A . is all you need! 🔥 RCE in Copilot for Visual Studio and SSMS. A trailing dot added to a config filename bypasses Copilot's security controls, leading to remote code execution in Visual Studio and SQL Server Management Studio. embracethered.com/blog/posts…

I'm happy that my first article as part of the @SLCyberSec research team is finally out! 😁 It covers an interesting ImageMagick race condition that I found back in June, which, combined with a polyglot payload, allowed me to achieve file read/RCE on Discourse. This should resonate with those who've seen the recent @HacktronAI research. I hope you'll enjoy it! 👇

How I got RCE and full cloud takeover on Meta at their in-person event in Taiwan zonduu.me/posts/meta-graphra…

How I Could've Accessed 17 Trillion Microsoft Records blog.faav.net/how-i-couldve-… :)

On July 25, we hacked OpenAI. Two bugs let us take over ChatGPT/Codex accounts of OpenAI employees (+some unaffiliated users) and reach connected services: Outlook, Slack, GitHub, etc. We proved it with a PR in OpenAI’s internal codebase . It took us <72h. 🧵

We know you're all hyped with DEF CON stuff but here's one more thing to get excited about: @J0R1AN just released a new research over at the Critical Research Lab! And this time it was inspired by a discussion we had on our discord, go check it out! lab.ctbb.show/research/solvi…

A vulnerability in Azure? How about 3 of those? Uncovering 2 SSRFs + a file upload path traversal I discovered in the Azure API Management service. Attackers could send requests from the service’s proxies, access internal Azure assets, deny service and upload malicious files🧵

Breaking Claude Code Opus 5 Auto Mode 🔥 1/ Here is a somewhat hilarious attack chain that hijacks Claude Code Opus 5 for a full system compromise via a website Hint: Security invariants are not optional 🧵

🚨 CosmosEscape: We found a single key that unlocked every database in Azure CosmosDB One key >> Platform-wide impact. Microsoft fully remediated the issue. ✅ Read the full research and see how Wiz uncovered CosmosEscape: wiz.io/blog/cosmosescape-tak…

The whitepaper is live! Read "Can AI Do Novel Security Research? Meet the HTTP Terminator" here -> portswigger.net/research/htt…

Seems that wp2shell PoCs are now floating around the internet, so we've published our blog post including our research methodology for finding the bug as well as a deep dive into the chain itself - slcyber.io/research-center/e…

MAD Bugs: My Cousin Vinyl (CVE-2026-50052) So the story went like this: Squid was bleeding from a 29-year-old heap overread in her default config. Naturally, she did the only sensible thing: she called her cousin, Vinyl. It turns out Vinyl also had a family problem of his own. blog.calif.io/p/mad-bugs-my-…

Pleased to publish a browser-related research paper (w/@inzo____) titled: One trigram at a time: XSLeak via Universal CSS Injection and DoS in Opera (GX) The title speaks for itself. Enjoy the read! zhero-web-sec.github.io/rese…

On June 10th, we announced a critical auth bypass in phpBB, now CVE-2026-48611. Here's the technical followup with exploit scenarios and how to detect it. All it takes is one unauthenticated request to log in as any user, admin included, on a default phpBB install, no password required. Aikido Attack caught this on a routine run. We reported it June 2nd, and phpBB shipped a fix four days later in version 3.3.17. If you haven't upgraded yet, do it now.