ROSECURIFY
Subscribe
~/ seclog/ #201

Seclog - #201

15 curated links

g3n3r4l13

  1. RCE (kind of) in Transmission BitTorrent’s daemon (joshua.hu)

    Transmission sets Access-Control-Allow-Origin: on its RPC endpoint and exposes the session-id token cross-origin, defeating the CSRF protection the RPC server relies on. Any website you visit can drive the RPC, change download-dir, set the torrent-done script, and get code execution: the exact threat model the session-id was added to stop in 2018.

  2. Imperia CMS <= 11.5.4 SiteActive TEMPLATE … (rcesecurity.com)

    CVE-2026-110355: Unauthenticated SSTI in Imperia CMS 11.5.4 and earlier enables remote code execution via SiteActive's TEMPLATE parameter when PHP is available.

  3. php2shell by Calif Research (calif.io)

    A tale of two PHP remote vulnerabilities.

  4. Reproducing the Hugging Face Incident, Part I (abundant.ai)

    A controlled reproduction of the package manager hack in the Hugging Face incident, with lessons for detecting and discouraging reward hacking.

  5. OSS Scanner (red.anthropic.com)

    OSS Scanner is a free, opt-in service by Anthropic that runs periodic security scans of open-source repositories with our strongest models.

  6. How practical is 100k requests per second? Introducing h3fuzz (slcyber.io)

    Can HTTP/3 really give you 100k requests per second for content discovery? We tested it in a fork of ffuf and are releasing h3fuzz, a web UI for fuzzing.

  7. China-Linked Hackers Targeted Governments Across Asia. We Hacked Their… (vulone.com)

    A China-linked operator ran 66 AI-driven intrusions against government and industry targets across Asia from a single exposed server, reaching 48 systems before the whole operation leaked onto the open internet.

  8. ira grachevskaya from the hit vn Z.A.T.O. // I Love the World and… (mastodon.catgirl.cloud)

    omfg they're ALL FUCKING 255. 4 EM OV TLS CA - G3C OV TLS. 56 EM EV TLS CA - G3C EV TLS.

  9. 8 eMudhra certificates are compromised. Here's what you need to know (blog.cloudflare.com)

    Following the discovery that eight eMudhra intermediate certificates use weak keys, Cloudflare is deploying mitigations and releasing client updates. We explain the impact, our response, and what customers and developers should do next.

  10. AI Pentesting Tool: 30 Questions to Ask Before You Buy (socradar.io)

    "AI pentesting" now covers very different products. Some platforms plan and run attack chains on their own and return exploitation evidence for every.

  11. eMudhra Intermediate CA Compromise (emudhra.we-have-a-problem.com)

    The private keys of eight eMudhra intermediate CA certificates, trusted by major root programs, have been compromised. Check whether your client is affected and how to protect it.

  12. Breaking the AWS MCP Python Sandbox (xplo1t-sec.github.io)

    Preface AWS announced the general availability of the AWS MCP Server on May 6, 2026. It is a managed remote Model Context Protocol (MCP) server. An MCP server exposes certain tools/functions and lets your AI agent call them.

  13. Tailworm (tailworm.com)

y0utube1

  1. php2shell is crazy (youtube.com)

    I used Codex and the hints from Calif's public demo to try to rediscover the PHP remote code execution vulnerability behind php2shell. I just wanted to make ...

g1thub1

  1. awesome-reverse-engineering: Curated reverse-engineering tools and… (github.com)

    Curated reverse-engineering tools and learning resources for binaries, apps, firmware, formats, and protocols.

← All Seclogs