Daily Writeups
@Daily_Writeups
3.49K subscribers
2 photos
128K links
Daily Bug Bounty / Cybersecurity Writeups
Source Code : https://github.com/Spix0r/writeup-miner
Download Telegram
About
Blog
Apps
Platform
Join
Daily Writeups
3.49K subscribers
Daily Writeups
⤷ Title: Total Database Collapse: Inside the ElectricSQL CVSS 10.0 SQL Injection
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 22 Apr 2026 14:06:59 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #CVE_2026_40906 #CVSS 10 #cyber attack #database security #ElectricSQL #infosec #Multi_tenancy #Patch Alert #PostgreSQL #sql injection #sqli
Daily CyberSecurity
Total Database Collapse: Inside the ElectricSQL CVSS 10.0 SQL Injection
ElectricSQL reveals a critical 10.0 CVSS SQL injection (CVE-2026-40906). Attackers can hijack PostgreSQL and bypass tenant isolation. Patch to v1.5.0 now.
24 views
Daily Writeups
⤷ Title: AWS Launches “Amazon Quick” to Bridge the Gap Between Desktop and Cloud
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 29 Apr 2026 08:06:58 +0000
════════════════════════
⌗ Tags: #Technology #Agentic AI #AI Desktop Assistant #Amazon Quick #AWS #Enterprise Productivity #Generative AI 2026 #Google Workspace #Long_Term Memory #Microsoft 365 #Multi_Platform Integration #Salesforce #Slack
Daily CyberSecurity
AWS Launches "Amazon Quick" to Bridge the Gap Between Desktop and Cloud
AWS unveils Amazon Quick, a "borderless" desktop AI assistant with long-term memory. It integrates local files with Slack, Teams, and Salesforce for proactive work.
12 views
Daily Writeups
⤷ Title: Critical 9.0 CVSS Flaw in ArcadeDB Allows Total Cross-Database Access
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Thu, 07 May 2026 02:17:05 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #ArcadeDB #Authorization Bypass #CVE_2026_44221 #cybersecurity #Data Isolation #database security #infosec #Multi_Model DBMS #Multi_tenancy #Patch Alert
Daily CyberSecurity
Critical 9.0 CVSS Flaw in ArcadeDB Allows Total Cross-Database Access
ArcadeDB 26.4.1 fixes a critical 9.0 CVSS authorization bypass (CVE-2026-44221) that dismantles database isolation. Secure your multi-model data and patch now!
22 views
Daily Writeups
⤷ Title: Critical 9.9 CVSS Rancher Fleet Flaw Grants Full Cluster-Admin Access
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Fri, 08 May 2026 01:29:28 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #CVE_2026_41050 #cybersecurity #Fleet #GitOps #Helm Deployer #infosec #Kubernetes Security #Multi_tenancy #Patch Alert #ServiceAccount Impersonation #SUSE Rancher
Daily CyberSecurity
Critical 9.9 CVSS Rancher Fleet Flaw Grants Full Cluster-Admin Access
Rancher Fleet fixes a 9.9 CVSS flaw (CVE-2026-41050) allowing tenants to bypass ServiceAccount isolation and steal secrets. Upgrade your GitOps engine now!
24 views
Daily Writeups
⤷ Title: PraisonAI CVE-2026-44338 Exploited in the Wild Hours After Patch Disclosure
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 13 May 2026 02:00:36 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #AI security #Authentication Bypass #CVE_2026_44338 #Cyber Security #Exploit in the Wild #infosec #LLM Security #Multi_Agent Orchestration #PraisonAI #Sysdig TRT
Daily CyberSecurity
PraisonAI CVE-2026-44338 Exploited in the Wild Hours After Patch Disclosure
Sysdig warns: PraisonAI (CVE-2026-44338) exploited in under 4 hours. Attackers bypassed auth to hijack agents and drain API quotas. Update to 4.6.34 now!
7 views
Daily Writeups
⤷ Title: Resurgent Tycoon 2FA Adopts OAuth Device Code Phishing to Hijack Microsoft 365
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Tue, 19 May 2026 07:11:10 +0000
════════════════════════
⌗ Tags: #Cybercriminals #Cloud Security #Cyber Security #Device Authorization Grant #eSentire TRU #infosec #MFA Bypass #Microsoft 365 #Multi_Factor Authentication #OAuth 2.0 #PhaaS #Phishing_as_a_Service #Tycoon 2FA
Daily CyberSecurity
Resurgent Tycoon 2FA Adopts OAuth Device Code Phishing to Hijack Microsoft 365
Despite a global takedown, Tycoon 2FA is back. It now abuses Microsoft's device code flow to bypass MFA entirely. Disabling this flow is critical.
11 views
Daily Writeups
⤷ Title: Passwords and SMS Are Dead: Microsoft Begins Sunsetting Text Message Verification for Consumer Accounts
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 20 May 2026 02:22:28 +0000
════════════════════════
⌗ Tags: #Technology #Credential Harvesting Mitigation #Cryptographic Key Pair #Microsoft Identity Core #Microsoft SMS Deprecation #Multi_Factor Authentication Safety #Origin Binding Phishing Protection #Passkey Authentication #Passwordless Microsoft Account #SIM Swapping Defense #Windows Hello Security
Daily CyberSecurity
Passwords and SMS Are Dead: Microsoft Begins Sunsetting Text Message Verification for Consumer Accounts
Microsoft has announced the deprecation of SMS verification codes for consumer accounts, forcing a shift to secure passkeys and biometric authentication.
11 views
Daily Writeups
⤷ Title: Talk to Your Tech: Google Debuts “Ask YouTube” and Instant Voice “Live” Tools at I/O 2026
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 20 May 2026 01:49:29 +0000
════════════════════════
⌗ Tags: #Technology #Ask YouTube AI Feature #Conversational Voice Prompting #Docs Live #Gemini Omni Integration #Gmail Live #Google I/O 2026 #Google Workspace Live #Keep Live #Multi_Modal Search #YouTube Labs Portal
Daily CyberSecurity
Talk to Your Tech: Google Debuts "Ask YouTube" and Instant Voice "Live" Tools at I/O 2026
At Google I/O 2026, Google unveiled "Ask YouTube" for natural-language video interrogation alongside "Live" voice-prompting across Gmail, Docs, and Keep.
12 views
Daily Writeups
⤷ Title: Google Cloud Abruptly Shuts Down Railway, Sparking Catastrophic Infrastructure Outage
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 20 May 2026 06:43:11 +0000
════════════════════════
⌗ Tags: #Technology #Automated Enforcement Algorithms #Cloud Concentration Risk #Google Cloud Account Suspension #Infrastructure Automation Failure #Multi_Cloud Redundancy #Non_Enterprise Build Throttle #Railway Outage 2026 #Site Reliability Engineering #Unilateral Cloud Termination #UniSuper GCP Incident
Daily CyberSecurity
Google Cloud Abruptly Shuts Down Railway, Sparking Catastrophic Infrastructure Outage
Developer cloud platform Railway suffers a widespread, catastrophic infrastructure outage after Google Cloud abruptly suspends its corporate account.
11 views
Daily Writeups
⤷ Title: Developer Alert: Poisoned Nx Console VS Code Extension Steals AWS, npm, and GitHub Tokens
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Wed, 20 May 2026 07:37:38 +0000
════════════════════════
⌗ Tags: #Malware #Bun JavaScript Runtime #Dangling Orphan Commit #DNS Tunneling Exfiltration #GitHub Token Theft #Multi_Stage Credential Harvester #Nx Console Extension Compromise #rwl.angular_console #Sigstore Supply Chain Poisoning #StepSecurity Forensic Audit #Visual Studio Code Marketplace
Penetration Testing Tools
Developer Alert: Poisoned Nx Console VS Code Extension Steals AWS, npm, and GitHub Tokens
The highly popular Nx Console extension for Visual Studio Code has been compromised via a weaponized supply-chain injection.
10 views
Daily Writeups
⤷ Title: Zero-Trust Voice: Discord Finalizes Mandatory “DAVE” Encryption for All Audio and Video Streams
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 20 May 2026 07:49:06 +0000
════════════════════════
⌗ Tags: #Technology #Automated Content Moderation #Client Update Requirements #Discord DAVE Protocol #End_to_End Encryption #Messaging Layer Security #Multi_Party Cryptographic Handshake #Selective Forwarding Unit #Trail of Bits Audit #User Data Sovereignty #WebRTC Encoded Transform
Daily CyberSecurity
Zero-Trust Voice: Discord Finalizes Mandatory “DAVE” Encryption for All Audio and Video Streams
Discord, the widely celebrated communications architecture tailored for the global gaming constituency, has announced the universal initialization of mandatory end-to-end encryption (E2EE) across …
13 views
Daily Writeups
⤷ Title: The Kill Switch: How an Automated Google Cloud Error Instantly Wiped Out the Railway Platform
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Thu, 21 May 2026 10:34:50 +0000
════════════════════════
⌗ Tags: #Technology #503 Service Unavailable #Anti_Abuse Filtering Engine Regression #Cloud Control Plane Blackout #Cross Cloud Data Preservation #GCP Automated Account Outage #Google Cloud Platform Post Mortem #Hyperscale Hypervisor Failover #Multi Cloud Synchronization #Railway App Google Cloud Suspension #Railway Metal Infrastructure
Daily CyberSecurity
The Kill Switch: How an Automated Google Cloud Error Instantly Wiped Out the Railway Platform
Railway suffered an 8-hour platform-wide blackout after Google Cloud's automated anti-abuse system incorrectly suspended its multi-million-dollar account.
15 views
Daily Writeups
⤷ Title: New Apache Camel K Flaw (CVE-2026-45760) Enables Cross-Namespace Attacks
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Fri, 22 May 2026 03:12:15 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Apache Camel K #Authorization Bypass #Build Deputy Attack #Cloud Native Security #CVE_2026_45760 #Cyber Security #infosec #Kubernetes Namespace Bypass #Multi_Tenancy Defect #Patch Alert #Pod Generation Hijack
Daily CyberSecurity
New Apache Camel K Flaw (CVE-2026-45760) Enables Cross-Namespace Attacks
Apache Camel K fixes CVE-2026-45760, a critical cross-namespace "Build Deputy" flaw allowing authorized users to hijack pods in secure namespaces.
25 views
Daily Writeups
⤷ Title: StablR Stablecoin Depeg Hack: $10M Minted in Multisig Failure
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Tue, 26 May 2026 07:14:55 +0000
════════════════════════
⌗ Tags: #Vulnerability #automated market maker AMM liquidity drain #Blockaid smart contract telemetry #cryptocurrency compliance regulations #Electronic Money Institution EMI governance failure #Markets in Crypto Assets MiCA compliance #multi_signature contract misconfiguration #private key exfiltration #Resolv stablecoin attack #StablR stablecoin depeg hack #USDR EURR token minting exploit
Information Security News
StablR Stablecoin Depeg Hack: $10M Minted in Multisig Failure - Information Security News
The StablR stablecoin depeg hack triggered a collapse in USDR and EURR value after an attacker hijacked a 1-of-3 multisig key to mint over $10M in tokens.
26 views
Daily Writeups
⤷ Title: VaultJacking: Exploiting Google Sync Infrastructure via Intercepted PINs
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Fri, 29 May 2026 09:41:23 +0000
════════════════════════
⌗ Tags: #Cybercriminals #cross_site authentication data theft #Google Workspace proxy environment hijacking #iCloud Keychain vs Google security architecture #multi_platform synchronized repository dump #PhishU Adversary_in_the_Middle framework #session cookie token theft mitigations #synchronization PIN credential exfiltration #unauthorized trusted device registry #VaultJacking Google password phishing #WebAuthn hardware perimeter bypass
Information Security News
VaultJacking: Exploiting Google Sync Infrastructure via Intercepted PINs
The Genesis of the VaultJacking Attack Vector A solitary numeric PIN can transform Google’s password repository into an unsecured gateway. Consequently, the emerging VaultJacking phishing methodol…
12 views
Daily Writeups
⤷ Title: AI SecOps: A Weekend’s Hackathon against the MCP tools and reflections on the findings & Secure AI…
════════════════════════
𐀪 Author: JPantsjoha
════════════════════════
ⴵ Time: Sun, 31 May 2026 17:35:53 GMT
════════════════════════
⌗ Tags: #gemini_agent_platform #multi_agent_systems #google_adk #ai_security #bug_bounty
Medium
AI SecOps: A Weekend’s Hackathon against the MCP tools and reflections on the findings & Secure AI Solution Architecture planning.
I’ve been raving about the ‘Applied AI Engineers’ for a wee while, but I was wrong. AI Skills are actually PlatformEngineer’s New Skill…
25 views
Daily Writeups
⤷ Title: The AI Proxy: Meta’s Virtual Assistant Exploited in Instagram Takeovers
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Wed, 03 Jun 2026 03:28:00 +0000
════════════════════════
⌗ Tags: #Vulnerability #account hijacking vulnerability #Andy Stone statement #automated chatbot support flaw #high_profile profile takeovers #Meta AI Instagram exploit #multi_factor authentication defense
Information Security News
Meta AI Instagram Exploit: Account Hijacking Fixed
Analyze the shocking Meta AI Instagram exploit. Learn how hackers manipulated the chatbot to hijack high-profile profiles and how Meta responded.
22 views
Daily Writeups
⤷ Title: Edge Vulnerabilities: The C0XMO Botnet Subverts Residential Network Perimeters
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Wed, 10 Jun 2026 03:35:41 +0000
════════════════════════
⌗ Tags: #Malware #C0XMO Gafgyt botnet variant #DD_WRT router vulnerability #DDoS flood attacks #Fortinet threat report #modular IoT malware #multi architecture exploit
Information Security News
C0XMO Gafgyt Botnet Variant: New DD-WRT Flaw
Discover the new C0XMO Gafgyt botnet variant discovered by Fortinet. Learn how this modular malware exploits DD-WRT routers to launch severe DDoS floods.
14 views
Daily Writeups
⤷ Title: Operation STANDOFF: Multi-Operator Intrusion Analysis
════════════════════════
𐀪 Author: Nam Phong
════════════════════════
ⴵ Time: Fri, 24 Jul 2026 15:10:53 +0000
════════════════════════
⌗ Tags: #Cybercriminals #BOTNET #infostealers #Multi_Operator Campaign #Operation STANDOFF #VMRay Labs
Information Security News
Operation STANDOFF: Multi-Operator Intrusion Analysis
Unveiling Operation STANDOFF A singular malicious installer served as the entry point into a vast criminal ecosystem that concurrently compromised endpoints, exfiltrated sensitive data, hijacked v…
22 views
Daily Writeups
⤷ Title: Unpatched Plane Authorization Bypass CVE-2026-15342 Exposes Other Workspaces
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Mon, 27 Jul 2026 13:03:32 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Authorization Bypass #broken access control #CERT/CC #CVE_2026_15342 #Multi_Tenant #open_source #Plane #Project Management #unpatched #VU#762226
Daily CyberSecurity
Unpatched Plane Authorization Bypass CVE-2026-15342 Exposes Other Workspaces
TL;DR CERT/CC published an advisory on July 21, 2026 for a Plane authorization bypass. Tracked as CVE-2026-15342, it lets a user in one workspace read, copy, or delete another workspace’s fi…
6 views