Daily Writeups
@Daily_Writeups
4.11K subscribers
4 photos
138K links
Daily Bug Bounty / Cybersecurity Writeups
Source Code : https://github.com/Spix0r/writeup-miner
Download Telegram
About
Blog
Apps
Platform
Join
Daily Writeups
4.11K subscribers
Daily Writeups
⤷ Title: “RondoDoX” Strikes Back: Exposed Logs Reveal Massive 9-Month Campaign Targeting Next.js and IoT
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 31 Dec 2025 02:33:19 +0000
════════════════════════
⌗ Tags: #Malware #botnet #CloudSEK #CVE_2025_55182 #IoT security #Next.js #Prototype Pollution #rce #React2Shell #RondoDox #Server Actions #Web Framework Security #XMRig
Daily CyberSecurity
“RondoDoX” Strikes Back: Exposed Logs Reveal Massive 9-Month Campaign Targeting Next.js and IoT
The RondoDoX botnet has resurfaced with a potent new arsenal, shifting its sights from simple routers to enterprise-grade web frameworks. A new intelligence report from CloudSEK details a sprawlin…
20 views
Daily Writeups
⤷ Title: RondoDox Botnet is Using React2Shell to Hijack Thousands of Unpatched Devices
════════════════════════
𐀪 Author: Deeba Ahmed
════════════════════════
ⴵ Time: Sat, 03 Jan 2026 14:59:09 +0000
════════════════════════
⌗ Tags: #Security #Botnet #Cyber Attack #Cybersecurity #Malware #Mirai #Next.js #React2Shell #RondoDox #Vulnerability
Hackread
RondoDox Botnet is Using React2Shell to Hijack Thousands of Unpatched Devices
Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread
49 views
Daily Writeups
⤷ Title: The Crash Code: Node.js Issues Critical Fix for Framework-Breaking DoS Flaw
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Fri, 16 Jan 2026 03:26:52 +0000
════════════════════════
⌗ Tags: #Vulnerability #async_hooks #Datadog #DoS vulnerability #Infosec #Next.js #Node.js #OpenTelemetry #React Server Components #Security Update 2026 #Web Development
Penetration Testing Tools
The Crash Code: Node.js Issues Critical Fix for Framework-Breaking DoS Flaw
The Node.js development team has disseminated critical security updates to mitigate a high-severity vulnerability capable of precipitating a
6 views
Daily Writeups
⤷ Title: Beyond the Wall: Intel and SoftBank’s ZAM Aims to Dethrone HBM by 2030
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Thu, 05 Feb 2026 03:33:30 +0000
════════════════════════
⌗ Tags: #Technology #3D DRAM stacking #Advanced Memory Technology #AI Memory #AMT #HBM #High Bandwidth Memory #intel #Next Generation DRAM Bonding #NGDB #SAIMEMORY #SoftBank #Tech News 2026 #Z_Angle Memory #ZAM
Daily CyberSecurity
Beyond the Wall: Intel and SoftBank’s ZAM Aims to Dethrone HBM by 2030
Intel and SoftBank subsidiary SAIMEMORY join forces to develop Z-Angle Memory (ZAM), a next-gen stacked DRAM aiming to slash power and double AI memory capacity.
17 views
Daily Writeups
⤷ Title: CVE-2026-25544: Critical Payload CMS SQLi (CVSS 9.8) Exposes Admin Tokens
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Tue, 10 Feb 2026 00:07:05 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #blind sqli #CVE_2026_25544 #database security #Drizzle ORM #Headless CMS #Next.js #Patch Alert #Payload CMS #sql injection #web development
Daily CyberSecurity
CVE-2026-25544: Critical Payload CMS SQLi (CVSS 9.8) Exposes Admin Tokens
Critical Payload CMS flaw CVE-2026-25544 (CVSS 9.8) allows SQL injection via JSON fields. Unauthenticated attackers can steal admin tokens. Update to v3.73.0.
17 views
Daily Writeups
⤷ Title: The Interview Trap: Malicious Next.js Repositories Weaponize Coding Tests to Hack Developers
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Fri, 27 Feb 2026 00:01:54 +0000
════════════════════════
⌗ Tags: #Cybercriminals #developer security #infosec #malware #Microsoft Defender #Next.js #npm Security #social engineering #supply chain attack #Technical Interview Scam #VS Code Security
Daily CyberSecurity
The Interview Trap: Malicious Next.js Repositories Weaponize Coding Tests to Hack Developers
Microsoft warns of a new campaign targeting engineers via fake Next.js technical assessments. Malware hides in VS Code tasks and npm scripts to steal secrets.
24 views
Daily Writeups
⤷ Title: 5 Best Next Gen Endpoint Protection Platforms in 2026
════════════════════════
𐀪 Author: Owais Sultan
════════════════════════
ⴵ Time: Thu, 05 Mar 2026 18:35:15 +0000
════════════════════════
⌗ Tags: #Security #AI #Cybersecurity #EDR #Endpoint Protection #Next Gen #SaaS #Technology
Hackread
5 Best Next Gen Endpoint Protection Platforms in 2026
Follow us on all social media platforms @Hackread
40 views
Daily Writeups
⤷ Title: Password Hijack in the Modern Stack: Payload CMS Patches Critical 9.1 CVSS Reset Flaw
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Fri, 03 Apr 2026 14:30:48 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Backend Security #CVE_2026_34751 #Headless CMS #infosec #Next.js #password reset #Patch Alert #Payload CMS #React #TypeScript #Vulnerability #Web Security
Daily CyberSecurity
Password Hijack in the Modern Stack: Payload CMS Patches Critical 9.1 CVSS Reset Flaw
Payload CMS fixes a critical 9.1 CVSS flaw (CVE-2026-34751) in its password reset flow. Attackers could hijack accounts. Update to v3.79.1 immediately!
8 views
Daily Writeups
⤷ Title: UAT-10608 Collective Hijacked 700+ Next.js Servers in Hours
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Mon, 06 Apr 2026 09:57:14 +0000
════════════════════════
⌗ Tags: #Malware #Vulnerability #Cisco Talos #cloud security #Credential Harvesting #CVE_2025_55182 #Cybersecurity 2026 #Next.js #React2Shell #remote code execution #supply chain attack #UAT_10608
Penetration Testing Tools
UAT-10608 Collective Hijacked 700+ Next.js Servers in Hours
Cybersecurity specialists have chronicled a voluminous, automated campaign for credential harvesting that, within a mere matter of hours,
9 views
Daily Writeups
⤷ Title: UAT-10608 Uses a Next.js “React2Shell” Flaw to Map Your Entire Cloud
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Tue, 07 Apr 2026 08:30:39 +0000
════════════════════════
⌗ Tags: #Cybercriminals #Cisco Talos #Cloud Security #Credential Harvesting #CVE_2025_55182 #infosec #Next.js #NEXUS Listener #React2Shell #supply chain attack #UAT_10608 #Web Security
Daily CyberSecurity
UAT-10608 Uses a Next.js "React2Shell" Flaw to Map Your Entire Cloud
Cisco Talos uncovers UAT-10608, an automated campaign using "NEXUS Listener" to harvest Next.js credentials via React2Shell. Patch your cloud tokens now!
10 views
Daily Writeups
⤷ Title: The Next.js Nightmare? Vercel Investigates “Critical” Internal Breach and Supply Chain Threat
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Sun, 19 Apr 2026 23:59:43 +0000
════════════════════════
⌗ Tags: #Data Leak #cybersecurity news #Data Breach #github #infosec #Next.js #npm #Secret Rotation #ShinyHunters #supply chain attack #Turbo.js #Vercel
Daily CyberSecurity
The Next.js Nightmare? Vercel Investigates "Critical" Internal Breach and Supply Chain Threat
Vercel investigates a major breach by ShinyHunters. With Next.js source code and tokens at risk, developers must rotate secrets immediately. Stay updated.
35 views
Daily Writeups
⤷ Title: Critical 9.1 CVSS Bypass in Clerk’s Middleware Gating
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Mon, 20 Apr 2026 12:05:05 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Astro Security #Authentication Bypass #Clerk #createRouteMatcher #CVSS 9.1 #infosec #Middleware Bypass #Next.js Security #Nuxt Security #Patch Alert #web development
Daily CyberSecurity
Critical 9.1 CVSS Bypass in Clerk’s Middleware Gating
Clerk reveals a critical 9.1 CVSS flaw in createRouteMatcher. Crafted requests can bypass middleware gating in Next.js, Nuxt, and Astro. Patch your apps now!
20 views
Daily Writeups
⤷ Title: The AI Weak Link: How a Third-Party Breach Exposed Vercel Customer Secrets
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Tue, 21 Apr 2026 09:17:43 +0000
════════════════════════
⌗ Tags: #Data Leak #API Keys #cloud security #Context.ai #Cybersecurity 2026 #data breach #Environment Variables #Mandiant #Next.js #OAuth Security #supply chain attack #Vercel
Penetration Testing Tools
The AI Weak Link: How a Third-Party Breach Exposed Vercel Customer Secrets
The month of April concluded for the American firm Vercel with a distressing incident that precipitously transcended the
22 views
Daily Writeups
⤷ Title: Open Proxy Risk: High-Severity Next.js SSRF Flaw Exposes Cloud Metadata Endpoints
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Mon, 18 May 2026 06:56:21 +0000
════════════════════════
⌗ Tags: #Vulnerability #Cloud Metadata Exploit #CVE_2026_44578 #CWE_918 #Next.js #Security Patch 2026 #Self_Hosted Node.js #Server_Side Request Forgery #SSRF #Vercel #WebSocket Upgrade
Penetration Testing Tools
Open Proxy Risk: High-Severity Next.js SSRF Flaw Exposes Cloud Metadata Endpoints
The development framework Next.js has remediated a critical security vulnerability, designated as CVE-2026-44578, which afflicts applications deployed on
30 views
Daily Writeups
⤷ Title: The Dawn of AV2: AOMedia Finalizes Next-Generation Video Compression
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Mon, 01 Jun 2026 04:32:58 +0000
════════════════════════
⌗ Tags: #Technology #AOMedia video standard #AV2 codec v1.0.0 release #next_generation streaming codec #open_source video infrastructure #royalty_free video compression #VLC DAV2D decoder
Daily CyberSecurity
The Dawn of AV2: AOMedia Finalizes Next-Generation Video Compression
Explore the historic AV2 codec v1.0.0 release by AOMedia. Learn about its royalty-free compression, VLC integration, and the future of streaming.
18 views
Daily Writeups
⤷ Title: Ethical Hacking: Building the Next Generation of Cyber Security Professionals
════════════════════════
𐀪 Author: Poddar Group of Institutions
════════════════════════
ⴵ Time: Thu, 04 Jun 2026 05:07:33 GMT
════════════════════════
⌗ Tags: #next_generation #ethical_hacking #professional #cybersecurity
Medium
Ethical Hacking: Building the Next Generation of Cyber Security Professionals
Ethical hacking is the authorized process of identifying vulnerabilities in computer systems and networks to strengthen security defenses…
43 views
Daily Writeups
⤷ Title: Next.js Patches Three CVSS 8.3 Flaws in Rewrites, Server Actions, and Middleware
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Thu, 23 Jul 2026 13:05:21 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #CVE_2026_64642 #CVE_2026_64645 #CVE_2026_64649 #Next.js #Next.js vulnerabilities #Server_Side Request Forgery #Vercel
Daily CyberSecurity
Next.js Patches Three CVSS 8.3 Flaws in Rewrites, Server Actions, and Middleware
TL;DR Vercel fixed three Next.js vulnerabilities, each rated CVSS 8.3. Two of them allow Server-Side Request Forgery, while the third lets crafted requests slip past middleware-based authenticatio…
15 views
Daily Writeups
⤷ Title: Critical Next.js RCE Vulnerability Fixed in Version 16.3.6
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Wed, 23 Sep 2026 07:54:27 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #CVE_2026_94545 #cybersecurity #Next.js #Remote Code Execution #Vercel #Web Security
Daily CyberSecurity
Critical Next.js RCE Vulnerability Fixed in Version 16.3.6
TL;DR On September 22, 2026, Vercel published an emergency fix for a critical Next.js RCE vulnerability. Tracked as CVE-2026-94545, this flaw allows unauthenticated remote attackers to execute arb…
29 views
Daily Writeups
⤷ Title: PoC Exploit Released for Next.js RCE Flaw CVE-2026-94545
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Thu, 01 Oct 2026 09:54:22 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #CVE_2026_94545 #Next.js #Next.js RCE #PoC #Remote Code Execution #Satori #Vercel
Daily CyberSecurity
PoC Exploit Released for Next.js RCE Flaw CVE-2026-94545
TL;DR Technical details and a working proof-of-concept exploit are now public for CVE-2026-94545, a critical Next.js RCE in the next/og image API. One unauthenticated request can run commands on t…
43 views
Daily Writeups
⤷ Title: Next.js Fixes Two Critical Unauthenticated RCE Flaws in Out-of-Band Update
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Thu, 15 Oct 2026 04:55:06 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #CVE_2026_96889 #Next.js #React #Remote Code Execution #shARP #Vercel #Web Security
Daily CyberSecurity
Next.js Fixes Two Critical Unauthenticated RCE Flaws in Out-of-Band Update
TL;DR Vercel shipped Next.js 16.4.1 and 15.5.28 on October 14, 2026, in an out-of-band release. The Next.js security update fixes two critical unauthenticated remote code execution flaws and one h…
26 views