%xx

bughunter | looking forward to bug bounty collaboration

[Lyrie.ai @lyrie_ai]

Full Tweet
Zoom has released updates for a critical Windows desktop client vulnerability, tracked as CVE-2026-53412, that could allow unauthenticated attackers to remotely take over user accounts.

[pwn.ai @pwn_ai]

🚨 ZERODAY: ImageMagick 🚨

Our autonomous pentester https://t.co/zHUcIkHqvr just dropped multiple zeroday chains in ImageMagick that achieve RCE and File Leak from a single .jpg or .pdf file, bypassing EVERY security policy (Default, Limited, AND Secure). 🤯

💥 Affects Ubuntu, Debian, WordPress & millions of servers globally. Happy Monday and Happy Hunting! 🥰

https://t.co/nNAvFAvPOx

[Behi @Behi_Sec]

I really enjoyed reading this writeup.

It's very cool to see how very small findings could be chained to achieve a critical impact.

https://t.co/OKxiXF1q0i

[Behi @Behi_Sec]

Good read:

https://t.co/wzF27CJplM

[QM @qasimmith]

Today, @washingtonpost covered critical vulnerabilities @depthfirstlabs found in TikTok. These vulnerabilities allowed hackers to access anything on a user’s device that TikTok itself could access, including the camera, microphone, payment information, photos, and the user’s entire TikTok account.

Read more in the thread 🧵

[s1r1us @S1r1u5_]

At a high level, this was the full exploit chain.

1. HEIC/HEIF upload
2. ImageMagick decoding
3. Heap overflow on libheif
4. RCE on https://t.co/gxAS3NLZ3q
5. Critical OpenAI SSO flaw
6. ChatGPT/Codex takeover
7. Connected GitHub access
8. Internal repo PR #1186742

[%xx @Alex51364708]

@ellivx512 Which CVE are you using? Did you escape the V8 sandbox?

[I'M H4CK3R 42 @luckyhacker43]

[8.8] CVE-2026-22812: OpenCode RCE

Unauthenticated HTTP server exposes /session/:id/shell, /pty, /file/content. Permissive CORS allows arbitrary command execution.

Dark Exploit found it.

Fix: Update to v1.0.216+

🔗 https://t.co/7dOVYmC398

---

🔗 https://t.co/pJWHoCMDix

[%xx @Alex51364708]

@silentgh00st Can the licensed domain be changed?

[Critical Thinking - Bug Bounty Podcast @ctbbpodcast]

Running a Figma plugin is enough to land cross-platform zero-click RCE on Figma Desktop...

Read the writeup on the Critical Research Lab https://t.co/16w1iiWEmF

And thanks @Dav3nn for the incredible post, what an amazing chain! =)

[trace37 @trace37_labs]

I'm pleased to share that CVE-2026-41238 has been assigned to a Prototype Pollution >> XSS vulnerability I identified in DOMPurify, affecting versions 3.0.1 through 3.3.3.

If your web application renders user-supplied HTML, there's a very good chance it relies on DOMPurify.

With 24m downloads per week, it's the de facto HTML sanitiser for the JavaScript ecosystem — used across React, Vue, Angular and Node.js applications.

Only 10 prior CVEs across 7 years speaks to the quality of the library and the rigour of its maintainers at Cure53.

The issue was patched in version 3.4.0.

Coordinated disclosure handled through Cure53 — thanks to the team for a smooth process.

Full technical writeup and GHSA below.

Write-up
https://t.co/xUcDvy2DKV

GHSA
https://t.co/wtkOKkeLY7

[Sam Stepanyan @securestep9]

#Antgravity - an AI code editor from Google that has access to your entire codebase and terminal had a Remote Code Execution (#RCE) vulnerability - a great find and write-up by @HacktronAI earning them $10k #BugBounty!
#BugBountyTips
👇

https://t.co/L6KXzmTlBu

[shubs @infosec_au]

@assetnote @SLCyberSec My work on the novel SSRF technique that landed a critical payout at a Live Hacking Event: https://t.co/CTSTEtKiD1

[3NVZ | Robert S. @YourFinalSin]

For anyone interested in Desktop Application Hacking - I found this talk to be a nice introduction:

https://t.co/OvybLdBQAU

[Youssef Sammouda (sam0) @samm0uda]

$312,500 worth of stored/reflected XSS vulnerabilities in Meta’s Conversions API Gateway allowed Javascript code to run on any Facebook domain and millions of third-party websites. The flaw enabled zero-click Facebook account takeover and more:

https://t.co/7gWpR4LQ8x

[Sam Curry @samwcyo]

Had some recent success using untranslatable Unicode in place of a "?" when attacking URL parsers for SSRF/OAuth issues.

What worked was...
\udfff -> � -> ?

Therefore...
{"redirectUri":"https://attacker\udfff@[victim]/"}

Equals...
Location: https://attacker?@[victim]/

[%xx @Alex51364708]

@ProtonSupport Hi team,I have sent you a DM, but also no response.

[ZoomEye @zoomeye_team]

🚨🚨CVE-2025-55182 (CVSS 10.0): RCE in React Server Components
A decoding bug in React Server Function payloads enables full unauthenticated RCE on vulnerable RSC backends.
🔥PoC: https://t.co/ZsTgkRqiHH

Search by vul.cve Filter👉vul.cve="CVE-2025-55182"
ZoomEye Dork👉http.body="react.production.min.js" || http.body="React.createElement(" || app="React Router" || app="React.js"
3.1M+ exposed React targets.
ZoomEye Link: https://t.co/evM9m7xxl0

Refer:
1. https://t.co/ypCp3ghocv
2. https://t.co/CbGYXnMWpR

#RCE #ZoomEye #cybersecurity #infosec #OSINT

[Nowasky @nowaskyjr]

Inside <svg><script>, only child text nodes become JS code, while comments or SVG elements are dropped.

So <//…> (a bogus comment) lets you sneak comment-looking sequences into executable JS.

https://t.co/PKDT0U9f4w

#xss