Lolagrey

Bug Bounty Hunter - Pentester.

[Cristian Borghello @SeguInfo]

Listo! Mañana se prende fuego el 70,2% de Internet.

Si usas #PHP, preparate, desde esta noche van a ser días largos.

Info y FAQ sobre CVE-2026-109618 y CVE-2026-109619 (en desarrollo)
https://t.co/9ARlhwqapH

[Kirill Firsov @k_firsov]

php2shell

Tomorrow is a helluva day.

[Calif @calif_io]

4/ APT stands for Apple Persistent Threat

[Calif @calif_io]

3/ Can your iPhone do this?

[Calif @calif_io]

Demos we presented at Hexacon in Paris today. Everything will be released in due time.

1/ Signal 1-click

[The XSS Rat - Proud XSS N00b :-) @theXSSrat]

WASM reversing only gets more relevant as more apps ship to the browser and the edge. Solid addition to the reversing series from @cocomelonckz

[H4x0r.DZ @h4x0r_dz]

Another day, another RCE in Next.js
https://t.co/pHXQ0Y9a54

[Pliny the Liberator 🐉󠅫󠄼󠄿󠅆󠄵󠄐󠅀󠄼󠄹󠄾󠅉󠅭 @elder_plinius]

🚰 SYSTEM PROMPT LEAK 🚰

Here's the full system prompt for Claude Opus-5.5!! The total count of everything extracted, including all tools, comes in at over 1.9M characters! 🤯

Lots to dig into here. Enjoy! 🫡

Link: https://t.co/GzISdXkbYq

gg

[Dark Web Intelligence @DailyDarkWeb]

🇨🇴 COLOMBIA TELMEX / MOVISTAR COLOMBIA INFRASTRUCTURE ATTACK CLAIM

A threat actor (TerroahGroup) claims a “full attack” against Colombia Telecomunicaciones SA ESP (Movistar Colombia) and Telebucaramanga, alleging exposure of admin pages, cookie sessions, IP addresses, router/hostname details, and cloud infrastructure hosted on Amazon USA servers (CloudFront, S3, certificates, and related configs).

The underground listing alleges compromised material including:
* Admin page access and cookie sessions
* Corporate and non-corporate IP addresses
* Network router information and hostnames
* Cloud infrastructure details (CloudFront, S3, certificates, https://t.co/nN0WQVVSf4 configs)

⚠️ Analyst Note:
Infrastructure dump claims often mix screenshots of public CDN/config surfaces with unverified access assertions. Whether Movistar Colombia / Telebucaramanga systems were actually breached, whether the claimed admin/session material is fresh or staged, and the real scope of exposed assets cannot be confirmed from the listing alone. Mentions of Amazon USA hosting describe cloud location for Colombian telco assets, not a US government or law-enforcement incident.

We assess this as an unverified threat-actor claim involving alleged Colombian telecommunications infrastructure access, NOT confirmation of a compromise of Movistar Colombia or Telebucaramanga systems.

If authentic, admin sessions and network/cloud config exposure could enable further intrusion, service disruption, or lateral movement against Colombian telecom customers and operators.

#DDW #DarkWeb #Colombia #Telmex #Movistar #Telecom #DataBreach #ThreatIntelligence #CyberSecurity

[Ing:\Juanita\ @ing_juani7a]

Otro día, otra brecha...

Un man en un foro q se hace llamar "Keishell" del grupo ZentinelTeam afirma haber comprometido dos cuentas de @PoliciaColombia , una con permisos elevados en el sistema de salud para gestionar medicamentos, resultados de laboratorio, citas y registros de pacientes, y otra para materiales de capacitación interna.

Ahora, no está confirmado aún, pero cuando el río suena...

[Ing:\Juanita\ @ing_juani7a]

Presuntamente alguien filtró el código fuente completo de Android de la app de banca móvil de @Davivienda: mmMódulos que cubren onboarding, inicio de sesión con PIN virtual/OTP, autenticación biométrica, actualización de perfil, préstamos de consumo, hipotecas, pagos, códigos QR y retiros sin tarjeta.

Veremos q tan cierto sea.

[International Cyber Digest @IntCyberDigest]

‼️ BREAKING: OpenAI was hacked by an Anthropic model. A HEIF photo uploaded to OpenAI's public support forum triggered a bug in the site's image decoder, led to code execution on the forum, and, through a second flaw in OpenAI's own login, ended with a pull request in OpenAI's internal GitHub.

The forum runs Discourse, the off-the-shelf software behind countless community sites. Discourse was still shipping an old copy of libheif, the library that decodes iPhone-style photos. The bug in it had already been fixed upstream.

But the fix was never labelled a security fix, so nobody treated it as urgent.

Hacktron's researchers uploaded a HEIF image and got their own code running on community[.]openai[.]com.

Then came the second bug, in OpenAI's own single sign-on, the "log in with OpenAI" button the forum uses. It turned that forum foothold into the actual ChatGPT and Codex accounts of people who had signed in there. OpenAI employees among them.

And a ChatGPT account is no longer just a chatbot. Through Codex, users wire in Gmail, Outlook, Drive, Slack, GitHub.

To prove the access was real, they used one employee account to have Codex open a harmless pull request in OpenAI's internal repo. They say they read no sensitive code.

OpenAI patched the SSO flaw roughly 14 hours after the report and paid a $6,500 bug bounty.

The team says Anthropic's Opus 4.8 found the libheif bug, and Opus 5 turned it into a working exploit.

Slack, Meta, GitHub Ent, Rails, Next.js, ImageMagick, and many more were also vulnerable and compromised by the same team of researchers.

[Rik Arends @rikarends]

51 million lines of code. Chromium codebase. Here you go. 120hz, 3gb ram use.

[0xSero @0xSero]

Deepseek-v4.1-flash reverse engineers anything I want it to.

[Kyle Wu @kyle_wu]

Just got a reward for a critical vulnerability submitted on @yeswehack -- Insecure Direct Object Reference (IDOR) (CWE-639). #YesWeRHackers

[HankAI @hank_aibtc]

卧槽，一个链接就能把网站子域名全查出来？我刚试完直的可以查出来。

不用装工具、不用写脚本，直接打开：

crt . name/v1/search?apex=你要查的域名

把后面换成 谷歌、淘宝 随便试，证书里出现过的子域名基本都能列出来。

原理就是公开的证书透明度日志，谁都能查，特别适合快速摸底一个站有哪些隐藏入口。

不需复杂设置，只要一个 URL。

[Zhongquan Li @Guluisacat]

iOS 27 App Sandbox Escape
Photos... App Containers

Submitted as a low impact bug a few days ago, but after
a closer review today escalated it to an app sandbox escape

[George adel @george_adel_1]

😂😂😂😂😂

[Ivan Castañeda @ivancastl]

Te gustaría espiar a ciberdelincuentes y descubrir cómo operan sus campañas maliciosas en sitios web usando bots de Telegram?

En este hilo veremos cómo, mediante OSINT y fuentes públicas, podemos encontrar rastros de bots, conversaciones, documentos y patrones relacionados con posibles fraudes.

Primero, vamos a buscar tokens de Telegram expuestos en sitios web maliciosos usando @urlscanio :

*domain:https://t.co/q0j7njyEFp

https://t.co/4vFq8EulVM

Damos clic en un sitio y luego vamos a → HTTP → Expand All → buscamos telegram y analizamos las llamadas a la API y posibles tokens expuestos.

También podemos revisar las herramientas de desarrollo del navegador para encontrar estas referencias.

🚨 Vamos al siguiente paso:

[TruthLover @0xtruthlover]

They triaged my finding and are currently fixing it—then called it out of scope for bounty rewards.
60k – yeah, sure!