Yusup Supriyanto

Nothing

[Anastasis Vasileiadis @Anastasis_King]

⚠️403 bypass tools for bug bounty hunters:

bypass-403 → https://t.co/1dBEOgxX9U
nomore403 → https://t.co/CUU7HjZaFo
4-ZERO-3 → https://t.co/NOonLi1FP1
byp4xx → https://t.co/ZrnUXo1epS
dontgo403 → https://t.co/910WB2npU9

[Yunus Emre Öztaş @ynsmroztas]

🚨 CVE-2026-44578 — Next.js WebSocket SSRF

Built a scanner + interactive exploit shell.
AWS credentials exfiltrated in 3 steps:

[1/3] Cloud auto-detect → AWS confirmed
[2/3] IAM role found: profile
[3/3] 🎯 AccessKeyId + SecretKey + Token

✅ Pipeline ready: subfinder | httpx | nextssrf
✅ Zero dependencies (stdlib only)
✅ Interactive shell with auto IAM chain

Affected: Next.js 13.4.13 → 15.5.15
Fixed: 15.5.16 / 16.2.5 (self-hosted only)

🔗 https://t.co/vLwbUYJ8Dz

#BugBounty #InfoSec #RedTeam #AppSec #bugbountytip #bugbountytips #infosec #recon

[Marouane Mouhtadi @Mar0_0uane]

During recent testing on a HubSpot-powered target, I needed a JSONP primitive to complete a DOM XSS chain.

One interesting behavior: HubSpot CMS exposes a built-in endpoint in this format:

`/_hcms/forms/embed/v3/form/{portalId}/{formId}?callback=alert`

Example :
`REDACTED. com/_hcms/forms/embed/v3/form/22544793/f411e5de-1b8b-4b19-8e6d-fe003d08cc8b?callback=alert`

It's a JSONP endpoint that wraps the response in whatever function name you pass. Just load it as <script src=...> and your callback fires.

The callback param has char restrictions so not every payload goes through, but alert() or prompt() works fine for proof. If you're hunting on any HubSpot site and just need that last JSONP piece for the chain, this is it.
#bugbounty

[SeQrity @seqrity9]

This is a simple regex generator to create GitHub dorks, inspired by @TakSec's project. You will be able to find subdomains, paths, URLs, and specific extensions on GitHub using these dorks. This page makes searching on GitHub easier.
https://t.co/EhnCpOO2GJ

[0xSabir @0xSabir]

403 Forbidden is just a challenge. Try /. or %2e to bypass the path filtering. The server wants to tell you its secrets.
Full automation with burpsuite ⬇️

[termireum @termireum]

23000$ for Authentication Bypass &amp; File Upload &amp; Arbitrary File Overwrite
https://t.co/u9diA6VRnt

[Michael Dalton @michaeldaltonau]

I'm excited to finally publish the writeup for my first @GoogleVRP vulnerability, leaking phone numbers and other sensitive information of Google Support customers (rewarded with a $14k bounty).
https://t.co/bhB2Y88q4D

[Yunus Emre Öztaş @ynsmroztas]

🚨 cPanelSniper — CVE-2026-41940

cPanel & WHM'de CVSS 10.0 kritik auth bypass.

CRLF injection → session file poisoning → root WHM access.

Zero creds. ~70M domain affected.

4-stage chain:

→ preauth session mint

→ CRLF inject via Authorization header

→ do_token_denied gadget (raw→cache flush)

→ /json-api/version → PWNED

✅ Interactive WHM shell

✅ Account enum · cmd exec · backdoor admin

✅ Bulk scan · pipeline ready · stdlib only

🔗 https://t.co/gmRA0xtEsx

#BugBounty #InfoSec #WHM #RedTeam #AppSec #bugbountytip #bugbountytips #infosec #recon

[The Hacker News @TheHackersNews]

⚠️ UPDATE: #cPanel flaw now tracked as CVE-2026-41940 (CVSS 9.8)—an auth bypass granting unauthenticated admin access.

Reportedly exploited as a 0-day, with activity observed for at least 30 days before disclosure. Root cause: CRLF injection enabling session forgery.

🔗 Exploit mechanics and real-world impact → https://t.co/8mHLoqywHY

[Dark Web Informer @DarkWebInformer]

‼️ watchTowr Labs released a write-up and detection script on the cPanel/WHM vulnerability.

GitHub: https://t.co/tA8E1hxSQF

Write-up: https://t.co/xKos4fPP15

[🕳 @sekurlsa_pw]

Nuclei template for detection
cPanel &amp; WHM - Authentication Bypass via Session-File CRLF Injection

nuclei -t http/cves/2026/CVE-2026-41940.yaml

Use -u &lt;target&gt;
-l &lt;target.list&gt;

https://t.co/GWpxCmzwsh

[shubs @infosec_au]

We've just released a high fidelity scanner for CVE-2026-41940 (cPanel/WHM authentication bypass). All public PoCs so far lead to false negatives, and are not reliable. @SLCyberSec's research team's notes on this here: https://t.co/7gik0IY4Cl &amp; tool here: https://t.co/RKoB6WaSQk

[International Cyber Digest @IntCyberDigest]

🚨 BREAKING: cPanel and WHM, the control panels behind an estimated 70+ million websites, have a critical security flaw that lets anyone become root admin without a password. CVE-2026-41940 affects every supported version. It’s already being exploited in the wild.

watchTowr Labs published the full attack today, after the hosting company KnownHost confirmed the bug was already being used to break into a significant chunk of the internet.

If you've never heard of cPanel: it's the dashboard that hosting providers and millions of website owners use to manage their servers, domains, email accounts, databases, and SSL certificates. WHM is the admin version that controls the entire server. If someone gets root access to WHM, they get the keys to the kingdom and to every apartment inside it.

How the attack works, in plain English:

🔴 Step 1: The attacker sends a deliberately wrong login. cPanel still creates a temporary "you tried to log in" record on disk and gives the attacker a cookie tied to it.
🔴 Step 2: The attacker tweaks the cookie to disable cPanel's password encryption. Normally cPanel encrypts the password field on disk. With one small change to the cookie, cPanel just stores it as plain text instead.
🔴 Step 3: The attacker sends a fake login attempt where the password field secretly contains hidden line breaks. cPanel does not strip these line breaks out, so they get written straight to the session file. Each line break creates a brand new fake record. The attacker uses this to inject lines that say "this user is root" and "this user already authenticated successfully."
🔴 Step 4: The attacker visits one more random page on the site to nudge cPanel into re-reading the file. cPanel then promotes the injected fake lines into its main session memory.
🔴 Step 5: On the next request, cPanel sees a flag that says "this user already passed the password check." cPanel trusts that flag, skips checking the actual password, and lets the attacker in as root.

From start to finish, the attack takes a handful of HTTP requests.

If you run cPanel or WHM, the patched versions are:

🔴 cPanel/WHM 110.0.x → 11.110.0.97
🔴 cPanel/WHM 118.0.x → 11.118.0.63
🔴 cPanel/WHM 126.0.x → 11.126.0.54
🔴 cPanel/WHM 132.0.x → 11.132.0.29
🔴 cPanel/WHM 134.0.x → 11.134.0.20
🔴 cPanel/WHM 136.0.x → 11.136.0.5

If your version is older than these, assume someone has already broken in and act accordingly. Patch right now, then rotate every password and key the server touched: root passwords, API tokens, SSL private keys, SSH keys, mail passwords, and database passwords.

[OmerAF @omer_asfu]

I achieved a cross-tenant #RCE in #GoogleCloud simply by abusing predictable bucket names. 🪣

In my latest research for @FocalSecurity, I look into "Bucket Squatting" - a cross-tenant attack that landed me 3 critical vulnerabilities in GCP.

Here is how it works:

[skull @brutecat]

My 2nd RCE in Google Cloud production (Borg) in less than 3 months...

I'm at $600k in total rewards from Google VRP in the past few months. Still can't believe it.

[Arour_mohamed @Arourmohamed01]

This extension got me bounty don't forget to install it
#bugbounty #hack #security

[cTino @tinopreter]

Q1 2026 was tough. $8,850 bounties mostly from access control vulnerabilities in APIs and caching issues.

I released 3 writeups through this:

$500 to $1,500 Email Verification Bypass: https://t.co/j2ZP873wiG

$1,500 GraphQL PII Leak: https://t.co/UvyClhILtA

[gara @anggarasamvdr]

nemu satu kata-kata cantik hari ini :

"Sometimes adulting itu belajar maafin orang yang bahkan ngga pernah bilang maaf."

Sekalipun nama gue pernah kotor dihadapan banyak orang, tapi gue gapernah mau hidup berdampingan dengan dendam dan ga pernah mau hidup dengan hati yang gak tenang.

[SuperSalL @ohmysal_]

dari pria untuk pria

1. jangan menormalisasikan laki laki tidak bercerita, cerita aja bebas.
2. kalau tidak ada tempat bercerita, ingat tuhan gak tidur, jadikan itu tempat untuk kamu mengadu.
3. ....

[HackingHub @hackinghub_io]

Your FFUF command isn’t returning anything useful, is it?

The problem usually isn’t the wordlist. You’re likely getting filtered or rate-limited.

Slow it down, control your rate, use realistic headers like a browser, and filter the noise so real endpoints stand out.

Try now 👇