Full Stack Developer at .HPO
Italia
Joined August 2010
- Tweets13.2K
- Following175
- Followers309
- Likes2.8K
Vincenzo Luongo retweeted
🚨 UPDATE: The Brotli flaw (CVE-2026-111497) goes beyond Node.js and web traffic.
• .NET: patched by Microsoft
• FFmpeg: hit via a crafted JPEG XL image
• ClickHouse: one request crashes it, fix not yet released
• Apache Arrow: no fix yet
Details ↓ thehackernews.com/2026/10/br…
Vincenzo Luongo retweeted
Vulnerabilidad HTTP2Shell afecta a .NET, FFmpeg, ClickHouse y Apache Arrow
La vulnerabilidad HTTP2Shell afecta a más que el tráfico web; nuevas investigaciones revelan que el fallo en el decodificador Brotli (CVE-2026-111497) puede comprometer aplicaciones .NET, el procesamiento de medios de FFmpeg, servidores ClickHouse y cargas de trabajo de Apache Arrow
blog.elhacker.net/2026/10/vu…
Vincenzo Luongo retweeted
🔥💀🧪📚 Moodle LMS Remote 0day! School’s in session and the gradebook still has secrets 🔥💀🧪📚
📓🔐✨
1️⃣ 🔥 High · Remote SQLi enrol_database still slashes and concatenates. auth_db already got a placeholder. An editing teacher sets course idnumber. Cron interpolates it into the external enrolment (sic) database.
github.com/abraxas/moodle-en…
abraxaslabs.tech/research/mo…
2️⃣ 💀 Medium · Remote file read Teacher Blackboard question import. img src is a path. The “image” is config.php copied into the draft area. Students cannot import.
github.com/abraxas/moodle-bl… abraxaslabs.tech/research/mo…
3️⃣ 👀 Medium · Remote IDOR Non-editing teacher. Separate groups. The grader UI learned groups. core_grades_get_feedback did not. Group A AJAX-reads Group B feedback plus email. Not a score write.
github.com/abraxas/moodle-gr…
abraxaslabs.tech/research/mo…
4️⃣ 🧪 Medium · Remote IDOR Enrolled student. The student UI hid the extra-credit item. The AJAX catalogue did not. Hidden names leak.
github.com/abraxas/moodle-gr… abraxaslabs.tech/research/mo…
📓🔐✨
🤖 Made with AI
Vincenzo Luongo retweeted
⚠🔴 New PoC for CVE-2026-109618 affecting ALL PHP VERSIONS, EVEN THOSE RECENTLY PATCHED
github.com/0x1c1101/CVE-2026…
Vincenzo Luongo retweeted
🚨 PHP2Shell attackers accessed MFA secrets and password hashes at a European government entity in just 2 hours.
That's not all.
→ Signs of agentic AI use in post-exploitation activity
→ Suspected Lazarus-linked operators scanning 216 targets worldwide
Full details ↓ thehackernews.com/2026/10/ph…
Vincenzo Luongo retweeted
Published our high fidelity scanner for node2shell: github.com/assetnote/node2sh…
Detection logic was written by @hash_kitten late last week. Open sourcing it to do public good in detecting this issue black box.
Vincenzo Luongo retweeted
HTTP2Shell(CVE-2026-111497)なかなかえぐいって・・
WAFが効かないしBrotli圧縮がかかっている受信リクエストやフェッチ応答やEnvoy Proxyとかが認証なしにリモートコード実行できるからクライアントもサーバも全部やん😂
パッチ出てるみたいやし、これは早めに当てておかないと・・
patchtheplanet.org/brotli
Vincenzo Luongo retweeted
PHP 8.4.27 released - 89 fixes in 30 components, including security fixes (CVE-2026-109618, CVE-2026-109619).
Changelog + downloads: php-net.pro/news/php-8-4-27-…
Vincenzo Luongo retweeted
The PHP project has released fixes for 2 critical vulnerabilities affecting servers that host PHP applications. Site owners and technical teams should confirm their hosting provider’s update plan and update PHP immediately. Versions before PHP 8.2 no longer receive security updates. These issues are not specific to WordPress, and no WordPress update is required. wp.me/pZhYe-5Gb
Vincenzo Luongo retweeted
WordPress 7.2 Beta 1 is ready for testing. It will bring responsive design controls, Notes improvements, faster media uploads, and a new Secrets API. Use a test site, not a production site, and report any issues. wp.me/pZhYe-5FP
Vincenzo Luongo retweeted
WordPress 7.1.3 is now available with 7 security fixes and 4 bug fixes. Update your sites immediately from the Dashboard, or download the release from WordPress.org. wp.me/pZhYe-5ER
Vincenzo Luongo retweeted
PoC:
[CVE-2026-63030/CVE-2026-60137] Pre Authentication RCE in WordPress Core 👾💥
- github.com/0xsha/wp2shell
- github.com/Icex0/wp2shell-po…
- github.com/sergiointel/wp2sh…
- slcyber.io/research-center/w…
- nvd.nist.gov/vuln/detail/CVE…
- nvd.nist.gov/vuln/detail/CVE…
Vincenzo Luongo retweeted
An XSS payload, Cuneiform-alphabet based. Bypass WAF
𒀀='',𒉺=!𒀀+𒀀,𒀃=!𒉺+𒀀,𒇺=𒀀+{},𒌐=𒉺[𒀀++],
𒀟=𒉺[𒈫=𒀀],𒀆=++𒈫+𒀀,𒁹=𒇺[𒈫+𒀆],𒉺[𒁹+=𒇺[𒀀]
+(𒉺.𒀃+𒇺)[𒀀]+𒀃[𒀆]+𒌐+𒀟+𒉺[𒈫]+𒁹+𒌐+𒇺[𒀀]
+𒀟][𒁹](𒀃[𒀀]+𒀃[𒈫]+𒉺[𒀆]+𒀟+𒌐+"(𒀀)")()
#bugbountytips #bugbountytip
Vincenzo Luongo retweeted
⚡ Attackers are exploiting WordPress CVE-2026-87902 within hours of disclosure.
The attacks use pearcmd.php to write attacker-controlled PHP files to disk, but only when specific theme and server conditions are met.
🔗 How the exploit works → thehackernews.com/2026/09/at…
Vincenzo Luongo retweeted
All WordPress users need to update their WordPress installations immediately 💯
There is a 9.2 CVE that discloses a remote code execution vulnerability that affects versions all the way back to 2016 😬
Here's the official notice github.com/WordPress/wordpre…
Vincenzo Luongo retweeted
10 repos de GitHub que parecen ''ilegales'' pero son perfectamente legales
1. yt-dlp → github.com/yt-dlp/yt-dlp
Descarga videos de cualquier plataforma. YouTube Premium cobra 16 dolares al mes por hacer menos
2. Ollama → github.com/ollama/ollama
Corre modelos de IA en tu laptop sin pagar APIs. Lo que a muchos les cuesta cientos al mes, aqui sale en 0
3. Fooocus → github.com/lllyasviel/Fooocu…
Genera imagenes con calidad tipo Midjourney en tu GPU. Midjourney cobra 30 dolares. Esto es ilimitado y gratis
4. Whisper → github.com/openai/whisper
Transcribe audio gratis en 99 idiomas. Otter cobra 20 dolares al mes por hacer lo mismo
5. Plausible → github.com/plausible/analyti…
La alternativa open source a Google Analytics. Empresas pagan miles al ano. Autoalojado cuesta 0
6. AppFlowy → github.com/AppFlowy-IO/AppFl…
El Notion open source. Notion cobra 20 dolares por usuario. Aqui tienes usuarios ilimitados en tu servidor
7. Penpot → github.com/penpot/penpot
La alternativa open source a Figma. Figma cobra 16 dolares por editor. Penpot es autoalojado y gratis
8. n8n → github.com/n8n-io/n8n
El Zapier open source. Zapier Pro puede costar cientos al mes. n8n corre automatizaciones ilimitadas
9. Cal .com → github.com/calcom/cal.com
La alternativa open source a Calendly. Calendly Teams cobra 16 dolares por usuario. Esto es gratis para uso personal
10. Bitwarden → github.com/bitwarden/server
La alternativa open source a 1Password. La mayoria cobra por usuario. Bitwarden tiene version gratuita muy completa
Todo legal. Todo gratis. Todo open source
Guardalos todos
Compartelo con esa persona que sigue pagando por herramientas que han sido gratis todo este tiempo
Vincenzo Luongo retweeted
New exploit: “xor dword [0xf80c2094], 1<<22”
Unlocks CPU microcode, the platform security processor, system management mode, and every internal processor register, all at once, on 100 million AMD CPUs. As far as I can tell can’t be fixed.
github.com/xoreaxeaxeax/skit…
Vincenzo Luongo retweeted
WordPress 7.0.4 is now available with an important security fix. Update your sites immediately from Dashboard → Updates or download the release. wp.me/pZhYe-5yH
