#vulnerabilityresearch — Public Fediverse posts

🎙️ On the Nexus Podcast, Check Point Head of Agentic Security Innovation, Shahar Tal, discusses work he and researcher Yarden Porat presented at #BlackHat on vulnerabilities in popular #AI agent frameworks, including LangChain, LangGraph, CrewAI, AutoGen, Microsoft Agent Framework, and Google ADK.

The vulnerabilities are an indication that these frameworks require additional scrutiny from a security perspective given the trust AI agents are given to execute tasks.

🎧 Listen to the full episode: https://nexusconnect.io/podcasts/nexus-podcast-check-points-shahar-tal-on-exploiting-ai-agent-frameworks

#LangChain #LangGraph #CrewAI #AutoGen #MSAgent #GoogleADK #VulnerabilityResearch

I recently discovered a command injection vulnerability (CWE-78) from Info-ZIP (zip). Advisory: https://sintonen.fi/advisories/infozip-test-option-command-injection.txt

The fix is now available in #Debian as DSA 6439-1: https://lists.debian.org/debian-security-announce/2026/msg00350.html

Other platforms shipping zip command should also pick up the patch: https://sources.debian.org/data/main/z/zip/3.0-16/debian/patches/fix-command-injection.patch

NOTE: macOS included zip command is not affected.

#advisory #vulnerabilityresearch #cybersecurity #infosec

Another vulnchain discovered at WP Core.

By visiting a malicious web that has a XSS payload, an attacker can do RCE to a victim Wordpress site.

While this is not nasty as wp2shell, you should still update your WP Core.

Technical writeup:
https://pwn.ai/blog/xss2shell

#cybersecurity #infosec #wordpress #vulnerability #vulnerabilityresearch #xss2shell

Last night I "discovered" a vulnerability in a very widely used open-source tool. The tool is nearly 40 years old, and the vulnerability is at least 28 years old.

Interestingly, Apple has a fix included that dates it back to 2008, but it appears for whatever reason the fix never made it to upstream.

Result? Everyone else is vulnerable today. I am not pointing fingers here, but clearly something went wrong.

I've now reported the issue upstream, which will hopefully eventually lead to a fix being distributed to every affected platform.

I am not going to disclose the details of the vulnerability right now, even though the fix has been public for a very, very long time now. As far as I can tell, most Linux and BSD systems are vulnerable right now, so letting coordinated disclosure happen only makes sense.

#infosec #cybersecurity #vulnerabilityresearch

#HandsOnActivity
Adversary Village at @defcon 34!
Anto Joseph, Lead Product & Infrastructure Security at EigenLabs, is hosting “Breaching the Frontier: A Hands-On Lab on AI-Native Vulnerabilities” on 7 Aug 2026 at the Adversary Village Hands-on Activity Stage.
Adversary Village schedule:
https://adversaryvillage.org/adversary-events/DEFCON-34/
More info on the session: https://adversaryvillage.org/adversary-events/DEFCON-34/Anto-Joseph
#AdversaryVillage #DEFCON34
#HandsOnActivity #ArtificialIntelligence #AINativeSecurity
#VulnerabilityResearch #AdversaryTactics

So, more explanation of wp2shell recently just popped out.

The vulnerability were found by GPT 5.6 Sol. By using modified prompt from how it found the solution of Cycle Double Cover conjecture.

It was initially found a SQL Injection, but after asked again if it can be elevated to RCE, it confirms it in 4 hours.

Technical explanation on the vulnearbility also can be found in this writeup, have a good read fellas.

https://slcyber.io/research-center/exploit-brokers-pay-500000-for-a-wordpress-rce-i-found-one-with-gpt5-6/

#cybersecurity #infosec #security #wordpress #chatgpt #gptsol #wp2shell #airesearch #llm #vulnerability #vulnerabilityresearch

RE: https://infosec.exchange/@hnsec/116923239649243702

My #Semgrep C/C++ ruleset is ready for prime time again!

Grab it before our new robot overlords take over the field of #VulnerabilityResearch entirely 🤖

Our Technical Director @raptor just shipped v2.0.0 of his #Semgrep C/C++ ruleset — now officially included in the @semgrep registry.

Marco built this ruleset back in 2022 to speed up C/C++ #VulnerabilityResearch, and it's since become a go-to reference, featured in several guides and toolkits.

This release brings new detections, fewer false positives, and better performance, all put to the test on real-world source code and binary firmware.

https://hnsecurity.it/blog/my-semgrep-c-cpp-ruleset-is-ready-for-prime-time-again/

𝗛𝗼𝘄 𝗱𝗲𝗲𝗽 𝗰𝗮𝗻 𝘆𝗼𝘂𝗿 𝗵𝗲𝗮𝗽 𝗿𝗲𝗿𝗲𝗮𝗿𝗰𝗵 𝗴𝗼?
“Class teaches exploitation and gives exact, in‑depth heap knowledge. By far the best in‑person training I’ve done.”
Build a research‑first understanding, practise hands‑on manipulation (& 𝗠𝗲𝗺𝗼𝗿𝗶𝗴𝗮𝗺𝗶), detect and analyse corruptions, craft robust strategies and chain primitives into exploits. Applies to 32‑ and 64‑bit targets.

Seats limited: https://www.corelan-training.com

#CorelanHeap #HeapExploitation #VulnerabilityResearch

AI is changing vulnerability research and exploit development but it's only as effective as the expertise behind it.

Corelan training combines deep technical knowledge with practical AI-assisted workflows. Learn to analyze vulnerabilities, develop reliable exploits, improve your prompting, automate repetitive tasks, and validate every result with a rigorous methodology. AI doesn't replace expertise. It amplifies it.

https://bit.ly/corelan-training

#Corelan #VulnerabilityResearch #ExploitDev #AISkill

Remember the phpBB authentication bypass our research team found? We said the proof was coming. 💥 It's here.

Two working PoCs, one for each vulnerability, are now live in the research:

👉 PTT-2026-004 (CVE-2026-48611, 9.4): the PoC shows the full path from a single crafted request to a valid admin session. No credentials that work, no prior access, no user interaction. Just the request and the session cookie that _shouldn't_ exist.

👉 PTT-2026-005 (CVE-2026-48612, 8.3): the PoC walks through the silent OAuth account takeover, including the case where the victim only has to load a forum post for the chain to fire.

Talk is cheap in this line of work, so check out both PoCs, plus the mitigation steps: https://pentest-tools.com/research/phpbb-authentication-bypass

phpBB 3.3.17 fixes both. If you haven't patched, the PoCs are a good reason to move today.

#offensivesecurity #vulnerabilityresearch #infosec

Fileless RCE on stock Android (~2.5B devices). Reported to Google VRP, confirmed by their own engineering team, closed as NSBC anyway.

Full writeup:
https://www.researchgate.net/publication/407433163_Fileless_Code_Execution_via_Semantic_Gap_in_Android_WebView_Bridge_Architecture_A_Case_Study_in_Platform_Security_Boundary_Ambiguity

#AndroidSecurity #infosec #Android #MobileSecurity #VulnerabilityResearch #RCE #BugBounty #VRP #ResponsibleDisclosure #AppSec #ThreatIntel #WebView #ZeroDay #CVE

🚨 New Vulnerability Analysis: CVE-2026-47670 🚨

In my latest technical deep dive, I break down a critical authenticated Remote Code Execution (RCE) vulnerability in DbGate (v7.1.8). Discover why relying on pseudo-sandboxing like require = null fails inherently inside Node.js environments when confronted with native, unblockable dynamic import() constructs.

👉 https://denizhalil.com/2026/06/15/cve-2026-47670-dbgate-rce-bypass/

#Cybersecurity #Infosec #NodeJS #VulnerabilityResearch #ApplicationSecurity #RCE

FreeBSD 15.1-RC1 is out — and one detail stands out: the release notes mention AI-discovered security issues being patched.

AI-assisted fuzzing and vulnerability discovery is quietly becoming part of the release pipeline. Worth watching how this shifts the baseline for what gets caught before shipping.

#FreeBSD #infosec #VulnerabilityResearch
https://www.phoronix.com/news/FreeBSD-15.1-RC1

The Exploiting Reversing Series (ERS) currently features 945 pages of exploit development based on real-world targets:

[+] ERS 08: https://exploitreversing.com/2026/03/31/exploiting-reversing-er-series-article-08/
[+] ERS 07: https://exploitreversing.com/2026/03/04/exploiting-reversing-er-series-article-07/
[+] ERS 06: https://exploitreversing.com/2026/02/11/exploiting-reversing-er-series-article-06/
[+] ERS 05: https://exploitreversing.com/2025/03/12/exploiting-reversing-er-series-article-05/
[+] ERS 04: https://exploitreversing.com/2025/02/04/exploiting-reversing-er-series-article-04/
[+] ERS 03: https://exploitreversing.com/2025/01/22/exploiting-reversing-er-series-article-03/
[+] ERS 02: https://exploitreversing.com/2024/01/03/exploiting-reversing-er-series-article-02/
[+] ERS 01: https://exploitreversing.com/2023/04/11/exploiting-reversing-er-series/

In the coming weeks, I will publish new articles covering exploration in areas such as Windows, Chrome, iOS/macOS, and hypervisors.

I sincerely hope these articles help other professionals define their own steps in this area.

Have a great day and enjoy reading.

#exploit #exploitation #windows #chrome #macOS #iOS #hypervisors #vulnerabilityresearch

"It's just dev mode."

PTT-2025-028 / CVE-2026-30461 disagrees. Any authenticated user on a FuelCMS dev instance can drop a PHP shell via git submodule and call it from the browser. One HTTP request. Full RCE. CVSS 8.8 High.

No patch coming. Project's been dormant for almost 4 years.
Found by Raul Bledea and Matei "Mal" Bădănoiu.

Full PoC: https://pentest-tools.com/research

#offensivesecurity #vulnerabilityresearch

Keep clicking that "check for updates" button. The pressure is now higher than ever 👹

https://neilalexander.dev/2026/03/31/llms-vulnerability-disclosure

#vulnerabilityresearch #LLMs #llm

🏴‍☠️ Least privilege? FuelCMS didn't get the memo.

Any authenticated user (regardless of role) can call the Blocks module endpoint. Pair that with PTT-2025-026 and a low privilege (one could even say zero-permission) account becomes full RCE. CVSSv3 goes from 5.4 to 8.8 faster than you can say "access denied."

No patch. ~4 years of unmaintained software. You know the drill.

Matei "Mal" Bădănoiu and Raul Bledea found the gap. Full PoC can be found in our Offensive Security Research Hub: https://pentest-tools.com/research

#offensivesecurity #vulnerabilityresearch #infosec #RCE

"In a post-attention-scarcity world, successful exploit developers won’t carefully pick where to aim. They’ll just aim at everything. Operating systems. Databases. Routers. Printers. These kinds of targets run everywhere, including in every regional bank and hospital chain in North America. To patch them, someone has to get in a car, drive somewhere inconvenient, and push a physical button.

These weak points were priced into everyone’s cost of doing business. If a criminal exploits one, they win a ransomware heist. But lucrative as ransomware is, it’s not the jackpot earned from a reliable Chrome drive-by. So elite talent doesn’t bother. That load-bearing bit of risk analysis is built into every IT shop in North America. It no longer holds.

Now consider the poor open source developers who, for the last 18 months, have complained about a torrent of slop vulnerability reports. I’d had mixed sympathies, but the complaints were at least empirically correct. That could change real fast. The new models find real stuff. Forget the slop; will projects be able to keep up with a steady feed of verified, reproducible, reliably-exploitable sev:hi vulnerabilities? That’s what’s coming down the pipe.

Everything is up in the air. The industry is sold on memory-safe software, but the shift is slow going. We’ve bought time with sandboxing and attack surface restriction. How well will these countermeasures hold up? A 4 layer system of sandboxes, kernels, hypervisors, and IPC schemes are, to an agent, an iterated version of the same problem. Agents will generate full-chain exploits, and they will do so soon.

Meanwhile, no defense looks flimsier now than closed source code. Reversing was already mostly a speed-bump even for entry-level teams, who lift binaries into IR or decompile them all the way back to source."

https://sockpuppet.org/blog/2026/03/30/vulnerability-research-is-cooked/

#CyberSecurity #VulnerabilityResearch #AI #LLMs #VibeCoding #Programming #SoftwareDevelopment

#AIcodingagents will soon drastically change the landscape of #vulnerabilityresearch, making it easier to find high-impact vulnerabilities. This shift, driven by the capabilities of frontier models, will lead to a surge in #exploitablevulnerabilities, impacting everything from operating systems to IoT devices. https://sockpuppet.org/blog/2026/03/30/vulnerability-research-is-cooked/?eicker.news #tech #media #news