Our security research team discovered a pre-authentication arbitrary file read as root in cPanel (CVE-2026-29205) — a path traversal in cpdavd that we made exploitable by abusing Dovecot's + alias handling to create attacker-controlled directory names on disk.
We've updated cpanel2shell-scanner to cover both issues. Writeup and tool in replies.
👇
Tomcat JMX Proxy exposed without auth?
Wrote a blog about how I got shell on a production Tomcat behind Cloudflare despite the deploy API being locked down, WAF blocking payloads, and CDN filtering template syntax.
8 dead ends. Then AccessLogValve + docBase + relaxedQueryChars + EL injection. 14 requests to RCE.
Tool + nuclei template included!
https://t.co/Ll5IkcnkDa
#bugbountytips #bugbounty
Vulnerability-spoiler-alert has detected its first two live “negative-days” in Grafana! CVE-2025-41117 (XSS) and CVE-2026-21722 (Privesc) are still unpublished right now, but is detectable via commits in the open-source repo. That’s at least 1 hour early. PoCs and more at https://t.co/Tom5BRqpKA
Voting is now live for the top ten web hacking techniques of 2025! Grab a coffee, browse the 61 quality nominations and cast your vote on the most creative and ground-breaking techniques:
https://t.co/srZ9GhJgSN
We've published a new blog post by RyotaK @ryotkak
He discovered 8 methods to bypass safety mechanisms in Claude Code, leading to arbitrary command execution.
We recommend updating to v1.0.93 or later to fix this vulnerability (CVE-2025-66032).
https://t.co/sNu7Z9QoXk
Sharing my Burp Extension that earned me $200k in 2025 while API testing heavy JS-rich targets.
https://t.co/2ttRurgoPh
The tool helps find endpoints, files, internal emails, and some secrets from minified JS.
Its goal is to achieve maximum efficiency with reduced noise in results. Contributions and feedbacks are welcome.