Hazard Researchers

[DEVCORE @d3vc0r3]

We took home Master of Pwn at #Pwn2Own Berlin 2026 with 50.5 points, pwning Microsoft Edge, Exchange, Windows 11, and SharePoint.

Edge was the only successful Browser entry, Exchange earned the highest single-target prize — and no memory bugs this time.

#P2OBerlin

[cts🌸 @gf_256]

Hi guys here is another Linux LPE for you to enjoy

[HADESS @Hadess_security]

Cloud Security Engineer is not "DevOps plus a firewall."

You write SCPs blocking rogue regions. You build Terraform modules with encryption guardrails. You hunt IMDS credential theft across 200 accounts.

$90K to $300K+. 33% growth through 2032.

https://t.co/bOO5uFfDfS

[HADESS @Hadess_security]

DevOps City

Your DevOps infrastructure is a city. Everything runs smooth until an incident hits.
You're the mayor. Find what broke, fix it.

This round: CI/CD pipeline security.
https://t.co/oAdA9g7edR

#game #devops #cicd #devsecops

[HADESS @Hadess_security]

The 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗔𝗻𝗮𝗹𝘆𝘀𝘁 career path requires more than 30 technical skills and more than 5 soft skills.
Launch Your Tech Career Today → https://t.co/M93OmX3cSo

#cybersecurity #infosec #securityanalyst #job #SOC #threatdetection #cybersecuritycareers

[Denis Laskov 🇮🇱 @it4sec]

Hacking Renesas chips for cars: three glitching resources to boost your success. 🚙⚡🫨🔬👨🏻‍💻

More details on:
LinkedIn: https://t.co/07EtcGaitv
Substack: https://t.co/wZ1qhzcHWv

[JFrog Security @JFrogSecurity]

⚡ Potentially Critical RCE Vulnerability in OpenSSL - CVE-2025-15467 ⚡

The JFrog Security Research team is tracking a newly disclosed OpenSSL stack overflow vulnerability rated as High by OpenSSL, that may lead to remote code execution (RCE). This vulnerability was patched with other 11 moderate and low severity vulnerabilities.

The stack overflow can be triggered by sending a crafted CMS AuthEnvelopedData message with malicious AEAD parameters. While no official CVSS score has been assigned yet, based on its characteristics, we assess it may be rated at least High or even Critical by NVD.

Our team reproduced the issue by invoking the CMS_decrypt API directly, confirming that OpenSSL applications parsing untrusted CMS data via this API are vulnerable. Exploitation is also possible when using the `openssl cms` CLI to decrypt untrusted input.

A contextual analysis scanner for this CVE is now available for JFrog Advanced Security customers:

[Security Bug Aggregator @BugsAggregator]

[453094710][reward: $250000] Out-of-bound read in the jmp table of ActiveMediaSessionController leads to sandbox escape.
https://t.co/ncXlTOVAOP

[Ryan Barnett (B0N3) @ryancbarnett]

We (@akamai_research) have seen more than 500K of these attack patterns in the past week with the most popular payload being:

[secret club @the_secret_club]

Hypervisors for Memory Introspection and Reverse Engineering by @memn0ps

https://t.co/yVi4yKE9ku

[Muqsit 𝕏 @mqst_]

🔀 Reversing for dummies - x86 assembly and C code (Beginner/ADHD friendly)

Blog: https://t.co/P9GFJIxDzk

#infosec

[Hazard Researchers @hazardres]

@codewhitesec Cool 😛 🔥

[CODE WHITE GmbH @codewhitesec]

Ever wondered how Kurts Maultaschenfabrikle got hacked in 2023? The full story, all technical details, out now ;-) https://t.co/8mO1EzGhUp

[Hazard Researchers @hazardres]

@mqst_ 🤠

[Muqsit 𝕏 @mqst_]

➰ Exploit Development: Fuzzing with AFL++ to Find Zero-Day Vulnerabilities

Blog: https://t.co/EPYGPsCMJE

#infosec

[silentwarble @silentwarble]

I wrote a C2 agent in pure PIC C (minus one constexpr). I'd love to hear any suggestions on how to handle memory management better or reduce the output size. Cheers! https://t.co/kBxidambs4

[Orange Tsai 🍊 @orange_8361]

Our talk at #BHEU is done! Hope you all enjoyed it. 😉 A detailed blog is on the way, but in the meantime, check out the pre-alpha website https://t.co/lGRfqhmcVK for early access and the slides!

Huge thanks to @BlackHatEvents and my awesome co-presenter @_splitline_! 🐈‍

[Vulmon Vulnerability Feed @VulmonFeeds]

CVE-2024-23780

CVE-2024-23780 Exploit for Netbox
This script exploits CVE-2024-23780, which allows remote code execution (RCE) on Netbox instances.
Usage
python netbox_exploit.py --url --username --password

https://t.co/NfcfsJmnHF

[Hazard Researchers @hazardres]

Unveiling CVE-2024-23780: Explore the Impact and Implications on NetBox's Security Landscape.
https://t.co/U7nFJQxYxs

POC: https://t.co/DrfaJOf5OJ

Fofa: https://t.co/rE3WlOlOYD

#netbox #security #network #devops #infrastructure #cve #exploit