Codean

Ethical hackers rock and we think they do not get enough love (tool wise). So we are creating a tool for security analysts, by security analysts!

[Codean @CodeanIO]

More details soon! For now enjoy a good ol' calc

[b0n0b0 @b0n0b0__]

Hey there @HacktronAI, I see that you too are having fun looking at LibreOffice! Me and my colleagues at @CodeanIO also played with that quite a bit BTW, here's a new RCE that we just reported, enjoy!

[Codean @CodeanIO]

We released our latest blogpost covering the details of some bugs that @b0n0b0__ presented during Romhack Camp (hosted by @cybersaiyanIT). They'll publish the video of the talk and the slides, make sure to check all that out and stay tuned for part two!

https://t.co/5hU9JIKyDD

[Codean @CodeanIO]

Our team just released the PoCs for the 6 LibreOffice issues they identified! Go check that out, there's some quite some interesting stuff there, including our PoC for the RCE CVE we share with @v12sec!

[Thomas Rinsma @thomasrinsma]

Just released PoCs for the 6 LibreOffice bugs we found (@b0n0b0__ ). Including an .odb/.odt/.jar triple-polyglot for the RCE and my personal favorite, an LFI using GStreamer that leaks via RGB pixel values🙃

[b0n0b0 @b0n0b0__]

I'll be talking about some cool research me and my colleagues performed at @CodeanIO during romhack camp!
Thanks @cybersaiyanIT for having me, can't wait to be there with y'all!
See you there!

[Codean @CodeanIO]

We’ve just published a blog post with the full write-up for this issue, so be sure to check it out!

https://t.co/Jyy5c8PJNK

[Codean @CodeanIO]

We looked into Kdenlive and find out that opening someone else's project was not the best idea, since it could lead to Remote Code Execution. The vulnerability (CVE-2026-45184) has been patched in version 26.04.1, make sure to update and remember: do not trust FFmpeg parameters!

[Codean @CodeanIO]

We looked into Kdenlive and find out that opening someone else's project was not the best idea, since it could lead to Remote Code Execution. The vulnerability (CVE-2026-45184) has been patched in version 26.04.1, make sure to update and remember: do not trust FFmpeg parameters!

[Codean @CodeanIO]

https://t.co/W7392Pd2fH

[Codean @CodeanIO]

We took a good look into GNOME and general Linux desktop security. Our first findings are now public, including a full Flatpak sandbox escape. More coming soon :)

https://t.co/nCjXMBNGa8

[Codean @CodeanIO]

Two of our Codean Labs colleagues evaluated OpenPGP.js and identified a signature spoofing vulnerability. Writeup includes a PoC where we demonstrate the vulnerability by spoofing a message by the Dutch government's Cyber Security Center!
https://t.co/lkHRUU1sZc

[Codean @CodeanIO]

It's been four years already! Here’s to four more years of making the world more secure!
https://t.co/ugcIZ66vPn

[Codean @CodeanIO]

At Codean Labs, our mission is to make the world more secure — and what better way than to secure fundamental open source projects?

We identified CVE-2025-47934, a critical vulnerability in OpenPGP.js to spoof signatures, see https://t.co/qnxUn5nklf
https://t.co/qnxUn5nklf

[Doyensec @Doyensec]

🚨 Advisory Alert!🚨 We've just published our @drw0if's advisory regarding a heap overflow in @HAProxy as part of our coordinated disclosure process. Read all the details here: https://t.co/AUUnnt1kby

#doyensec #appsec #security #haproxy

[Codean @CodeanIO]

Codean Labs' @b0n0b0__ and @Doyensec's @drw0if discovered CVE-2025-32464, a heap-buffer overflow in HAProxy. Read our write-up here: https://t.co/kUoesl4xNl

[Codean @CodeanIO]

We discovered CVE-2024-12425 & CVE-2024-12426 which allow attackers to write files & extract sensitive data.

Check our blog post for the impact & how to protect yourself.
https://t.co/kkdoVhqixf

[Codean @CodeanIO]

We spent a lot of effort on improving the security of Ghostscript and this is our third and final blog post about everything we found.

Enjoy the read!
https://t.co/QzWDSdcII0

[Codean @CodeanIO]

We just reached over 1,000 commits on Codean 🎉

Just a few thousand more and I am sure Codean will be done by then 😉

[Codean @CodeanIO]

We are finally catching up on some basic capabilities everyone expects, but are still darn hard to get right!

Finally, landed on SCIP and SCIP indexers to have code intelligence that also enables us to create unique and cool features in the future. Stay tuned for more!

[Codean @CodeanIO]

Another day another high impact #CVE-2024-29511 on #Ghostscript ≤ 10.02.1. it leads to an arbitrary file read/write (under certain conditions) outside of the -dSAFER sandbox. You can find all details about this #vulnerability on our blogpost.

https://t.co/gOtxkdbLKD

[Codean @CodeanIO]

We found #CVE-2024-29510, a format string vulnerability in Ghostscript ≤ 10.03.0. It enables attackers to gain Remote Code Execution (#RCE) while also bypassing all sandbox protections. It has significant impact so please update Ghostscript!
https://t.co/6DxCfe3neU

[Codean @CodeanIO]

A public service announcement about #CVE-2024-4367 that we found in one of our pentests at Codean Labs. Make sure to update your #Firefox version to 126 and for #developers to update your PDF.js dependency. You can read our blog post for all details.
https://t.co/4hJ0kSh87r