I share bug bounty insights to the bug bounty community
Joined November 2022
- Tweets500
- Following29
- Followers5.9K
- Likes719
CyberSecurity Insights 🪄 retweeted
I found this interesting "403 Forbidden" Bypass; through "Microsoft-Azure-Application-Gateway/v2"
1. Accessing the URL returns "403 Forbidden"
2. Appending the query "?x=.js", successfully bypasses the Azure restriction leading to direct access to the restricted resource.
CyberSecurity Insights 🪄 retweeted
🚨 PoC RELEASED: Telegram Desktop one-click account takeover (CVE-2026-107181)
A researcher has published a full technical write-up and proof of concept for a flaw in Telegram Desktop before 7.2.9.
🔴 CVSS 4.0: 8.6 High (CVSS 3.1: 8.1), scored by VulnCheck
🎯 Root cause (CWE-143): Telegram Desktop's single-instance IPC didn't escape its record separator, so a crafted external link could inject extra commands. One of them reached a legacy internal helper that reads a local file and sends it to a chat, with no authorization check and no confirmation.
💥 Impact: one click on an external link can lead to arbitrary local file read. That includes Telegram's session data, enough to take over the account when no local passcode is set. Confirmed on Windows.
📅 Reported via ZDI in June. Telegram quietly fixed it in 7.2.9 (Sept 17) with no advisory. CVE assigned Oct 7.
Not in CISA KEV. No in-the-wild exploitation reported. ThreatWire has not run the PoC.
✅ Update to Telegram Desktop 7.2.9+. Also consider:
• "Ask where to save each file"
• Limiting who can add you to groups
• Setting a local passcode
Full breakdown & Poc👇
threatwire.tech/research/tel…
#Telegram #CVE #InfoSec #CyberSecurity
3M+ military service member records are stolen by hackers last year ❗❗
People are NOTIFIED a year later..
BREACH is already done, nothing changes even if you tell someone about their data
$76K from one Bugcrowd program
no program-hopping
→ 7-8 endpoints not forcing HTTPS, reported separately
→ email HTML injection, drip-fed one at a time
→ SSTI that took six days of payloads
→ a scope update caught early, new forms fell first try
anonhunter.medium.com/how-i-…
🚨 OpenAI research agent HACKED live access-control flaws on Australia's Medicare portal
the government's response was to complain about the disclosure 💀
found by a machine, on a government portal, and the argument is about etiquette
we're so not ready for this ⚡
one link, one admin click, RCE WordPress core‼️
fixed in 7.1.1 (chain CVSS 9.6)
the admin's session is forced to install a vulnerable theme
→ the Customizer runs its inactive PHP in preview
→ a no-permission-check handler runs a package
the victim's session supplies it all
Hacking AI support agents
two From headers, one email: SPF passes the attacker's domain, the AI agent resolves the victim's account
→ attacker(comment)@domain beats rate limits → spoofed email + real reset = OTP lands with attacker
identity resolution is the new auth bypass
Must Read this 👇intigriti.com/researchers/bl…
🚨 OnePlus confirmed a researcher's two root bugs, then threatened legal action over the disclosure.
so he published everything.
zero-permission app
→ AtlasService injects text into a root command
→ olc2 runs any shell command
→ full system control.
still unpatched 🤯
Full writeup: Arvin Shivram's $148,337 Google Cloud RCE
Chain 1: leaked proto definitions for internal Google APIs → internal workflow queue → a workflow task that executes Stubby RPCs with Google's own prod identity
👇
Chain 2: cross-tenant IDORs + a filter-based binary search that reconstructs victim UUIDs in ~128 requests
Both chains reach "Google treats this as RCE": brutecat.com/articles/google…
Security resources worth bookmarking #16
awesome-hacker-search-engines - replace your scattered recon bookmarks with one list
550+ engines, 28 categories: domains, certificates, code, leaks, threat intel, CVEs
Intersting do check it out.....
github.com/edoardottt/awesom…
Security resources worth bookmarking #14
Vulhub ➡ pre-built docker environments for real CVEs
git clone ⇢ cd into a CVE folder ⇢ docker compose up -d
From Shellshock to the Next.js middleware bypass, each folder has a README with repro steps
github.com/vulhub/vulhub
Security resources worth bookmarking - #13
Hackviser.
A practical collection of cheat sheets and methodology for web application pentesting.
Recon, authentication, access control, XSS, SSRF, SQLi & more.
hackviser.com/
CyberSecurity Insights 🪄 retweeted
GitLab security team waking up every few weeks:
“yeah… another critical one.”
CVE-2026-85706 is CVSS 10.0.
Unauthenticated path traversal → arbitrary file read via the repository commits API.
Self-hosted GitLab admins:
please patch your shit. 💀
Security resources worth bookmarking - #10
Pentest Monkey.
A classic collection of reverse shell cheat sheets and penetration testing references.
Simple, practical, and still useful when you need the right one-liner quickly.
pentestmonkey.net/cheat-shee…
A security resource worth bookmarking - #9
Assetnote Wordlists.
High-quality wordlists built from real internet-scale data.
Useful for subdomain enumeration, content discovery, API testing, and other tasks.
An excellent resource when standard wordlists aren't enough.
