Made it to New York City!🗽🇺🇸

The rain has been intermittent in Chicago, so most outdoor activities have been canceled, including my kayaking trip.🥲

Let’s connect on LinkedIn. linkedin.com/in/ewan-xu-6b61…

#WAF Bypassing #AWS #CloudFront & #ALB WAF: Exploring the attack surface of a dual-layer web protection architecture. The first layer: a malicious XSS payload was blocked by CloudFront’s global WAF. By altering the XSS event-handler tag, I was able to bypass the first layer. The second layer: the request was then blocked by the regional WAF associated with the ALB. By exploiting normalization differences, I was able to bypass the second layer as well. The result: the XSS payload reached the origin and ultimately executed in the browser.

In the Tomcat August security bulletin, 6 CVEs were independently discovered and reported by our team (@4ra1n_x and unam4). Official severity ratings: 2 Important and 4 Low. If HackerOne’s Internet Bug Bounty hadn’t been suspended, we probably could’ve earned at least a few thousand bucks in bounties.

Apparently, I’m not done hunting JDBC vulnerabilities in IBM products. It started with my first report years ago. Found another one this year, bringing the total to 4 vulnerabilities reported to IBM, together with @4ra1n_x and unam4. The rabbit hole goes deeper.🐰 Make JDBC Attacks Great Again!🔥 ibm.com/support/pages/node/7… ibm.com/support/pages/node/7…

The author of the Fastjson project sent me a commemorative T-shirt as a token of appreciation for my vulnerability report.

Teamed up with my AI assistant and discovered a new Command Injection vulnerability in MariaDB. Another CVE added to the collection. Let’s go!🚀🚀🚀

Yet another real-world JDBC attack case. Back in my Black Hat talk, I pointed out that in cloud environments, attacks can originate from a tenant and reach the control plane, or even enable lateral movement across tenants—especially when container or VM isolation is not properly enforced. At the time, very few people seemed to understand what I meant, and most dismissed the risk. It’s interesting to see these scenarios continue to emerge in the real world.

#CVE-2026-28496: SSTI in #FOSSBilling Twig templates may escalate to SQLi or even RCE when FILE privileges are enabled.

AI-assisted discovery of a new MySQL vulnerability. Another CVE credit added to the list🚀🚀🚀@4ra1n_x