Предраг Цујановић � Ｐ𝗿𝐞ⅆｒ𝚊ⓖ Ⅽ𝗎𝐉ａｎ𝚘𝕧ⓘć @cujanovic

@nullenc0de 🙋

Introducing HTTP/2 Bomb: a remote DoS in nginx, Apache httpd, Microsoft IIS, Envoy, and Cloudflare Pingora. A single client pins 32GB of server memory in 10s. Found by Codex. Blog post: blog.calif.io/p/codex-discov… PoCs: github.com/califio/public…

It has been straight exploit after exploit, Meta has given AI so much power to take over any account & claim any possible username We still have not received any public announcement in regards to these exploits and breaches. @instagram @Meta Please stop relying on AI for this

Dark Web Informer @DarkWebInformer

3 weeks ago

🚨 Possible new Instagram exploit is currently making its rounds, separate from the one yesterday. h/t: TG Feds

19 47 541 205K 172

Here's the PoC for Nginx CVE-2026-42945 which works against vanilla Ubuntu (and any other distro?) + Nginx with ASLR enabled. I have included all iterations of the PoC the LLM was kicked to improve. TL;DR: We can use an LFI/file-read primitive to leak enough details from /proc//mem to bypass ASLR and achieve reliable RCE, in most cases at first shot. There are still other ways to make it work, with even less subtle primitives. If you ask Geppetto nicely, he will help you ;) github.com/Hamid-K/nginx-…

Our security research team discovered a pre-authentication arbitrary file read as root in cPanel (CVE-2026-29205) — a path traversal in cpdavd that we made exploitable by abusing Dovecot's + alias handling to create attacker-controlled directory names on disk. We've updated cpanel2shell-scanner to cover both issues. Writeup and tool in replies. 👇

shubs.io/the-down-fall-…

🚨 CVE-2026-44578 — Next.js WebSocket SSRF Built a scanner + interactive exploit shell. AWS credentials exfiltrated in 3 steps: [1/3] Cloud auto-detect → AWS confirmed [2/3] IAM role found: profile [3/3] 🎯 AccessKeyId + SecretKey + Token ✅ Pipeline ready: subfinder | httpx | nextssrf ✅ Zero dependencies (stdlib only) ✅ Interactive shell with auto IAM chain Affected: Next.js 13.4.13 → 15.5.15 Fixed: 15.5.16 / 16.2.5 (self-hosted only) 🔗 github.com/ynsmroztas/nex… #BugBounty #infosec #RedTeam #AppSec #BugBountytip #BugBountytips #infosec #recon

cPanel's latest patch (11.134.0.26) for the pre-auth arbitrary file read issue (CVE-2026-29205) is incomplete. We made the call to not publish our research until a working patch is released. We are in touch with WebPro's security team.

NGINX rift: We autonomously discovered this 18 yr old heap overflow (CVE-2026-42945) in @nginx impacting version 0.6.27 to 1.30.0. If you use rewrite and set directive, you maybe impacted! Please update your NGINX or change the config to mitigate it. Read more at depthfirst.com/nginx-rift

Reported another cPanel critical pre-authentication vuln. Our research dates back to early April, but this exploit chain does not seem to be exploited in the wild, unlike our collision with a threat actor for the auth bypass. We'll publish details once a patch is avail.

💥 Introducing "Dirty Frag" A universal Linux LPE chaining two vulns in xfrm-ESP and RxRPC. A successor class to Dirty Pipe & Copy Fail. No race, no panic on failure, fully deterministic. ~9 years latent. Ubuntu / RHEL / Fedora / openSUSE / CentOS / AlmaLinux, and more. Even if you've applied the "Copy Fail" mitigation, your Linux is still vulnerable to "Dirty Frag". Apply the Dirty Frag mitigation. Details: dirtyfrag.io

Same script. Ubuntu, Amazon Linux, RHEL, SUSE — four root shells, side by side. No per-distro tuning. No race window. No kernel offsets to leak. Most Linux LPEs need at least one of those. This one needs none.

> be two researchers at wiz > download github enterprise server (same code as github but runs locally) > reverse-engineer the binaries with ai > find that git push -o strings go straight into an internal header > type a semicolon > inject a fake git hook > rce as the git service user > find an enterprise-mode flag gating hooks on github. it's also injectable > type another semicolon > rce on github itself > land on a shared node holding millions of private repos > read someone else's repo > get access to millions of private repos belonging to other users and orgs > github patches the same day, en urgence

🚨 According to sample data we received from the Vercel breach, Vercel's CEO Guillermo Rauch was last seen on March 3, 2026. Who is running the company? The threat actor told us Vercel's security was poor, and consistent with Vercel's own disclosure, a senior engineer authenticated with a fake third-party AI tool via its Google Workspace OAuth app. - The breach appears to have started or ended on April 12, 2026 - We were sent records of all employees...

keyboard_arrow_left Previous keyboard_arrow_right Next

To check if your Google Workspace has been compromised by the same tool that compromised Vercel: 1. Go to admin.google.com/ac/owl/list?ta… - This is Google Admin Console > Security > Access and Data Control > API Controls > Manage app access > Accessed Apps 2. Filter by ID = …v79i7bbvqj.apps.googleusercontent.com - This is the ID of the compromised OAuth app If you see an app after filtering, you have potentially been compromised

There is now a write-up on infostealers.com, apparently based on Hudson Rock data, that adds more detail to the #Vercel breach Many will focus on the Lumma stealer infection and the Roblox download. Okay. That matters too. But for me, the bigger failure came after that … Infections happen - always. The real question is what one infected machine can reach afterwards. If one compromised path was enough to expose access to Google Workspace, Supabase, Datadog, Authkit and Vercel-related admin resources, then the problem was not just the infostealer. The problem was too much access, weak separation, missing limits and security monitoring that failed to highlight highly suspicious activity on that account The mantra should be: “assume compromise” infostealers.com/article/breaki…

keyboard_arrow_left Previous keyboard_arrow_right Next

Technical report released: The AI-Assisted Breach of Mexico’s Government Infrastructure gambit.security/blog-post/a-si…

Everyone is looking for XSS in PDF generators and SSR bots, but they are missing the actual architectural nightmare: Headless Context Bleed (HCB). Opening a new "incognito" tab in Puppeteer doesn't isolate everything. A thread on how shared state in backend browsers is the next massive attack surface. 🧵👇

This week in security: - LiteLLM, backdoored release exfiltrating secrets - Axios, supply chain malware via dependency - Railway, CDN caching leaked user data - OpenAI Codex, command injection via GitHub branch names - Mercor 1TB data leak - Delve, data leak + compliance risk infra is the attack surface now