Daily Writeups
@Daily_Writeups
4.07K subscribers
4 photos
138K links
Daily Bug Bounty / Cybersecurity Writeups
Source Code : https://github.com/Spix0r/writeup-miner
Download Telegram
About
Blog
Apps
Platform
Join
Daily Writeups
4.07K subscribers
Daily Writeups
⤷ Title: The “Phantom” Character: How a Single Email Can Seize Full Control of Your FreeScout Helpdesk
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Fri, 06 Mar 2026 07:11:13 +0000
════════════════════════
⌗ Tags: #Vulnerability #AllowOverride #apache #CVE_2026_28289 #FreeScout #helpdesk security #Laravel #OX Research #PHP #RCE #Tech News 2026 #zero_click exploit #zero_width space
Penetration Testing Tools
The "Phantom" Character: How a Single Email Can Seize Full Control of Your FreeScout Helpdesk
In a recent dossier, OX Research delineated how a mundane email dispatched to a corporate address can precipitate
9 views
Daily Writeups
⤷ Title: Publicly Disclosed: Bishop Fox Reveals Critical Pre-Auth SQL Injection in FortiClient EMS
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Tue, 17 Mar 2026 14:00:19 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Bishop Fox #CVE_2026_21643 #cybersecurity #database security #FortiClient EMS #infosec #sql injection #threat intelligence #vulnerability disclosure #zero_click exploit
Daily CyberSecurity
Publicly Disclosed: Bishop Fox Reveals Critical Pre-Auth SQL Injection in FortiClient EMS
Bishop Fox publicly disclosed details of a critical 9.1 CVSS zero-click SQL injection in FortiClient EMS (CVE-2026-21643). Patch to 7.4.5 immediately.
15 views
Daily Writeups
⤷ Title: The Invisible Breach: ‘Operation GhostMail’ Uses Zero-Click XSS to Hijack Ukrainian Webmail
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Fri, 20 Mar 2026 09:11:42 +0000
════════════════════════
⌗ Tags: #Cyber Security #APT28 #CVE_2025_66376 #Cyberespionage #cybersecurity #infosec #Operation GhostMail #Seqrite Labs #threat intelligence #Zero_Click XSS #Zimbra Vulnerability
Daily CyberSecurity
The Invisible Breach: 'Operation GhostMail' Uses Zero-Click XSS to Hijack Ukrainian Webmail
Seqrite Labs uncovers Operation GhostMail, an APT28-linked campaign using a zero-click XSS flaw in Zimbra to silently hijack Ukrainian government webmail.
24 views
Daily Writeups
⤷ Title: Apple Resurrects iOS 18 Security to Stop the “DarkSword” Outbreak
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Thu, 02 Apr 2026 07:52:46 +0000
════════════════════════
⌗ Tags: #Apple #Vulnerability #Cybersecurity 2026 #DarkSword #GhostBlade #GhostKnife #GhostSaber #iOS 18.7.7 #iOS 26 #iPadOS Update #iPhone security #Malware Defense #Zero_Click
Penetration Testing Tools
Apple Resurrects iOS 18 Security to Stop the "DarkSword" Outbreak
Apple has, for the first time in a considerable epoch, yielded to the entreaties of its patrons by
12 views
Daily Writeups
⤷ Title: The Zero-Click Vulnerability: Akamai Uncovers Incomplete Patch for APT28 Exploit
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Mon, 27 Apr 2026 14:54:39 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Akamai #APT28 #CVE_2026_32202 #Fancy Bear #infosec #LNK File #NTLM hash theft #NTLM Relay #smb #Windows Security #Zero_Click
Daily CyberSecurity
The Zero-Click Vulnerability: Akamai Uncovers Incomplete Patch for APT28 Exploit
Akamai uncovers CVE-2026-32202: A zero-click LNK flaw used by APT28 to steal Windows NTLM hashes silently. No user interaction required. Patch alert!
31 views
Daily Writeups
⤷ Title: The Zero-Click Ghost: How an Incomplete Patch Left Windows Open to Fancy Bear’s Credential Theft
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Mon, 27 Apr 2026 15:15:59 +0000
════════════════════════
⌗ Tags: #Vulnerability #Akamai #APT28 #Credential Theft #CVE_2026_21510 #CVE_2026_32202 #Fancy Bear #InfoSec 2026 #NTLM Coercion #Windows Shell #Zero_Click Vulnerability
Penetration Testing Tools
The Zero-Click Ghost: How an Incomplete Patch Left Windows Open to Fancy Bear’s Credential Theft
An oversight within a security remediation has inadvertently carved a novel path for exploitation. While the developers successfully
15 views
Daily Writeups
⤷ Title: Critical Zero-Click Android Flaw Grants Remote Shell Access Without Interaction
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Tue, 05 May 2026 01:33:52 +0000
════════════════════════
⌗ Tags: #Android #Vulnerability Report #android #Android 16 #CVE_2026_0073 #cybersecurity #Google Security Bulletin #infosec #Project Mainline #rce #Remote Code Execution #Wireless ADB #Zero_Click
Daily CyberSecurity
Critical Zero-Click Android Flaw Grants Remote Shell Access Without Interaction
Google warns of CVE-2026-0073: a critical zero-click Android vulnerability allowing remote code execution via Wireless ADB. Patch to May 2026 level now!
22 views
Daily Writeups
⤷ Title: Reddit in the Spotlight: Google’s Search Pivot Puts “First-Hand Accounts” at the Core of AI Overviews
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Fri, 08 May 2026 08:04:49 +0000
════════════════════════
⌗ Tags: #Technology #AI Overviews #content licensing #Digital Marketing 2026 #Expert Advice #First_Hand Accounts #Google AI Mode #google search #Reddit #Search Engine Updates #SEO Strategy #Zero_Click Search
Daily CyberSecurity
Reddit in the Spotlight: Google’s Search Pivot Puts "First-Hand Accounts" at the Core of AI Overviews
Google’s AI Overviews shift focus to first-hand accounts from Reddit and social media. Discover how "Expert Advice" and inline linking aim to reclaim user trust.
16 views
Daily Writeups
⤷ Title: Zero-Click Shell: Public Exploit and PoC Disclosed for Android’s Critical ADB Auth Bypass (CVE-2026-0073)
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Mon, 11 May 2026 01:00:27 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #ADB #Android security #Auth Bypass #BARGHEST #CVE_2026_0073 #Exploit #infosec #mobile security #PoC #Wireless Debugging #Zero_Click
Daily CyberSecurity
Zero-Click Shell: Public Exploit and PoC Disclosed for Android’s Critical ADB Auth Bypass (CVE-2026-0073)
A critical vulnerability existing within the core of Android’s developer tools has been exposed, revealing a zero-click avenue for attackers to silently hijack mobile devices over Wi-Fi. Det…
17 views
Daily Writeups
⤷ Title: Zero-Click pretalx XSS Flaw Lets Hackers Hijack Conference Organizer Accounts
════════════════════════
𐀪 Author: Deeba Ahmed
════════════════════════
ⴵ Time: Mon, 01 Jun 2026 12:54:19 +0000
════════════════════════
⌗ Tags: #Security #Cybersecurity #javascript #Novee Security #pretalx #Vulnerability #XSS #Zero Click
Hackread
Zero-Click pretalx XSS Flaw Lets Hackers Hijack Conference Organizer Accounts
pretalx XSS flaw lets attackers hijack conference organizer accounts, steal sessions, auto-accept talks, and demote admins. Patched in v2026.1.0.
23 views
Daily Writeups
⤷ Title: Shadow Infiltration: Google Discloses Critical Zero-Click Android Flaw
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Thu, 04 Jun 2026 03:44:58 +0000
════════════════════════
⌗ Tags: #Android #Vulnerability #Android Framework core vulnerability #AOSP exploit mitigation #CVE_2025_48595 Android zero day #June 2026 security bulletin #mobile device fleet security #zero click privilege escalation
Information Security News
CVE-2025-48595 Android Zero Day: June 2026 Patches
Analyze the critical CVE-2025-48595 Android zero day flaw. Learn how this zero-click privilege escalation bug affects core devices and how to fix it.
19 views
Daily Writeups
⤷ Title: Roundcube 1.7.2 Patches Zero-Click Stored XSS CVE-2026-54433
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Thu, 09 Jul 2026 15:00:45 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #CVE_2026_54432 #CVE_2026_54433 #Roundcube #Roundcube Webmail #ssrf #Stored XSS #Webmail Security #Zero_Click XSS
Daily CyberSecurity
Roundcube 1.7.2 Patches Zero-Click Stored XSS CVE-2026-54433
TL;DR Roundcube shipped versions 1.7.2 and 1.6.17 to fix six security bugs. The headline flaw is a Roundcube zero-click XSS, tracked as CVE-2026-54433, in plain-text message rendering. The update …
17 views
Daily Writeups
⤷ Title: Zero-Click File Drop Hits Xiaomi ShareMe: PoC Public
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Thu, 13 Aug 2026 12:44:09 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Android security #Bluetooth LE #MiDrop #ShareMe #Xiaomi #Zero_Click
Daily CyberSecurity
Zero-Click File Drop Hits Xiaomi ShareMe: PoC Public
TL;DR A researcher at ByteriaLab found a zero-click flaw in Xiaomi ShareMe, also shipped as MiDrop. An attacker within Bluetooth LE range can write arbitrary files to a victim’s phone the mo…
31 views
Daily Writeups
⤷ Title: Pegasus Spyware Hits Serbian Student Activist via Zero-Click iMessage
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Tue, 08 Sep 2026 02:56:43 +0000
════════════════════════
⌗ Tags: #Malware #Mercenary Spyware #NoviSpy #NSO Group #Pegasus #Pegasus spyware #Serbia #zero_click exploit
Daily CyberSecurity
Pegasus Spyware Hits Serbian Student Activist via Zero-Click iMessage
The Citizen Lab confirmed a Pegasus spyware infection on the iPhone of a Serbian student activist on September 2, 2026. The attack used a zero-click iMessage exploit, so it needed no clicks or tap…
44 views
Daily Writeups
⤷ Title: WeWorm: First Zero-Click Worm Spreads Through WeChat Calls on iOS and Android
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Tue, 08 Sep 2026 14:53:20 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Calif security #mobile RCE #Tencent patch #WeChat vulnerability #WeWorm #zero_click worm
Daily CyberSecurity
WeWorm: First Zero-Click Worm Spreads Through WeChat Calls on iOS and Android
TL;DR Security firm Calif built WeWorm, the first zero-click worm to propagate through WeChat voice calls on both iOS and Android. A single unanswered call can hijack the victim’s account wi…
19 views
Daily Writeups
⤷ Title: WeChat Zero-Click Worm Exposed in New Security Advisory
════════════════════════
𐀪 Author: Nam Phong
════════════════════════
ⴵ Time: Tue, 08 Sep 2026 17:00:04 +0000
════════════════════════
⌗ Tags: #Vulnerability #RCE #vulnerability #wechat #Worm #Zero_Click
Information Security News
WeChat Zero-Click Worm Exposed in New Security Advisory
Researchers at Calif developed the first zero-click worm for WeChat. This WeChat zero-click worm spreads through automated calls across iOS and Android platforms. Tencent has already mitigated thi…
41 views
Daily Writeups
⤷ Title: Plugin4Shell: Zero-Click RCE Hits Four AI Coding Agents
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Mon, 21 Sep 2026 01:00:00 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #AI Coding Agent #AI supply chain #Claude Code #Gemini CLI #Plugin4Shell #SHA pinning #Zero_Click RCE
Daily CyberSecurity
Plugin4Shell: Zero-Click RCE Hits Four AI Coding Agents
TL;DR AIR Security disclosed Plugin4Shell, a zero-click remote code execution flaw in four AI coding agents. The bug defeats SHA pinning, the check meant to lock a plugin to reviewed code. Claude …
38 views
Daily Writeups
⤷ Title: AI Vs AI (Part 2): EchoLeak
════════════════════════
𐀪 Author: Subodh K Phadnis
════════════════════════
ⴵ Time: Wed, 07 Oct 2026 09:47:13 GMT
════════════════════════
⌗ Tags: #zero_click #ai #infosec #cybersecurity #enterprise_security
Medium
🤖 AI Vs AI (Part 2): EchoLeak
When your AI assistant becomes an ‘insider threat’!
8 views
Daily Writeups
⤷ Title: 0-Click Account Takeover via Cookie Switching
════════════════════════
𐀪 Author: L4ZZ3RJ0D
════════════════════════
ⴵ Time: Tue, 13 Oct 2026 16:51:08 GMT
════════════════════════
⌗ Tags: #ctf #bug_bounty #zero_click_attack #infosec #account_takeover
Medium
0-Click Account Takeover via Cookie Switching
A router reseller running both a staging and a production environment, the kind of setup every company has somewhere, test build on one…
16 views
Daily Writeups
⤷ Title: AdFection Spyware Attack Targets Al Jazeera Devices
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Tue, 20 Oct 2026 06:25:13 +0000
════════════════════════
⌗ Tags: #Malware #ad tech #AdFection #Al Jazeera #Candiru #Citizen Lab #Discover_Tech #spyware #Zero_Click
Daily CyberSecurity
AdFection Spyware Attack Targets Al Jazeera Devices
Citizen Lab Exposes a New Ad-Based Attack The Citizen Lab at the University of Toronto has published a report on a new way to deliver commercial spyware through targeted advertising. Researchers n…
26 views