abdelnasser·2d agoOne-Click Account Takeover via WebView Auth Header Injection to Claimable Whitelisted Domainبِسْمِ اَللَّهِ وَالْحَمْدِ لِلَّهِ الَّذِي عَلَّمَ بِالْقَلَمِ عَلَّمَ الْإِنْسَانَ مَا لَمْ يَعْلَمْ وَالصَّلَاةَ وَالسَّلَامَ عَلَى…
Avinash Kumar·2d ago[$10,000] Google Jules — The Silent Code Heist - Stealing Github Codes RemotelyHi everyone!A response icon1A response icon1
Isv0x1·3d agoCross-Site Scripting (XSS) via Malicious GIF Cyshield CTF 2026In my previous writeup, we explored the first CYSHIELD CTF 2026 challenge, focusing on a 2FA authentication flaw.
starkwizzer·3d agoKilled by a Browser, Revived by a BackslashSingle Quote Turned a Dead Bug to Full JS Control over NASA.govA response icon1A response icon1
InMeetCyberbyGopal Rajguru·5d agoYour AI Coding Assistant Will Run Whatever Its Config File Says[bug bounty hunters and appsec engineers] This month, a single trailing dot in GitHub Copilot’s own security prompt was turned into a…
Killua199·6d agoBypassing Organization-Wide 2FA Enforcement with a Single API Requestالحمد لله الذي عَلَّمَ بالقلم.. عَلَّمَ الإنسانَ ما لم يَعْلَم والصلاةُ والسلامُ على خيرِ مُعَلِّمي الناسِ الخير محمد أما بعد
AstroKrypTech·6d agoBug Bounty Case Study: How a Public ID Exposed Private Account EmailsGetting a valid UUID
0xdzubair·Oct 29CWE-540 in the Wild: Hardcoded Credentials in a Production Analytics ScriptA quick lesson in why “we’ll clean that up later” is the most dangerous sentence in software.
L4ZZ3RJ0D·Oct 29SSRF Vulnerability on Major Gaming CompanyA gaming company’s content service that fetches resources from a URL you hand it, and the obvious question hanging over that kind of…
Mr. Robot.txt·Oct 27How I Bypassed a CAPTCHA Implementation Without Breaking a SweatHey y’all, it’s been a minute since I posted anything to do with web security. Well, you’re in luck, because today I’m dropping something…
![[$10,000] Google Jules — The Silent Code Heist - Stealing Github Codes Remotely](https://webproxy.poorya-velaei-d67.workers.dev/https://miro.medium.com/v2/resize:fill:160:106/1*BnUqWuLxIdDhHDLlp1HmdA.png)
![[$10,000] Google Jules — The Silent Code Heist - Stealing Github Codes Remotely](https://webproxy.poorya-velaei-d67.workers.dev/https://miro.medium.com/v2/resize:fill:320:214/1*BnUqWuLxIdDhHDLlp1HmdA.png)
