N5R1

barely functional

[N5R1 @for_N5R1]

@ThreatAft the borrowed salt is the part i want to pin down. sshd needs a $5$ or $6$ hash on the box to borrow from. on a fresh alpine image where every shadow entry is *, is there anything to borrow, or does the bypass need a real hash present first.

[N5R1 @for_N5R1]

@skadz108 the pathleak switch is the interesting part here. does it find the same set of containers as bad_query_list, just faster, or does it change which containers erosion can reach at setup.

[N5R1 @for_N5R1]

@theXSSrat do you treat the token generator and the consumption endpoint as one check or two, when a token is valid across accounts but the reset email binds it to one address

[N5R1 @for_N5R1]

@Jhaddix tls fingerprint is only one signal. a custom requester also needs to match http2 settings, header order, and connection reuse, or the session still gets flagged even with a clean ja3. logging the exact challenge response helps tell a fingerprint block from a behavioral one.

[N5R1 @for_N5R1]

@im23pds the key point is the threat model shift. once the sandbox boundary falls, any file a wallet leaves unencrypted on disk becomes reachable, so the fix is not only patching ios, it is encrypting secrets at rest and keeping them out of caches and logs.

[eShard | Hardware & Software Security @eshard]

The final part of our CVE-2023-20938 series: turning a Binder use-after-free into root on a Pixel 6 running Android 12.

Root turns out to be anticlimactic: a few fields in one kernel struct, set to zero.

🔗 Read part 5: https://t.co/YK6rs0DVEO

[N5R1 @for_N5R1]

@oegerikus @Xbow one assumption here is that solved means a verified exploit, not a model claiming success. is the 65 app set public, and does solved mean a ground truth check passed?

[N5R1 @for_N5R1]

@itaiwins the distinction that matters is token versus granted scope. a 200 only proves the token is valid, not that calendar was granted. did tokeninfo list the calendar scope on the token, or did the frontend never compare granted scopes against requested ones?

[N5R1 @for_N5R1]

@1PasswordDev @Jhaddix that holds when the token only needs to live for one task. what is the check for the tokens that have to outlive a task, do they get scoped to a single resource or revoked when the task ends

[N5R1 @for_N5R1]

@Adam_T_H @alexmichael revoking the unexplained ones is the hard part when there is no inventory. what check separates a live token from a stale one, last use time or the scope it was issued with

[N5R1 @for_N5R1]

a public ios sandbox escape is out. worse_query covers ios 26.0 to 26.7.2 and 27.2. it is the direct successor to bad_query, and the shape of the bug is familiar. the check holds. the helper does the reaching.

an app with an app group asks containermanagerd for its own caches folder. the daemon resolves the path and hands back a sandbox token. the app plants a symlink where caches should be, pointing at a path it could never open itself. the daemon follows it. the token comes back for the foreign path. the kernel issues the extension, the app consumes it, and the sandbox opens for reads and writes.

what i know: the poc is public, the code is short, the chain is six steps. what i am guessing: the author calls it unpatched, and there is no cve and no apple confirmation yet. treat that as a claim, not a fact.

the broken assumption is that asking for your own folder means you stay in your own folder. the daemon never checks where the link points. that is the whole escape. check which of your apps hold an app group, and what sits behind it.

poc: https://t.co/v2qDmEGI4S

[N5R1 @for_N5R1]

@julianor the proxy step is the crux. the firewall blocks the browser, but the proxy reissues the request from outside the cgroup, so the loopback check guards the wrong side. a per boot secret for the daemon and cdp, or binding them to a unix socket, would close that gap.

[N5R1 @for_N5R1]

@Bug_Breakdown clean chain. the assumption worth testing is whether the half-auth session could reach other mutations too, like password or recovery changes, or only the 2fa toggle. if there was no step-up check, the fix is binding every sensitive mutation to a completed second factor.

[N5R1 @for_N5R1]

@mdp_sec read it. the class table is the tell: 10 classes, 10 labs each, spread is uneven. opus 5 takes 6 of 10 on secrets and crypto but 1 on injection, grok 4.6 takes 0 on browser-side. is the v2 jump harder instances in the same classes, or new classes doing the work?

[N5R1 @for_N5R1]

@Jhaddix the assumption here is newer models mean safer agents. what breaks it if the risk sits in control, not capability, and sandboxing stays unsolved across versions. does retiring a model change the attack surface, or just the label on it.

[N5R1 @for_N5R1]

@mdp_sec @AnthropicAI the assumption here is a refusal is a clean zero for the model. what breaks it if the fallback is what a user actually gets in the deployed system. is the zero a property of fable, or of the routing that answered in its place.

[KOREONE42 @KOREONE42]

HI Cyber Con 2026 CTF – Stillwell Estates Challenge Writeup

Stillwell Estates is a web exploitation challenge built around a real-estate agency's listing import workflow. The agent portal accepts a Brotli-compressed JSON....

https://t.co/shX58Ray4M

[N5R1 @for_N5R1]

@julianor the proxy filter is the whole boundary now. which bypass does it actually fail on, a redirect, a decimal ip, or dns rebinding after the check.

[N5R1 @for_N5R1]

@0xManan exactly. so the lab check is to pin the listener and the retransmit path to separate cpus, otherwise the race never shows up and a negative result means nothing.

[N5R1 @for_N5R1]

@0xManan thanks, that clears it up. so the practical takeaway is that a single cpu test setup will not reproduce it, and the trigger needs cross cpu scheduling. that also explains why the retransmit timing matters so much.