Wendy

Passionate about life, people, and technologies.

[⁵⁄₉ @fiveoutofnine]

So basically, today PHP got two critical bugs that let anyone run code on your server without even logging in, which is bad, and then the details leaked before the patch was even out, which is worse, and it works on WordPress and MediaWiki and Magento and Joomla and Laravel, and Censys says like 1.5 million servers are running a version with no fix, so the NSA was like "take your system offline," and the FBI was like "take your system offline," and CISA and the UK and CERT-EU were all like "take your system offline," and then the Prime Minister of Japan, the actual Prime Minister, posted at 5:55 in the morning telling 48.8 million people to take their system offline, so everyone took their system offline, like the Dutch cybersecurity agency took its own website offline, and the Dutch parliament went offline, and the Port of Rotterdam went offline, and Finland and France and Denmark started pulling government sites, and Wikipedia went down, and https://t.co/QlOXb3COq3 went down, and Asana and GOG and Something Awful went down, and the University of Vienna's webmail went down for some reason, and that's just PHP. Because GitLab also dropped a CVSS 10.0, which is the highest score they give out, for a bug that's been there since 2014, so that's every self-hosted GitLab for twelve years, and then LiteLLM 1.107.0 got hijacked and shipped a credential stealer and a remote access trojan in every single wheel and the Docker images, including latest, and you didn't even have to import it, just installing it was enough, and it's the second time this year, and then Railway paused every deployment on the entire platform because someone got into the environment variables, so now everyone has to rotate every secret they've ever stored there, and TiDB Cloud said someone was walking around inside with stolen credentials for basically a month and an extortion group says they took 10.6 terabytes, and Zeabur got breached for the second time in two months and is just shutting down, like the whole company, and Node.js patched remote code execution and a TLS bypass, and CISA says Plex is being actively exploited, and someone took over 300 Tor exit relays to steal SSH passwords, and SafePay ransomware has hit over 600 critical infrastructure orgs, and India's biggest bank filed a data loss incident, and Japan has been in an official state of emergency in cyberspace since October 9, which honestly explains the 5:55 AM post. Oh, and eMudhra, a certificate authority that's issued over 60 million certificates, whose entire job is proving websites are who they say they are, was supposed to be using private keys that are random numbers over a hundred digits long, and one of them was 4. Just 4. And the others were like 66 and 237. Anyway, it's Wednesday.

[4nzn @paoloanzn]

we cracked it. the cch= signing system in claude code is fully reverse engineered - all credits for the work go to @ssslomp who did an amazing re work

now any opensource client can let users actually use the anthropic subscription they already paid for. with whatever tool they want

already merged into free-code. third party clients can generate valid cch= hashes now, no official binary needed

the "native attestation layer" lasted about a day lol

[chiefofautism @chiefofautism]

someone at ANTHROPIC just showed CLAUDE finding ZERO DAY vulnerabilities in a live conference demo

claude has found zero day in Ghost, 50,000 stars on github, never had a critical security vulnerability in its entire, history...

it found the blind SQL injection in 90 minutes, stole the admin api key, then did the exact, same thing to the linux kernel

[deadrosesxyz @deadrosesxyz]

im so excited to announce that this bounty was found using my own fine-tuned AI tool!

i only had to first understand the codebase, get a very good lead for the exploit, feed all of this to the AI, explain my entire thought process of the attack and the AI found it 🙏

[🇵🇸Ayaa Hamed @AyaaHam82030201]

Hi everyone,
I’ve just published the write-up. Hope it’s helpful and an interesting read.

https://t.co/fHjkGwtiKd

#BugBounty #bugbountytips

[payloadartist @payloadartist]

Pwning OpenAI Atlas Through Exposed Browser Internals ($5k #bugbounty)

Interesting find by @HacktronAI team

#bugbountytips #LLM #AI

[Alex Matrosov @matrosov]

With the recent Shai Hulud attacks, I’m getting more and more concerned about the state of software supply chain security. If we struggle to reliably detect backdoors in JavaScript/TypeScript, what does that say about compiled code, where everything is effectively a black box?

We were lucky to catch things like the XZ backdoor. How many similar issues are still out there, just not exposed?

Ken Thompson’s 1984 “Reflections on Trusting Trust” was already very clear about these gaps in our software supply chain thinking, and honestly, our mindset hasn’t shifted that much since then (source: https://t.co/6iiAqZXzpS).

More recently, Bert Hubert’s reflections on Thompson and Niklaus Wirth highlight a similar concern: growing software complexity and ever-faster shipping velocity, while “security” often gets reduced to a checklist instead of a continuous practice (source: https://t.co/Yn4nmfq7DH).

As an industry, we love new tools and shiny “next-gen” solutions. But if they’re all so good, why are software supply chain problems still growing exponentially?

[ProjectDiscovery @pdiscoveryio]

Reversing web CVEs isn't guesswork. It's process.

New blog: how we go from "vague advisory" → local lab → patch diff → safe Nuclei PoC, with concrete examples (Zimbra, Ivanti, Versa, Lucee).

Read the full methodology: https://t.co/Qfm0Uh8gQE

[沉浸式翻译 @immersivetran]

互联网最强物理老师——Bartosz Ciechanowski

你想知道“机械表”是怎么走的吗？“GPS”是怎么定位的吗？看文字解释可能会让你睡着。

但当你打开 Bartosz Ciechanowski 的个人博客时，你会跪着看完。他被誉为“互联网上解释万物最清晰的人”。

这个网站有什么特别厉害的地方？

他写的不是文章，是“程序”。当你阅读“声音”原理时，你可以拖动滑块改变��气波的密度；当你阅读“齿轮”时，你可以用鼠标去啮合它们。

他会把复杂的物理结构拆解成 3D 爆炸图，让你从内部看清每一个零件的运动逻辑。

这不仅是科普，这是工程美学的巅峰。配合沉浸式翻译阅读他那严谨的英文解说，你会获得一种打通任督二脉的快感。

准备好一个下午的时间，因为你一旦点进去，就出不来了。

🔗：https://t.co/ygKwMHAJBH

[Chris Thompson @retBandit]

🔥Fire research by the team! Great talk on compromising cloud AI providers via a GPU kernel 0day by Valentina Palmiotti (@chompie1337) & Samuel Lovejoy (@_dinolover38)

https://t.co/KvTHqJsYBJ

[Crusaders of Rust @cor_ctf]

Our @hexacon_fr talk is out on Youtube now😎

https://t.co/eN4vG4658d

Follow the slides at: https://t.co/UcfZIUHhsq

[Samuel Groß @5aelo]

I've uploaded the slides of my recent talk "JS Engine Security in 2025": https://t.co/1znTdICVmY. I think there'll also be a recording available at some point (otherwise I can make one as not everything's in the slides).

Thanks for the fantastic conference @POC_Crew!

[Stanislav Fort @stanislavfort]

We've found a high-severity zero-day vulnerability in Firefox using @WeAreAisle's autonomous AI security system. It's now going by the name of CVE-2025-13016.

If you're interested, here's my detailed technical blog post: https://t.co/o13azuTBw0

[Bour Abdelhadi @BourAbdelhadi]

Hey everyone! I’ve been building rep+, a lightweight HTTP Repeater inside Chrome DevTools. No proxy setup or certificates. Just open DevTools and start poking requests. It also has built-in AI for explanations and attack ideas. I’ll share one rep+ feature every day.
Try it 👇

[LuemmelSec @theluemmel]

Holy cow. I fixed an issue within #Rubeus where the salt was not extracted from the pA-ETYPE-INFO2 and subsequently failed.
Ran into this with a protected users user and a salt with upper and lower case somehow derived from the displayname ...
@harmj0y
https://t.co/nLpvU0xndc

[The Figen @TheFigen_]

Photographer Lena Ortiz captured this rare alignment.

[BSidesCanberra @BSidesCbr]

We’ve called in our backup speaker. Angus from InfoSect will be stepping in with: Walkthrough of an N-day Android GPU driver vulnerability

Angus will take us deep into ARM Mali GPU drivers, a kernel bug case study, and a proof-of-concept exploit demo.

https://t.co/xpiy8bmm5t

[CODE WHITE GmbH @codewhitesec]

We have reproduced "ToolShell", the unauthenticated exploit chain for CVE-2025-49706 + CVE-2025-49704 used by @_l0gg to pop SharePoint at #Pwn2Own Berlin 2025, it's really just one request! Kudos to @mwulftange

[Synacktiv @Synacktiv]

🚗🔌 We reverse engineered the Tesla Wall Connector and uncovered a previously undocumented attack surface via the charging cable. From protocol analysis to code execution, a Pwn2Own Automotive 2025 exploit write-up.
https://t.co/kUsIFaTcQr

[xvonfers @xvonfers]

CVE-2025-31205)[290992]Cross-site CSS rule and redirect URL disclosure is now open with PoC(was tested on Safari 18.4 by Ivan)
https://t.co/2KIHV6RErS

Repoted by Ivan Fratric(@ifsecure)