Simple IDOR turned into an interesting question of "how do we find the IDs?" The answer: Continuously probe ObjectId()'s from MongoDB and search through the predictable gaps! Check out the full explanation & implementation below: www.aikido.dev/blog/predict...
Predicting MongoDB ObjectId() continuously in Rocket.Chat
Aikido's AI pentester found this file-access flaw in Rocket.Chat. A closer look at MongoDB's ObjectId() showed the weak randomness that makes it exploitable.
aikido.dev
It's friday so you know what that means, time for a critical vulnerability! Okay... we announced it 4 weeks ago already to be fair, but now we can talk about the technical parts ๐ Read how authentication could be bypassed on every online phpBB instance: www.aikido.dev/blog/authent...
Authentication Bypass in the default configuration phpBB
Our AI pentest agents found a critical phpBB auth bypass (CVE-2026-48611): one unauthenticated request logs you into any account. See the exploit and the fix.
aikido.dev
DevArea from HackTheBox features an Apache CXF file-read SSRF, a Hoverfly middleware command injection, a forged Flask session from a leaked secret, and a symlink-check bypass in a sudo script for root.
HTB: DevArea
DevArea hosts a freelance developer marketplace backed by several web applications on different stacks. Iโll find a JAR file on an open FTP server that matches one of the web services that uses a vulnerable version of Apache CXF. Iโll abuse its attachment handling to read arbitrary files off the host. Those files leak credentials for a Hoverfly API simulation instance, where a command injection in the middleware feature gives a shell as the first user. From there Iโll pivot through a custom SysWatch monitoring app, forging a session cookie with a secret pulled from a world-readable environment file and slipping a command past a weak input filter to run as the service account. Finally, Iโll exploit a flawed symlink check in a script that account runs as root to read the root login key and get a shell. In Beyond Root Iโll explore why I couldnโt read user.txt from the initial file read, and look at the admin password from the syswatch application.
0xdf.gitlab.io
Node.js is weighing a controversial proposal to move more security reports into public workflows as AI-generated submissions surge. Maintainers say ending bug bounty rewards didn't reduce the volume, and many reports remain duplicated or low-signal. socket.dev/blog/nodejs-... #nodejs #javascript
Node.js Considers Public Workflow for Security Reports Amid ...
Node.js is debating whether AI-driven security report volume warrants moving more vulnerability reports into public workflows.
socket.dev
Don't just say "find bugs". Assert the bug exists, e.g. this function has 3 vulnerabilities, find them, don't quit. Further reading:
Needle in the haystack: LLMs for vulnerability research
Table of Contents Intro Lore Why "Find All The Vulnerabilities" does not work Minimal Scaffolding That Actually Helps Case Study: Claude Opus 4...
devansh.bearblog.dev
I just did an interview with @mutantzombie.bsky.social with teasers for my upcoming #BHUSA presentation "Can AI Do Novel Vulnerability Research: Meet the HTTP Terminator", plus reflections on the Top Ten Web Hacking Techniques of 2025 & 2026. Watch it here: www.youtube.com/watch?v=fOWh...
Top 10 Web Hacking Techniques of 2025 and a Hint for 2026 - James Kettle - ASW #380
YouTube video by Security Weekly - A CRA Resource
youtube.com
We tested another mail client, Roundcube this time. The agents found a Stored Self-XSS vulnerability that could really only be exploited with Cookie Tossing. Scary for password reset tokens... Blog post below: www.aikido.dev/blog/roundcu...
Roundcube XSS chained with cookie tossing for full inbox access
We found a stored XSS in Roundcube's draft attachment endpoint that, chained with a cookie tossing technique, gives an attacker full access to a victim's inbox. Here's how the exploit chain works and ...
aikido.dev
We've launched a new free Web Security Academy topic on exploiting AI-powered security scanners! Learn how to use indirect prompt injection to steal data, cause damage & trigger exploit chains! Dive in here: portswigger.net/web-security...
AI-powered scanner vulnerabilities | Web Security Academy
Application security teams often deploy AI-powered scanners that use Large Language Models (LLMs) to scan web applications for vulnerabilities. While ...
portswigger.net
New blog post is out! A few vulnerabilities in Mailcow. A critical unauthenticated XSS, and another interesting Self-XSS escalation involving a Login CSRF with a leftover tab. Check it out: www.aikido.dev/blog/xss-vul...
Multiple XSS Vulnerabilities Found in Mailcow, Including Unauthenticated Account Takeover
Aikido's AI pentest agent found three XSS vulnerabilities in Mailcow, one of which let unauthenticated attackers take over administrator accounts. All issues have been patched as of version 2026-03b.
aikido.dev
Fun parser differential to fallback SVG sanitizer bypass: github.com/freescout-he...
Stored XSS through SVG file upload with filter bypass
### Summary Bypasses of the attachment view logic and SVG sanitizer make it possible to upload and render an SVG that runs malicious JavaScript. An extension of `.png` with content type of `imag...
github.com
When reviewing pull requests with new additions for CSPBypass.com, I often find myself questioning how useful a given entry actually is. If no websites whitelist a specific host, there is little point in adding it.
Last week, Syzik took my course and patched JWT ReAuth as the same time ๐คฏ Here's his fork github.com/Syzik/jwt-re... This version supports multiple profiles, per profile scopes, and the ability to fetch access tokens from refresh ones ๐ ๏ธ
GitHub - Syzik/jwt-reauth
Contribute to Syzik/jwt-reauth development by creating an account on GitHub.
github.com
New Claude found zero-day's in OpenBSD, ffmpeg, Linux and FreeBSD.
Claude Mythos Preview \ red.anthropic.com
red.anthropic.com
Noma Security researchers used indirect prompt injection to turn Grafana's own AI into an unwitting courier for sensitive corporate data cyberscoop.com/grafanaghost...
โGrafanaGhostโ bypasses Grafana's AI defenses without leaving a trace
Noma Security researchers disclosed GrafanaGhost, a Grafana vulnerability that uses indirect prompt injection to silently exfiltrate sensitive enterprise data โ bypassing AI guardrails without a login...
cyberscoop.com
Software supply chain attacks are on the rise. Learn how open source contributors can use what GitHub Actions is building to help protect projects and the broader software community. github.blog/news-insight...
What's coming to our GitHub Actions 2026 security roadmap
A look at GitHub Actionsโ 2026 roadmap, outlining how secure defaults, policy controls, and CI/CD observability harden the software supply chain end to end.
github.blog
Snapped from HackTheBox features CVE-2026-27944 to download and decrypt Nginx UI backups without auth, bcrypt cracking for a shell, and CVE-2026-3888 to exploit a snapd race condition for root.
HTB: Snapped
Snapped is a Linux box hosting a static site behind nginx, with an Nginx UI admin panel. Iโll exploit CVE-2026-27944 to decrypt a backup download from the Nginx UI to find bcrypt password hashes in a SQLite database. Iโll crack one to get SSH access. To escalate to root, Iโll exploit CVE-2026-3888, a recent vulnerability in snapd where systemd-tmpfiles deletes snap-confineโs private temp directory, allowing me to win a race condition and replace the dynamic linker with a malicious payload that runs as root.
0xdf.gitlab.io
My writeup for the "Secret Manager" challenge by zerodaygym (@yeswehack.bsky.social) ๐คซ cryptocat.me/blog/ctf/mon...
Argument Injection via Wildcard Expansion | YesWeHack Dojo 49: Secret Manager | CryptoCat's Blog
YesWeHack Dojo #49 writeup: exploiting wildcard argument injection in shell cp and grep commands to access internal secrets
cryptocat.me
The CVE Archeologistโs Field Guide is now on Storygraph for tracking and rating/reviews! Iโd definitely recommend it as a read for everyone โ honestly such a great read, full of useful info, and the information was packed into 106 pages of need-to-know without too much fluff. 10/10! ๐ฅ
WontFix can be an RCE Goldmine SOAPwn by chudyPB #5 in PortSwigger Web Hacking Techniques of 2025 Blog link ๐
SOAPwn: Pwning .NET Framework Applications Through HTTP Client Proxies And WSDL
Welcome back! As we near the end of 2025, we are, of course, waiting for the next round of SSLVPN exploitation to occur in January (as it did in 2024 and 2025). Weeeeeeeee. Before then, we want to clear the decks and see how much research we can publish. This
labs.watchtowr.com
A commit meant to "strengthen the crypto" in FreshRSS ended up removing the need for a correct password. Why? Longer SHA-256 nonce + bcrypt truncation at 72 bytes. A nice example of why secure systems are about composition, not just stronger primitives. pentesterlab.com/blog/freshrs...
How "Strengthening Crypto" Broke Authentication: FreshRSS and bcrypt's 72-Byte Limit
As part of our CVE monitoring, we came across GHSA-pcq9-mq6m-mvmp (CVE-2025-68402), an authentication bypass in FreshRSS, a self-hosted RSS aggregator. It ...
pentesterlab.com
โ๏ธโ๐ฅ ๐๐๐๐ต๐ฒ๐ป๐๐ถ๐ฐ๐ฎ๐๐ถ๐ผ๐ป ๐๐๐ฝ๐ฎ๐๐ ๐ถ๐ป ๐ฝ๐ฎ๐ฐ๐ฐ๐ท Another issue with a library leveragining JWT: www.codeant.ai/security-res....
CVE-2026-29000: Critical Auth Bypass in pac4j-jwt: Full PoC Using Only a Public Key
CodeAnt AI found a critical authentication bypass in pac4j-jwt where an attacker can impersonate any user using only the RSA public key. Full PoC and disclosure.
codeant.ai
Defuddle now has a website! This means you can use Defuddle anywhere to get the main content of a page in Markdown format. You can simply add "defuddle.md" before any URL, use it via curl, Skills, CLI, or add it to your app via NPM.
XSS on a password manager, about the scariest impact you can have... github.com/aliasvault/a... Luckily it was fixed super quick! Here's a simple script you can use to send raw HTML in emails. I think a lot more clients will benifit from sanitizer testing. gist.github.com/JorianWoltje...
Cross-Site Scripting (XSS) via Email HTML Rendering
## Impact A stored cross-site scripting (XSS) vulnerability was identified in the email rendering feature of AliasVault Web Client versions 0.25.3 and lower. When viewing received emails on an ali...
github.com
Inspired by one of @simonwillison.net 's reflections, I wrote a piece on the real cost of technical writing and documentation. passo.uno/real-cost-of...
The writing was always the cheap part
Last December, quite unrealistically, I took a solemn oath: I would not write again about AI for at least another year. I was growing tired with the incessant noise, the lack of stability, and the sel...
passo.uno
Vulnerability Spoiler Alert Action by @spaceraccoonsec It monitors repositories and uses Claude to detect patching of security vulns. This early warning can give security teams more time to patch before the CVE drops. GitHub repo๐
GitHub - spaceraccoon/vulnerability-spoiler-alert-action: GitHub Action to alert on security patches before the CVE drops.
GitHub Action to alert on security patches before the CVE drops. - spaceraccoon/vulnerability-spoiler-alert-action
github.com
In January, @anishathalye.bsky.social, @josejg.bsky.social, and I returned to @csail.mit.edu to teach Missing Semester, a class on topics we miss from most CS programsโtools and techniques that everyone should know, like Bash, Git, CI, and AI tools. Today, weโre releasing the course for free online!
![The Missing Semester of your CS education [MIT IAP 2026] - https://missing.csail.mit.edu](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:ksdsms3vq5jx3zzslkouevlp/bafkreighfwu5c3nnebavcur5n5xgr7etazrvuwnmjrydizxdq7u3hbmg7m)
Paged Out! #8 is out! pagedout.institute @pagedout.bsky.social In "An AWKward Modem" (p. 28), I show how to write a tiny modem in 5 lines of AWK and shift it into the near-ultrasonic range. ๐
