makelaris

Building worlds where hackers play. 🏴
Head of CTFs @hackthebox_eu | Global cyber competitions + enterprise training | he/him

[makelaris @makelariss]

Who knew you could suffer eternal damnation by eating some space shrimps? 🦐 20 hours and counting ⏰.
You still have time to hack your way in at https://t.co/V2JOKI8lDK and claim the first🩸for my #Web challenge #ImageTok.

#HackTheBox #CyberSecurity #CyberSecurityTraining

[Xclow3n @xclow3n]

Spent a week testing AI for vulnerability research. 14 confirmed bugs in 20 min on one target. 5% hit rate on a hardened one. Same AI, same setup. 4 approaches, what worked, what failed, why target selection matters more than model sophistication. https://t.co/R5ofHyXQem

[Mr.Z @zux0x3a]

I am releasing a new toolkit I built for IIS-based lateral movement and code execution within IIS worker pool process's memory.

Phantom ASPX Loader & PhantomLink -- a two-part toolkit for reflectively loading native DLLs into IIS w3wp.exe worker processes via ASPX.
https://t.co/EevQysfANT

[Xclow3n @xclow3n]

Discovered 3 HTTP request smuggling vulnerabilities and 1 cache poisoning vulnerability in Cloudflare’s Pingora reverse proxy, all exploitable under the default configuration. These issues resulted in 2 Critical CVEs and 1 High-severity CVE.

https://t.co/jvvwexywg9

[pashov @pashov]

🚨Ethereum Developers: you can now install your first AI Auditor in 1 minute - fully autonomous, available 24/7, with multiple sub-agent helpers. Open Source.

FREE to use (with your AI model) and already finding vulnerabilities in smart contracts. Link below🫡

[Ruben Groenewoud @RFGroenewoud]

New blog: Hooked on Linux — Rootkit Taxonomy, Hooking Techniques and Tradecraft

Part 1 of our Linux rootkit series exploring kernel & userland rootkits and the hooking techniques they use (syscall/function hooks, ftrace, eBPF, inline patching).

🔗https://t.co/GIAK4a9v34

[Adnan Khan @adnanthekhan]

Turning Almost Nothing into a Supply Chain Compromise of Angular with GitHub Actions Cache Poisoning

https://t.co/jwatPVhujC

#BugBounty

[Tim Blazytko @mr_phrazer]

Recently my RE workflow moved into sandboxed VMs where agents have full control over the environment. I needed an MCP server that runs headless in the same sandbox and exposes way more of the #BinaryNinja API than others.

Here's the release: https://t.co/HU2Vf8Uj6T

[Jorian @J0R1AN]

WebSockets are not yet affected by Local Network Access permission in Chrome.
Check out this blog post from my colleague @GrumpinouT!
https://t.co/JGbv8zLa8S

[Devansh (⚡, 🥷) @0xAsm0d3us]

A bunch of security issues I reported to better-hub. Disclosing as these should have been fixed now.

Thanks for quick fixes @bekacru

[Icare @Icare1337]

Apache FOP + Ghostscript = 💥
Bypassed PostScript escaping using non-breaking spaces (\xa0) to inject commands. Chained with CVE-2025-46646 for Windows RCE. @truffzor
Apache won't fix it - just updating the docs 🤷
Full technical details @sigabrt9 https://t.co/iNjDmPLS13

[Devansh (⚡, 🥷) @0xAsm0d3us]

New write-up!

Bypassing egress filtering in BullFrog GitHub Action (using query pipelining feature of DNS over TCP)

(link in comment)

[Yotam Perkal @pyotam2]

We disclosed a critical unauthenticated RCE chain in mcp-atlassian (4M+ downloads).

CVE-2026-27826 - SSRF via Atlassian URL headers
CVE-2026-27825 - Arbitrary file write → RCE

Fixed in 0.17.0.

Full breakdown 👇
https://t.co/KtOql88nM8

[Devansh (⚡, 🥷) @0xAsm0d3us]

Second write-up of the day!

sudo restriction bypass via Docker Group in BullFrog GitHub Action

https://t.co/X9ux7s2NI7

[quarkslab @quarkslab]

Why macOS AVs shouldn’t trust PIDs 😄🍏 - new post by @Coiffeur0x90 Intego X9: XPC validation falls back to PID → PID reuse + posix_spawn() shenanigans 😏 ⇒ confused deputy / privileged methods abused 🤡🧨 Lesson: PID ≠ identity. https://t.co/kD1ju8eWNz

[Jorian @J0R1AN]

Just a few days later, there's the next blog post for @AikidoSecurity! Another framework-level vulnerability this time affecting Astro, resulting in SSRF if an unvalidated connection can be made to the webserver.
Read the details here:
https://t.co/hozRN3poJR

[shubs @infosec_au]

Sometimes you spot a sink and know it's vulnerable, but proving it is a challenge. @SLCyberSec's team broke through layers of crypto to reach a pre-auth deserialization sink in OpenText Directory Services. Breaking the encryption was a journey. https://t.co/f961ijdyPh

[RCE Security @rcesecurity]

Pwning TRUfusion Enterprise again: chaining a pre-auth SSRF (CVE-2025-32355), a default password, and a path traversal (CVE-2025-59793) to gain RCE.

#security

https://t.co/kkVDeAnTVi

[Devansh (⚡, 🥷) @0xAsm0d3us]

HonoJS JWT/JWKS Algorithm Confusion (CVEs pending)

https://t.co/odO3hHiGX6

[Martin Mielke @xct_de]

I was looking a bit onto why OPENROWSET is able to read privileged files (like the root flag on Signed @hackthebox_eu) when using Silver tickets on MSSQL. Turns out you can get SYSTEM access without potatoes by recovering the full token. https://t.co/cd47HQLXF0