs separated by a comma — victim first…
18 views
Daily Writeups
⤷ Title: One DNS Query Maps a Company’s Entire SaaS Stack
════════════════════════
𐀪 Author: Devansh Patel
════════════════════════
ⴵ Time: Sun, 09 Aug 2026 17:15:38 GMT
════════════════════════
⌗ Tags: #privacy #python #cybersecurity #osint #bug_bounty
Medium
One DNS Query Maps a Company’s Entire SaaS Stack
Part 3 — The complete email OSINT workflow, in order: validation, dorking, the pivot, verification discipline, the legal line, and a…
12 views
Daily Writeups
⤷ Title: RepoJacking: How 5 Unclaimed GitHub Usernames Enabled RCE on Self-Hosted Servers
════════════════════════
𐀪 Author: tushar
════════════════════════
ⴵ Time: Sun, 09 Aug 2026 16:36:00 GMT
════════════════════════
⌗ Tags: #supply_chain #infosec #github #cybersecurity #bug_bounty
Medium
RepoJacking: How 5 Unclaimed GitHub Usernames Enabled RCE on Self-Hosted Servers
How I used a 3-line bash script to find 8 backdoorable plugins in an official plugin registry — and why this attack requires zero exploits.
14 views
Daily Writeups
⤷ Title: The Protocol Every Hacker Should Learn Before Touching Burp Suite
════════════════════════
𐀪 Author: Zer0trace
════════════════════════
ⴵ Time: Sun, 09 Aug 2026 13:02:35 GMT
════════════════════════
⌗ Tags: #cybersecurity #bug_bounty #software_development #ethical_hacking
Medium
The Protocol Every Hacker Should Learn Before Touching Burp Suite
Type http://example.com into a browser and hit Enter. A page shows up — text, maybe an image or a login box — and you move on. You don't…
10 views
Daily Writeups
⤷ Title: Why Your Best XSS Is on a Param You Can’t See
════════════════════════
𐀪 Author: Nitin yadav
════════════════════════
ⴵ Time: Sun, 09 Aug 2026 11:31:01 GMT
════════════════════════
⌗ Tags: #ethical_hacking #infosec #cybersecurity #bug_bounty #hacking
Medium
Why Your Best XSS Is on a Param You Can’t See
What’s up everyone! Nitin here 👋
13 views
Daily Writeups
⤷ Title: Indirect Prompt Injection: What LLM Bounty Triagers Actually Reward
════════════════════════
𐀪 Author: Muhammad Haider Tallal
════════════════════════
ⴵ Time: Sun, 09 Aug 2026 11:00:13 GMT
════════════════════════
⌗ Tags: #prompt_injection_attack #ai_security #bug_bounty #cybersecurity #artificial_intelligence
Medium
Indirect Prompt Injection: What LLM Bounty Triagers Actually Reward
Direct injection and jailbreaks keep getting closed as informational. The findings that pay chain a hidden instruction to a real…
18 views
Daily Writeups
⤷ Title: Unauthenticated Mass Data Deletion: When DELETE Has No Auth Check
════════════════════════
𐀪 Author: Divakarvasani
════════════════════════
ⴵ Time: Sun, 09 Aug 2026 09:54:53 GMT
════════════════════════
⌗ Tags: #hacking #cybersecurity #bug_bounty
Medium
Unauthenticated Mass Data Deletion: When DELETE Has No Auth Check
Finding and proving a cross-user resource deletion vulnerability through JS bundle analysis and sequential ID enumeration
13 views
Daily Writeups
⤷ Title: How I Chained an Unauthenticated OAuth Registration Endpoint into Full Account Takeover
════════════════════════
𐀪 Author: Divakarvasani
════════════════════════
ⴵ Time: Sun, 09 Aug 2026 09:50:04 GMT
════════════════════════
⌗ Tags: #hacking #cybersecurity #bug_bounty
Medium
How I Chained an Unauthenticated OAuth Registration Endpoint into Full Account Takeover
A walkthrough of abusing RFC 7591 Dynamic Client Registration left open in production
11 views