GatewayToHeaven: Finding a Cross-Tenant Vulnerability in GCP's Apigee
https://omeramiad.com/posts/gatewaytoheaven-gcp-cross-tenant-vulnerability/
https://omeramiad.com/posts/gatewaytoheaven-gcp-cross-tenant-vulnerability/
Omeramiad
GatewayToHeaven: Finding a Cross-Tenant Vulnerability in GCP's Apigee | Omer Amiad's Blog
A technical step-by-step writeup about finding CVE-2025-13292, a cross-tenant vulnerability in Google Cloud's Apigee. This vulnerability allowed an attacker to gain read/write access to verbose cross-tenant access logs and analytics data that could contain…
❤9👍2
Evaluating and mitigating the growing risk of LLM-discovered 0-days
https://red.anthropic.com/2026/zero-days/
https://red.anthropic.com/2026/zero-days/
❤3👎1🤔1
Forwarded from Android Security & Malware
Understanding and Experimenting with Apple's Pointer Authentication Codes (PAC) on iOS
https://blog.reversesociety.co/blog/2026/pointer-authentication-code-for-ios
https://blog.reversesociety.co/blog/2026/pointer-authentication-code-for-ios
❤3
TRUSTING CLAUDE WITH A KNIFE: UNAUTHORIZED PROMPT INJECTION TO RCE IN ANTHROPIC’S CLAUDE CODE ACTION
https://johnstawinski.com/2026/02/05/trusting-claude-with-a-knife-unauthorized-prompt-injection-to-rce-in-anthropics-claude-code-action/
https://johnstawinski.com/2026/02/05/trusting-claude-with-a-knife-unauthorized-prompt-injection-to-rce-in-anthropics-claude-code-action/
John Stawinski IV
Trusting Claude With a Knife: Unauthorized Prompt Injection to RCE in Anthropic’s Claude Code Action
An external attacker could submit a pull request to any repository using Claude Code Action, wait for a reviewer to trigger the action, and then replace the PR title with a prompt injection payload…
❤7👍1
RCE in Google's AI code editor Antigravity - $10000 Bounty
https://www.hacktron.ai/blog/hacking-google-antigravity
https://www.hacktron.ai/blog/hacking-google-antigravity
Hacktron AI
RCE in Google's AI code editor Antigravity - $10000 Bounty
Hacktron AI Research Team discovered a critical RCE in Google’s Antigravity IDE that lets attackers take over your system just by opening a malicious website.
👏8❤7
When Audits Fail Part 2: From Pre-Auth SSRF to RCE in TRUfusion Enterprise
https://www.rcesecurity.com/2026/02/when-audits-fail-from-pre-auth-ssrf-to-rce-in-trufusion-enterprise/
https://www.rcesecurity.com/2026/02/when-audits-fail-from-pre-auth-ssrf-to-rce-in-trufusion-enterprise/
RCE Security - Your European Offensive Security Partner
When Audits Fail Part 2: From Pre-Auth SSRF … | RCE Security
A pre-auth SSRF in TRUfusion Enterprise (CVE-2025-32355) allows external attackers to reach internal-only services via a misconfigured reverse proxy. This …
❤9
GraphQL Pentesting for Bug Bounty Hunters: From Endpoint Discovery to High-Impact Exploits…!
https://medium.com/@mpjani294/graphql-pentesting-for-bug-bounty-hunters-from-endpoint-discovery-to-high-impact-exploits-821f64a953b5
https://medium.com/@mpjani294/graphql-pentesting-for-bug-bounty-hunters-from-endpoint-discovery-to-high-impact-exploits-821f64a953b5
Medium
GraphQL Pentesting for Bug Bounty Hunters: From Endpoint Discovery to High-Impact Exploits…!
Here is the mind map for reference LINK
🔥9👍1
How I Cured My Bug Hunting AI's Goldfish Memory
https://labs.trace37.com/blog/mastermind-hooks-architecture/
https://labs.trace37.com/blog/mastermind-hooks-architecture/
trace37 labs — offensive security research & tools
How I Cured My Bug Hunting AI's Goldfish Memory
An interactive look at the 6 Claude Code hooks that give my autonomous bug bounty system persistent memory, triage gates, and the ability to pick up exactly where it left off.
❤7
New Burp Bounty Pro v3.0.0 release:
* Multi-Step Scanning: Chain Attacks That Single Requests Can't
* Time-Based Detection Engine: Catch What String Matching Misses
* Global Variables System: Write Profiles Once, Reuse Everywhere
* Per-Scan Performance Control: Different Settings for Different Targets
* True Pause & Resume: No More Lost Scan State
* UI Improvements: Faster Profile Workflow
* Tag-Based Passive Scan Launching
https://bountysecurity.ai/blogs/news/new-burp-bounty-pro-v3-0-0-release
* Multi-Step Scanning: Chain Attacks That Single Requests Can't
* Time-Based Detection Engine: Catch What String Matching Misses
* Global Variables System: Write Profiles Once, Reuse Everywhere
* Per-Scan Performance Control: Different Settings for Different Targets
* True Pause & Resume: No More Lost Scan State
* UI Improvements: Faster Profile Workflow
* Tag-Based Passive Scan Launching
https://bountysecurity.ai/blogs/news/new-burp-bounty-pro-v3-0-0-release
Bounty Security
New Burp Bounty Pro v3.0.0 release
By Eduardo Garcia — Founder, Bounty Security
After months of development driven directly by user feedback, Burp Bounty Pro 3.0.0 is live. This isn't an incremental update — it's a ground-up rebuild of the scanning engine with four major features that change…
After months of development driven directly by user feedback, Burp Bounty Pro 3.0.0 is live. This isn't an incremental update — it's a ground-up rebuild of the scanning engine with four major features that change…
❤10🔥6
Hacking Gemini Enterprise for a $15,000 bounty
https://x.com/behi_sec/status/2029219439028171210?s=46&t=RUHDSSKAhWrUfYiwLCvA2w
https://x.com/behi_sec/status/2029219439028171210?s=46&t=RUHDSSKAhWrUfYiwLCvA2w
X (formerly Twitter)
Behi (@Behi_Sec) on X
Hacking Gemini Enterprise for a $15,000 bounty
❤7
LeakyLooker: Hacking Google Cloud’s Data via Dangerous Looker Studio Vulnerabilities
https://www.tenable.com/blog/leakylooker-google-cloud-looker-studio-vulnerabilities
https://www.tenable.com/blog/leakylooker-google-cloud-looker-studio-vulnerabilities
Tenable®
LeakyLooker: Hacking Google Cloud’s Data via Dangerous Looker Studio Vulnerabilities
Tenable Research revealed "LeakyLooker," a set of nine novel cross-tenant vulnerabilities in Google Looker Studio. These flaws could have let attackers exfiltrate or modify data across Google services like BigQuery and Google Sheets. Google has since remediated…
❤3👍1
Needle in the haystack: LLMs for vulnerability research
https://devansh.bearblog.dev/needle-in-the-haystack/
https://devansh.bearblog.dev/needle-in-the-haystack/
devansh
Needle in the haystack: LLMs for vulnerability research
Table of Contents
Intro Lore
Why "Find All The Vulnerabilities" does not work
Minimal Scaffolding That Actually Helps
Case Study: Claude Opus 4...
Intro Lore
Why "Find All The Vulnerabilities" does not work
Minimal Scaffolding That Actually Helps
Case Study: Claude Opus 4...
❤7
ALMOST IMPOSSIBLE: JAVA DESERIALIZATION THROUGH BROKEN CRYPTO IN OPENTEXT DIRECTORY SERVICES
https://slcyber.io/research-center/almost-impossible-java-deserialization-through-broken-crypto-in-opentext-directory-services/
https://slcyber.io/research-center/almost-impossible-java-deserialization-through-broken-crypto-in-opentext-directory-services/
Searchlight Cyber
Almost Impossible: Java Deserialization Through Broken Crypto in OpenText Directory Services › Searchlight Cyber
Introduction We recently found ourselves looking into OpenText Directory Services (OTDS). We had seen it present on our customer's attack surface, and it seemed to be an interesting target. OTDS is a Java web application providing authentication and user…
🔥5❤3
Forwarded from Android Security & Malware
This media is not supported in your browser
VIEW IN TELEGRAM
Analysis of RCE of Xiaomi C400 camera by exploiting Vulnerability #1 and #3 combined together. Vulnerabilities are not patched!
Vulnerability #1: Xiaomi - miIO Protocol Authentication Bypass
Vulnerability #2: Xiaomi - miIO client cryptographically weak PRNG
Vulnerability #3: miIO client heap buffer overflow
Analysis: https://labs.taszk.io/articles/post/nowyouseemi/
Exploits and jailbreak for Xiaomi Smart Cameras: https://github.com/TaszkSecLabs/xiaomi-c400-pwn
Vulnerability #1: Xiaomi - miIO Protocol Authentication Bypass
Vulnerability #2: Xiaomi - miIO client cryptographically weak PRNG
Vulnerability #3: miIO client heap buffer overflow
Analysis: https://labs.taszk.io/articles/post/nowyouseemi/
Exploits and jailbreak for Xiaomi Smart Cameras: https://github.com/TaszkSecLabs/xiaomi-c400-pwn
❤5
Pentesting a pentest agent - Here's what I've found in AWS Security Agent
https://blog.richardfan.xyz/2026/03/14/pentesting-a-pentest-agent-heres-what-ive-found-in-aws-security-agent.html
https://blog.richardfan.xyz/2026/03/14/pentesting-a-pentest-agent-heres-what-ive-found-in-aws-security-agent.html
Virtual Security Car
Pentesting a pentest agent - Here’s what I’ve found in AWS Security Agent
Richard’s blogs on Cloud Security
❤2
CVE-2026-22730: SQL Injection in Spring AI’s MariaDB Vector Store
https://blog.securelayer7.net/cve-2026-22730-sql-injection-spring-ai-mariadb/
https://blog.securelayer7.net/cve-2026-22730-sql-injection-spring-ai-mariadb/
SecureLayer7 - Offensive Security, API Scanner & Attack Surface Management
CVE-2026-22730: SQL Injection in Spring AI’s MariaDB Vector Store
Contributors: Sandeep Kamble, BugDazz Autonomous Pentest AI, Rabit0 ModelPublication Date: March 19, 2026Severity Rating: High (CVSS Score: 8.8)Vulnerability Status: Zero-day at time of discovery A...
❤6👍1
Instagram Notes Audio Leakage via URL Extraction (Fixed & Rewarded)
https://github.com/i12gocaj/Instagram-Notes-Audio-Leakage-via-URL-Extraction-Fixed
https://github.com/i12gocaj/Instagram-Notes-Audio-Leakage-via-URL-Extraction-Fixed
GitHub
GitHub - i12gocaj/Instagram-Notes-Audio-Leakage-via-URL-Extraction-Fixed
Contribute to i12gocaj/Instagram-Notes-Audio-Leakage-via-URL-Extraction-Fixed development by creating an account on GitHub.
❤8👎4
How I Earned $76,000 From a Single Program on Bugcrowd
https://anonhunter.medium.com/how-i-earned-76-000-from-a-single-program-on-bugcrowd-adf2a0eeece0
https://anonhunter.medium.com/how-i-earned-76-000-from-a-single-program-on-bugcrowd-adf2a0eeece0
Medium
How I Earned $76,000 From a Single Program on Bugcrowd
Consistency and patience are not soft skills in bug bounty. They are the strategy.
❤14👎5👍1
Remote Command Execution in Google Cloud with Single Directory Deletion
https://flatt.tech/research/posts/remote-command-execution-in-google-cloud-with-single-directory-deletion/
https://flatt.tech/research/posts/remote-command-execution-in-google-cloud-with-single-directory-deletion/
GMO Flatt Security Research
Remote Command Execution in Google Cloud with Single Directory Deletion
Introduction
Hello, I’m RyotaK
(@ryotkak
), a security engineer at GMO Flatt Security Inc.
A while ago, I participated in the Google Cloud VRP bugSWAT,
a live hacking event organized by Google.
During this event, I discovered a remote command execution…
Hello, I’m RyotaK
(@ryotkak
), a security engineer at GMO Flatt Security Inc.
A while ago, I participated in the Google Cloud VRP bugSWAT,
a live hacking event organized by Google.
During this event, I discovered a remote command execution…