sy.br1d

security researcher |

[sy.br1d @rafabd1_]

I'd like to announce a new vulnerability chain we found that starts with an SVG parser bug. It affects multiple products and can lead to RCE.

I created https://t.co/3Tk4B6amtx to share more about the chain, which I'm calling "VectorFreed" for now.

I started looking into this early this month and have since confirmed command execution in several products that process SVGs. The root issue is CVE-2026-96889, with fixes in librsvg 2.63.2 and the 2.62.4 backport.

The repo has an early overview and references for now. I'll share the technical write-up in the coming weeks.

[sy.br1d @rafabd1_]

I'd like to announce a new vulnerability chain we found that starts with an SVG parser bug. It affects multiple products and can lead to RCE.

I created https://t.co/3Tk4B6amtx to share more about the chain, which I'm calling "VectorFreed" for now.

I started looking into this early this month and have since confirmed command execution in several products that process SVGs. The root issue is CVE-2026-96889, with fixes in librsvg 2.63.2 and the 2.62.4 backport.

The repo has an early overview and references for now. I'll share the technical write-up in the coming weeks.

[sy.br1d @rafabd1_]

@mastomii If the app is using multiple workers/replicas probably, here since I used just a simple process it ends up crashing inevitably

[sy.br1d @rafabd1_]

We recently found a new RCE chain affecting the Node.js ImageResponse implementation in Next.js.

Vercel has published CVE-2026-94545. Next.js versions from 16.2.0 through 16.3.5 are affected. Upgrade to Next.js 16.3.6.

I'll share more details soon, once the remaining upstream advisories are out!

Credit also to @ragrocks77, who discovered this together with me

Post: https://t.co/zX7dJ6WIoj

[sy.br1d @rafabd1_]

@SpiderMorpheus 🫡

[sy.br1d @rafabd1_]

@992vuln992 Not yet, probably next week

[sy.br1d @rafabd1_]

@kolovskydev Different rasterizers. Edge uses Resvg/WASM, while the Node path uses a different lib

[sy.br1d @rafabd1_]

@0xNatlas__ @isaacstffn rendimento do exterior, e no IR ele da pra importar os dados

[sy.br1d @rafabd1_]

@0xNatlas__ @isaacstffn eu fazia pelo Carnê Leão

[sy.br1d @rafabd1_]

@nectoor daqui uns dias vou poder divulgar

[sy.br1d @rafabd1_]

After heist, we are still free

[s1r1us @S1r1u5_]

i wouldn’t be surprised if other incredible researchers soon find vulnerabilities with similar impact.

[sy.br1d @rafabd1_]

@S1r1u5_ who knows

[sy.br1d @rafabd1_]

@reclameaqui1902 o meu foi num programa de terceiros, sem ser da Microsoft

[sy.br1d @rafabd1_]

primeiro LPE

quando der posto o PoC

[𝚎𝚌𝚑𝚎𝚕𝚘𝚗 @echel0n_1881]

when the AI provider does something similar: Look what did we do🤤🤤🤤🤤🤤
when some elite guys do it: 🤬🤬🤬🤬 youre being unprofessional🫪🫪🫪 stop 🤬🤬🤬🤬 youre violating my ego😭😭😭😭😭

[Hacktron AI @HacktronAI]

We are not stopping at OpenAI.

Today we’re publishing HEIF Heist, a months-long investigation by our security research team into vulnerabilities in libheif.

The research uncovered attack paths affecting OpenAI, Slack, Meta, GitHub Enterprise, Rails, Next.js, ImageMagick and others.

https://t.co/QXWulEXjJp

[sy.br1d @rafabd1_]

@JuninDaSEC e pior que vai ver o outro report as vezes nem chegou no impacto seu

[sy.br1d @rafabd1_]

eeu to bbem eu to mnuito bem nunc estiveve melhr]

[sy.br1d @rafabd1_]

@M4N03LL eu fico vendo as notificações a cada 10s

ai depois de 1 mês eles fecham como dup