Eugene M.

appsec/pentest engineer. identity platforms, access control, and whatever got marked 'vendor product, out of scope.'

[Eugene M. @jenistranger]

the scariest part of the carmaker ForgeRock research by @samwcyo and @infosec_au isn't the RCE. it's that none of it needed a ForgeRock 0-day. it came down to hardening the vendor had already documented.

[Eugene M. @jenistranger]

@theXSSrat nice one. a blind OOB variant would be a great add, that's the version people usually run into in real apps

[Eugene M. @jenistranger]

@NahamSec @nmatt0 curious how it holds up on stripped firmware with no symbols, that's where I'd expect the llms to start guessing

[Eugene M. @jenistranger]

@TheHackersNews the overwrite part is the scary half. anyone still pulling by tag instead of digest just runs whatever got pushed 😬

[Eugene M. @jenistranger]

@TheHackersNews CLFS again 😅 that driver keeps being the LPE gift that never stops. no patch + public code means detection is the only play for now

[Eugene M. @jenistranger]

@TheHackersNews 59 kernel bugs from one team is wild. curious how much of that came from AI-assisted fuzzing vs plain manual review

[Eugene M. @jenistranger]

codex-security by @OpenAIDevs shipped v0.10.0 with a --max-total-cost cap for batch runs. useful, since agent scans on a big repo get expensive fast.

the mode worth putting in CI is diff scanning (cs scan . --diff origin/main) with SARIF output.

https://t.co/1cz1Ld5ci3

[Eugene M. @jenistranger]

@Jhaddix @Xbow unauth RCE on an election commission app right after midterms is wild. curious if it was a known CVE or something the agents found from scratch

[Eugene M. @jenistranger]

@hakluke small single-purpose tools make so much sense for agents. curious how you handle scope though, hard block out-of-scope hosts in the tool wrapper or just trust the prompt?

[Eugene M. @jenistranger]

@TheHackersNews the chrome extension route is the sneaky one. a malware download at least has a shot at tripping EDR, a search hijacker just sits in the browser for months

[Eugene M. @jenistranger]

@TheHackersNews the console bypass worries me more than the 9.5 DoS tbh. the console manages your whole ADC fleet, so one auth bypass there is a lot of blast radius

[Eugene M. @jenistranger]

patched but still exploitable is the worst kind of advisory. if your N-central appliance faces the internet, put it behind a vpn/allowlist today and don't wait for the fixed fix. one RMM box = every customer network behind it.

[The Hacker News @TheHackersNews]

‼️ BREAKING: Recently patched N-central servers remain exploitable under certain conditions.

"4EverAble2Shell" enables unauthenticated root RCE; "Agent2Shell" can run Windows SYSTEM commands with the appliance ID.

Attackers are probing. N-able is investigating.

Details: https://t.co/t3tenC9MPi

[Eugene M. @jenistranger]

telegram opened HTML widgets to all bots on Nov 9. two days later researchers showed code execution on Android from a bot message via the widget JS engine.

a new parser in every chat is new attack surface. it's patched and widgets now run in an isolated process. update: 13.2.2.

[Eugene M. @jenistranger]

@TheHackersNews good to see tenant isolation on the list. shared GPU boxes are exactly where I'd start poking first

[Eugene M. @jenistranger]

@watchtowrcyber default config again 😬 netscaler memory bugs have a habit of going from advisory to mass exploitation in days, patch tonight not next sprint

[Eugene M. @jenistranger]

@TheHackersNews "patch blocks the exploit but not session hijacking" is the line that matters here. MSPs patching and calling it done are gonna have a bad time 😅

[Eugene M. @jenistranger]

@TheHackersNews approving the real MFA prompt doesn't help when the proxy just walks off with the session cookie. push MFA really isn't built for AiTM, passkeys are

[Eugene M. @jenistranger]

@theXSSrat and when introspection is off, the "did you mean..." field suggestions usually leak most of the schema anyway

[Eugene M. @jenistranger]

@UpwindMDR so presumably any page the user opens can poke the local api? endpoint agents trusting whatever talks to localhost never gets old

[Eugene M. @jenistranger]

@vxunderground heaven's gate in 2026 is a flex lol. curious if it drops the final payload entirely when it sees mssense or just switches the delivery path

[Eugene M. @jenistranger]

@TheHackersNews worth noting the PoC basically forges a call to an existing Server Action with your args, so how bad it gets depends on what actions the app ships. one more reason to treat actions as public endpoints