If iOS was a car, notifications would pop up in front of your brake pedal and steering wheel.

New blog post out on an authenticated SQLi I found and reported in FreePBX a couple months ago:

theyhack.me/CVE-2025-677...

💯

My team confirmed that recently disclosed Arista NGFW vulnerabilities are fully exploitable! RCE is possible with victim interaction. More details coming soon to our blog: bishopfox.com/blog

We now have a (draft) @metasploit-r7.bsky.social exploit module for the recent Fortinet FortiWeb vulns, chaining CVE-2025-64446 (auth bypass) + CVE-2025-58034 (command injection) to achieve unauthenticated RCE with root privileges: github.com/rapid7/metas...

Blog post for CVE-2025-64328 FreePBX Authenticated Command Injection has been released. It includes a nuclei template for detection.

theyhack.me/CVE-2025-643...

I have a close friend who spent the last 15 years as an ETL developer and whose department was recently laid off (jobs were outsourced). If anyone has or knows of any openings, this guy is intelligent, personable, and overall a great person, and I'd love to put you in touch.

Reposts appreciated!

📣THREAD: It’s surprising to me that so many people were surprised to learn that Signal runs partly on AWS (something we can do because we use encryption to make sure no one but you–not AWS, not Signal, not anyone–can access your comms).

It’s also concerning. 1/

📢 Confirmed! Sina Kheirkhah and McCaulay Hudson of Summoning Team used a pair of bugs to exploit of the Synology ActiveProtect Appliance DP320. That rounds their day off with another $50,000 and 5 more Master of Pwn points. (And clean that screen!) #Pwn2Own

I released the details of CVE-2025-34227, an authenticated command injection vulnerability I discovered and reported in Nagios XI.

theyhack.me/CVE-2025-342...

has anyone ever actually got any useful information from a company's "service status" page? I don't think I've ever once went to the page and found something degraded/offline when I was experiencing an issue, only to find someone on reddit/hackernews posted the same issue...

Another day, another Remote Code Execution (and its 3 friends).

Pre-auth path traversal, hard-coded crypto key allowing cookie forgery, arbitrary file write, and PII disclosure in TRUfusion Enterprise (CVE-2025-27222 to CVE-2025-27225) #security

www.rcesecurity.com/2025/09/when...

a5784ebd34c7f5117f7c846d1b31bcbdb1061b609327753613b49c341c1ab30b

CVE-2024-13986 has been assigned to two vulnerabilities in Nagios XI I found and reported last year that result in Remote Code Exection:
nvd.nist.gov/vuln/detail/...

Blog post and exploit I released on them here:
theyhack.me/Nagios-XI-Au...

Yup.

lol fr. I always see stuff like this in products and think of how hard companies try to make so much of tech seem like it's magic, and not just some HTTP request, probably to a spring boot API...

At worst, E̶x̶c̶e̶l regex is the second best tool for the job.

my favorite part of our med system is how a provider gets acquired/changes systems, and now I need to register on some new "portal" that was cloned from a random dashboard on github and rebranded, and then totally put all of my personal info in this one now.

news.ycombinator.com/item?id=4401...

IANA anything to do with this field, but there is some decent discussion on this study here.

That was a really fun read!

Heads up, I _think_ there are a couple typos in this line

> Just like that, we've seemingly replicated CVE-2025-4427 - but as always, we cant't help but wonder about t why this vulnerability works this way.

That one line issue with XXE, I seem to remember coming across something when I had the same issue where a Java version change causes newlines to throw an exception vs older java would just send them. I _think_ it was version 11, but google is not cooperating today.

I'm convinced some applications' defense is simply to load as many external resources as possible to deter attackers from looking through requests in burp.

Safe.eth on X: "Investigation Updates and Community Call to Action" / X Investigation Updates and Community Call to Action

New details on the ByBit/Safe{Wallet} breach, and uhhh wow, some really silly blunders on the DPRK side. They still succeeded which is the most upsetting part of all of this. Let's bully some threat actor tradecraft! A🧵
x.com/safe/status/...

jinja2.exceptions.UndefinedError: 'randstr' is undefined 👀 😅

It would be cool if with nuclei, you could select all templates that use a specific path. IE, if I could specify `~/nuclei-templates/http/exposed-panels/` and then run every template that is `{{baseURL}}` or every template that is `/admin` IE maximize matchers to requests ratio...

Yep.

Then I accidentally click one of the columns like `host` and it changes without me realizing it, then I go insane thinking burp is broken 😅

I kinda wish you could lock that somehow...

My role was just eliminated.

Exciting news! I’ve been accepted to speak at #RSAC 2025! I’ll be presenting “Critiquing Cloud Criminals: Ready for Smarter Cloud Attacks?”. We’ll critique the tradecraft and techniques of real world threat actors! It’s like a Gordon Ramsay cooking show, minus the accent and swearing! See you in SF!

client side 2fa 😅