https://bsky.app/profile/javi.ka0labs.net

[Brendan Dolan-Gavitt @moyix]

Exim 4.99.3 is out, patching CVE-2026-45185, a critical RCE found by XBOW! Check out our post linked in the reply; I'll summarize some details in this thread.

[XBOW @Xbow]

“The vulnerability with the highest CVSS score in this month’s update is a critical remote code execution flaw in the Microsoft Devices Pricing Program. CVE-2026-21536 (CVSS score: 9.8), per Microsoft, has been fully mitigated [...] Artificial intelligence (AI)-powered autonomous vulnerability discovery platform XBOW has been credited with discovering and reporting the issue.” https://t.co/w9hhiuot2R

[XBOW @Xbow]

🚨 Critical SQL injection in Chef Automate (CVE-2025-8868)

If you're running Chef for infrastructure automation, patch immediately to version 4.13.295 or later.

Full technical breakdown: https://t.co/BtOAk40tVn

What XBOW found 🧵

[XBOW @Xbow]

Last chance to see XBOW’s demo at #BlackHat. (1/3)

Launch a comprehensive pentest in just 3 clicks.

Every finding comes with a proof-of-concept exploit.

[XBOW @Xbow]

First vulnerability of the day!
We’re at Black Hat, come meet the team.
📍 Booth 3257

[djurado @djurado9]

The new episode of @ctbbpodcast is out! Huge thanks to @Rhynorater and @rez0__ for having me. I had a great time chatting with you about XBOW and HackerOne’s Ambassador World Cup. It was a blast! 🫶🏼

[XBOW @Xbow]

XBOW pulled off the perfect digital heist: stealing files by hiding them in plain sight.

Disguised arbitrary file content as satellite imagery pixels. TiTiler processed the "images" while XBOW extracted secrets from the compression data.

Mission details: https://t.co/Eb5SYz6yul

[XBOW @Xbow]

⚡️XBOW found LFI where most tools would have given up.

Photo download endpoint blocked all path traversal attempts. But JavaScript analysis revealed /photo/proxy?url= - vulnerable to file:// scheme access.

Successfully read a password file via proxy endpoint.

Technical breakdown: https://t.co/BbxLxCCb63

[Oege de Moor @oegerikus]

Come and meet XBOW! Apart from the thing itself, also chat with some of the humans that are building it: @nicowaisman, @moyix, @pwntester, @niemand_sec, @djurado9, @ntrippar, @ca0s. I'd love to talk too!

[XBOW @Xbow]

What if two AI models could collaborate without knowing it?

Our Head of AI, Albert Ziegler developed "model alloys" - alternating between different LLMs in a single conversation. Sonnet handles some steps, Gemini others, but neither knows about the switch.

Result: 55% solve rate vs 40% with single models.

https://t.co/RbtfWo630q

[XBOW @Xbow]

When simple attack vectors fail, XBOW doesn't give up.

⚡️New discovery: Arbitrary file read in WordPress Ninja Tables plugin. Hidden in plain JavaScript sight, protected by nonce validation, but XBOW pieced together the exact request format needed.

Technical breakdown here: https://t.co/t4Z6NWRWuT

[XBOW @Xbow]

When standard SQL injection vectors fail, dig deeper.

⚡️New XBOW discovery: Z-Push vulnerability hidden in Basic Authentication username field. Response timing differences revealed PostgreSQL time-based injection where obvious targets were clean.

Full analysis: https://t.co/EvOT45rkHS

[XBOW @Xbow]

Sometimes the most illogical approach wins.

XBOW discovered XSS in Salesforce Aura by testing aura.format=JSON - which counterintuitively returns text/html content type instead of JSON.

The kind of discovery that comes from systematic testing without assumptions.

Full hunt analysis by @djurado9 https://t.co/hdfAvG3hp6

[XBOW @Xbow]

Even mature products hide critical flaws – and @XBOW just found another one.

CVE-2025-49493: XXE in Akamai CloudTest discovered during our climb to #1 on HackerOne.

A complete technical breakdown from an error-based detection to a full exfiltration by @djurado9

https://t.co/3CTRZ3wB5f

[XBOW @Xbow]

For the first time in history, the #1 hacker in the US is an AI.

(1/8)

[Bug Bounty Village @BugBountyDEFCON]

AI isn’t replacing bug bounty hunters anytime soon, but it’s getting surprisingly close.

In this DEF CON talk, Joel Noguera & Diego Jurado (@xbow) show how they built agents that exploit real-world XSS, JWT, and CSRF bugs autonomously

https://t.co/vHXnE1UmsW

#BugBounty #DEFCON

[XBOW @Xbow]

Just in time for the holidays: how XBOW found an arbitrary file download (CVE-2024-53982) in ZOO-Project, protecting Santa's critical geospatial processing infrastructure from attackers! https://t.co/ZcMvCKdzvy

[XBOW @Xbow]

While developing XBOW over the past three months, we played around with using it for bug bounties and ended up at #11 in the US on HackerOne:

[XBOW @Xbow]

Here’s the walkthrough: https://t.co/9YG1Lf9xk1

[XBOW @Xbow]

XBOW bypasses a MIME-type filter, abusing an OTP icon preview feature in 2FAuth to exploit an SSRF and discover CVE 2024-52598. Affected users should apply the patch and read about all the details in our blog post this Friday.