XBOW retweeted
A thread on how XBOW identified an unauthenticated, Critical-severity Remote Code Execution vulnerability in a public web application belonging to the U.S. Election Assistance Commission (@EACgov), the independent, bipartisan federal commission that focuses on election administration. 🧵
XBOW retweeted
This is the first blog post I’ve written since joining @Xbow.
This post covers a particularly interesting RCE found by XBOW in an EAC application, including the reasoning and validation process that led to the finding. Please check it out and let me know your thoughts!
Read the full details here: xbow.com/labs/research/how-x…
XBOW retweeted
The Libbrotli vulnerability allows you to exploit Wordpress through the /xmlrpc.php endpoint.
Patch now!
If you want to verify if you are vulnerable, @_remot3 did an amazing exploit for @XBOW
XBOW retweeted
For $50, anyone can rent a frontier AI model and start attacking a company. @Emerj talks with Sridhar Boddula, Head of Security Platform Eng. at @MassMutual, on #AIinBusiness. Sponsored by @XBOW zurl.co/ARbYO
XBOW retweeted
The danger of HTTP2Shell is very real. The libbrotli 🥦vulnerability affects a wide range of software, patch now (CVE-2026-111497)
We've achieved unauth RCE in Docker's official WordPress image abusing the well known /xmlrpc.php endpoint, we call it the pingback of hell :)
XBOW retweeted
- por qué tantas vulnerabilidades esta semana?
- pocos tuvieron acceso a mythos. en que es bueno y en que no?
- las noticias de agents hackeando: es marketing o real?
@fede_k de @Xbow te cuenta esto y mas en @radarlat, con @mgonto y @DAarambillet
youtube.com/watch?v=qcUY5GnW…
XBOW retweeted
The 4th annual Cyber 60 list is here.
This year’s list recognizes some of the fastest-growing venture-backed cybersecurity startups in the market, building to advance next-gen infrastructure, AI security, and how we approach threat detection.
Congratulations to everyone who made the #Cyber60 list in partnership with @FortuneMagazine and sponsor @AWSstartups.
Read our full CISO survey report, conducted with Wakefield Research, which polled 200 CISOs on enterprise AI and where they’ll invest next: lsvp.com/cyber60-2026-2027/
XBOW retweeted
Crashing the Crashpad talk is fascinating. I simply study further about the flow and details, this is quite fun and decent, making the object alive by uploading 512MB object slowly. Thank you so much.
@Xbow
@offensive_con
XBOW retweeted
PHP2Shell (CVE-2026-109618 / CVE-2026-109619) has caused a state of panic across the internet.
@Xbow has built the capability to identify vulnerable PHP versions and, where they are genuinely exploitable, demonstrate real code execution, proof, not theory.
Our offensive research team continues to expand coverage across common PHP versions and configurations.
But coverage is only part of the story: because no two targets are identical, our agents do not rely on a fixed list of known-good targets.
When they encounter a build or configuration they have not seen before, they can analyze it, work out the target-specific parameters a working exploit requires, and adapt the technique to that instance, in effect building the exploit for that target rather than replaying a canned one.
That means XBOW can validate real impact even on PHP instances that off-the-shelf tooling would simply mark "possibly vulnerable" and move on.
For immediate support, get in touch with our team below.
XBOW retweeted
DataTribe / Virtu Cyber Innovation Conference 2026 - DMV Rising - DataTribe Challenge kicked off with "Autonomous Offense: AI, Agentic Pen Testing, and the Race to Patch Faster" #Keynote by Nico Waisman (XBOW) #CIC2026 @DataTribe @Xbow @virtruprivacy
XBOW retweeted
This will be an interesting session!
We're doing an AMA on Reddit with @moyix!
Drop your questions in the reddit thread + he'll answer live tomorrow, Thursday, 10/22 from 12-1pm ET. 🤓
reddit.com/r/cybersecurity/s…
XBOW retweeted
The abundance of RCE in these days, remind me the 2000. Exploits were shared, traded but also kept private, some lived for years.
XBOW retweeted
🏆Huge congratulations to @Xbow on winning Top Infosec Innovators at Cyber Defense Con 2026! Your bold vision, relentless innovation, and game-changing impact are redefining cyber resilience. Truly well-deserved. The industry is stronger with you! #CDCon2026 #CDMAwards
XBOW retweeted
Looking for tips in building your hackbot? Catch this new episode of Offense Taken with @Jhaddix
What happens when autonomous agents start hacking for real?
@fede_k + @Jhaddix share their predictions in this episode of OFFENSE TAKEN 🔮
youtu.be/BfwYN-9_1KI?si=9HJM…
XBOW retweeted
Come train alongside your security peers at the SANS Institute AI Cybersecurity Summit. Our registrants are from banks, hospitals, utilities, manufacturers, technology companies and government agencies, and we're all back in boot camp!
These are people you can learn with, talk through a problem with, and call after the conference.
We’ve set aside two afternoons for six hands-on workshops. Pick two:
AI incident response:
Practice responding to compromised AI workloads with Steve de Vera (AWS) and Kyle Shields, CISM, GCIH, GCPN (AWS).
AI swarms:
Investigate intrusions involving multiple AI agents with @joswr1ght (CounterHack).
Offensive AI:
Use AI to exploit vulnerable applications with Andy Dennis and and William Reyor (@Xbow)
Delegating to agents:
Practice assigning security work to agents while retaining control with @lennyzeltser (SANS Institute).
AI pentesting:
Practice AI-assisted penetration testing with @pedramamini (OPSWAT) and Adrian Wood (Dropbox / BT6).
Autonomous DFIR:
Work with Caleb Evans (Airbyte) and Mulder, his winning Find Evil! incident-response agent.
Registration closes SOON for @SANSInstitute AI Cybersecurity Summit
See you in Arlington, VA (Select Summit talks are also available live online.) Registration includes virtual access to @unpromptedconf II
go.sans.org/YjGCXr
XBOW retweeted
Woot! the @unpromptedau talks are starting to coming come online! 👀
This one by @moyix was probably my favorite: 15mins of unadulterated old-school “I’m hacking this because I think I can” followed by a one-shot live exploit demo involving a t-shirt with a cat on it worn by @mdowd. Seriously just go watch it
(and subscribe for the others… More on the way!)
Watch Brendan Dolan-Gavitt: Security Through Obscurity Is Dead and LLMs Killed It unprompted.au/videos/securit…
![Security Through Obscurity Is Dead and LLMs Killed It · Brendan Dolan-Gavitt | [un]prompted.au 2026](https://pbs.twimg.com/card_img/2114970162625744896/VER_aD-r?format=jpg&name=800x419)
XBOW retweeted
We are always so grateful for our sponsor, @Xbow!
XBOW Built a Chrome Full-Chain Exploit Affecting a Billion Users in Six Days
XBOW researchers and GPT-5.6 Sol discovered and built a Chrome full-chain exploit in less than a week, showing how an attacker could use Chrome to remotely take over a Windows machine.
The breakthrough highlights how the cost and time of finding serious vulnerabilities are falling fast, for attackers and defenders alike.
Get details on the exploit and what it means.
xbow.com/blog/xbow-built-a-c…
