- Tricking Deepseek Into Not Hacking Your Website
238 points22 comments3 d ago
- I spent countless nights digging into PHP2Shell. Here's a deep dive into how it actually works, from memory to PHP internals to a real exploit.
When the PHP vulnerabilities were first announced, I spent a HUGE amount of time trying to figure out the logic behind them. As many others who tried investigating them probably noticed, there was...
203 points10 comments4 d ago
- IP snowshoeing under US .gov email via a whitelisted AmazonSES typo in SPF
I run a small email security consultancy and this is our research. A typo of AmazonSES in US government DNS whitelisted 32,066 IPs to pass DMARC p=quarantine as milivcounty\[.\]gov, with the IP...
159 points12 comments2 d ago
- unlocking any car from X brand in most of the world
99 points7 comments5 d ago
- Certificate authority list: every CA's incident record since 2017
CAs found 17% of their own incidents in 2026 so far, down from 29% last year and 59% in 2022. Researchers, root programs, and other outsiders found the rest. That's from a dataset we built of...
42 points5 comments2 d ago
- Forwarded Without Question: How Web Frameworks Overtrust the Forwarded Header
Many common web frameworks like Spring and Ruby on Rails trust the Forwarded header by default, even though most proxies don't actually have any support for it. This makes apps vulnerable to...
33 points2 comments6 d ago
- Barracuda Networks is your new best friend (Barracuda Email Security Gateway Pre-Auth Remote Root RCE CVE-2026-116606 / CVE-2026-111560) - watchTowr Labs
31 points1 comment6 d ago
- Electron, we have a problem
Electron, we have a problem. Many Electron apps auto-update without verifying signatures. Many also still trust the compromised eMudhra certificates. Together, that lets an attacker on your...
20 points0 comments2 d ago
- Pwning Home Assistant Green: Pre-Auth RCE in Eclipse Mosquitto
11 points1 comment3 d ago
- Who’s Trying to Get Into Our Fridge Freezer? There's nowt in it!
10 points1 comment6 d ago