Marc Montpas

Software Entomologist focusing on dangerous species.

[lcamtuf @lcamtuf]

Frankly, I'm appalled by the prospect of LLMs taking offensive security research jobs from honest, hard-working fuzzers

[the tiny corp @__tinygrad__]

“Simplicity is a great virtue, but it requires hard work to achieve and education to appreciate. And to make matters worse, complexity sells better.” — Edsger Dijkstra

[LiveOverflow 🔴 @LiveOverflow]

What I’ve always found amazing about CTFs is that "flag is flag". Whether you found an unintentional solve or pwned the browser with n-day for a XSS challenge, it didn't matter.

I totally get the frustration of AI, but there is no solution other than accepting the change.

[Trail of Bits @trailofbits]

Probably not. Prompting an LLM with natural language is inherently lossy and ambiguous. Up to this point, programming has always been deterministic: Your code does what you say it should do otherwise, it’s a bug. Coding agents break that contract. https://t.co/gqsBV0nQBa

[Marc Montpas @marcS0H]

Guess it's that time of the year again. :-)

#aws #down #dns

https://t.co/lRudELsicQ

[Gynvael Coldwind @gynvael]

This looks nicely written: https://t.co/RcY87eZngD

[Oliver Sild @OliverSild]

It's so cool to see so many people participate in our #WCUS WordPress CTF. @marcS0H from @jetpack is currently leading the competition! 😎 You can see the live scoreboard here: https://t.co/rHwax8rPJQ

[WPScan - WordPress Security @_WPScan_]

Our researchers found a Pre-Auth Object Injection vulnerability in the SEOPress plugin (300k+ active installs). It was fixed in the recent 7.9 update. Make sure to update now! #wordpress #security

https://t.co/Mor1Qwvc0V

[Marc Montpas @marcS0H]

MOTD: Reinventing the wheel only works if it's circle-shaped.

(Love uncovering relatively uncommon antipatterns like this.)

#wordpress #security

[WPScan - WordPress Security @_WPScan_]

Our researchers found a Pre-Auth Object Injection vulnerability in the SEOPress plugin (300k+ active installs). It was fixed in the recent 7.9 update. Make sure to update now! #wordpress #security

https://t.co/Mor1Qwvc0V

[Charles Fol @cfreal_]

The first part of the blog series: #Iconv, set the charset to RCE. We'll use #PHP filters and #CVE-2024-2961 to get a very stable code execution exploit from a file read primitive. #cnext

[Sonar Research @Sonar_Research]

🔥Multiple XSS vulnerabilities in popular CMS Joomla! (CVE-2024-21726) 🔥

PHP bug could be used to bypass sanitization - We just disclosed the technical details behind the recent Joomla vulnerability:

https://t.co/9JVMjj5FO9

[Fio Cavallari 🍻👾🪓 @fiocavallari]

Automattic is expanding the Jetpack and WPScan Security Research team, if you like to break PHP code and investigate malware fill out the interest form here: https://t.co/WUqX2IyJNe

#hiring #wordpress #securityresearch #remotejobs

[Denis @unmaskparasites]

Balada Injector: analysis of the initial and secondary infections.
Domains: *.specialcraftbox[.]com and *.greenfastline[.]com (more in the post)
Vulnerable plugin: Popup Builder.
Thanks @marcs0h for the help with understanding the vuln

[WPScan - WordPress Security @_WPScan_]

Our researchers found a Pre-Auth Stored XSS vulnerability in the WP Go Maps plugin (formerly known as WP Google Maps, 400k+ active installs). It was fixed in the recent 9.0.28 update. Make sure to update now!

#wordpress #security

https://t.co/m0IWVsc7vs

[WPScan - WordPress Security @_WPScan_]

Our researchers found a Pre-Auth Stored XSS vulnerability in the Popup Builder plugin (200k+ active installs). It was fixed in the recent 4.2.3 update. Make sure to update now!

#wordpress #security

https://t.co/h9O5MSOHXP

[Ambionics Security @ambionics]

Learn about the two @Owncloud vulnerabilities CVE-2023-49103 and CVE-2023-49105 in our new blogpost: https://t.co/6fDfMLHYC9

[Charles Fol @cfreal_]

CVE-2023-49103: this analysis by @GreyNoiseIO is erroneous. The exploit WORKS with default configuration, even on docker installs. Please patch.

[Marc Montpas @marcS0H]

@FenriskSec Neat find!

[Fenrisk @FenriskSec]

Expecting to struggle finding a gadget chain in WordPress Core during an assessment when devs suddenly decided to make it easy : https://t.co/gJhHoktLtD

[WPScan - WordPress Security @_WPScan_]

Our researchers found a serious SQL Injection vulnerability in the WP Fastest Cache plugin. It was fixed in the recent 1.2.2 update. Make sure to update now!

https://t.co/Dk6m1ciEGd

#wordpress #security