@s3bsrt

I like to break stuff | Web Vuln Research & CTF @ARESxCTF @aboutblankets

 Italy
sebsrt.xyz
Joined February 2022
  • Tweets68
  • Following569
  • Followers772
4Media
Pinned Tweet
sebsrt@s3bsrtFeb 13
I’ve been digging into HTTP Trailers and found some new smuggling techniques: sebsrt.xyz/blog/trailing-dan…

Trailing Danger: exploring HTTP Trailer parsing discrepancies

Trailing Danger: exploring HTTP Trailer parsing discrepancies

sebsrt.xyz
4
107
4
426
42,992
CTF has finally become a contest between Korean meat proxies just to see which team has the bigger wallet and can burn more tokens with their pay2win strats
12
25
5
385
25,810
The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2. PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.
345
4,178
1,254
18,605
7,064,314
Bro emudhra.we-have-a-problem.co…
2
2
7
2,871
A 12 year-old race condition to object injection and RCE, preauth in some configurations, I found in DokuWiki (CVE-2026-113356). gist.github.com/sebastianosr…

DokuWiki RCE - file r/w race condition to object injection

DokuWiki RCE - file r/w race condition to object injection - report.md

gist.github.com
1
16
87
6,062
sebsrt retweeted
Codean@CodeanIOOct 9
We released our latest blogpost covering the details of some bugs that @b0n0b0__ presented during Romhack Camp (hosted by @cybersaiyanIT). They'll publish the video of the talk and the slides, make sure to check all that out and stay tuned for part two! codeanlabs.com/2026/10/break…

Breaking GNOME: the core - Codean Labs

codeanlabs.com
5
2
15
2,935
We're back, analyzing CVE-2026-21589 - an Arbitrary File Read vulnerability in Atlassian Jira, Confluence, BitBucket and more... Enjoy! labs.watchtowr.com/you-wont-…

You Won’t Hear About These, Even In Myths (Atlassian Jira, Confluence (and more) Pre-Auth Arbitrary...

Welcome back to yet another episode of "security was taken seriously". Being who we are (and constantly being exposed to what we see…), we recognize we have been doomed to eternal damnation as we...

labs.watchtowr.com
2
73
6
209
18,915
sebsrt retweeted
HAHWUL
@hahwulSep 6
GORI v0.5.0 is out 🎉 - Cookie workbench: decode / verify / crack / forge Flask, Rack, Django session cookies - Retest: diff two projects at endpoint scale - CVSS v3.1 & v4.0 on issues, SARIF export - gRPC schema from descriptor sets or server reflection - Pipe bytes through your own command Plus a long tail of very specific things — per-send TLS fingerprints, WebSocket-over-h2 replay, SOCKS5H. Hack from the terminal. github.com/hahwul/gori/relea…
🤖 Made with AI
1
2
1
15
1,219
🚨🚨🚨🚨🚨🚨 From Padding Oracle to Shell: Unauthenticated RCE in Telerik UI for ASP[.]NET AJAX tantosec.com/blog/2026/09/te… The vulnerabilities described in this post were discovered, analysed, and exploited with some AI assistance, and a lot of old-fashioned human persistence.

From Padding Oracle to Shell: Unauthenticated RCE in Telerik UI for ASP.NET AJAX

TantoSec turned an unauthenticated AES-CBC padding oracle in Telerik UI for ASP.NET AJAX into remote code execution, chaining a decrypt-versus-parse oracle, a predictable HMAC key, and a type-name...

tantosec.com
1
59
5
181
32,099
I've published UniBLEed, a fully wormable proximity Bluetooth RCE affecting Unitree's G1 humanoids. Blog spans cloud, mobile, firmware, Bluetooth & hardware. Two multi-bug RCE chains. 3 months into ~80 minutes, $6,700 in bounties. Go jailbreak your G1s!! boschko.ca/g1-ble-rce/

UniBLEed: Unauthenticated Root RCE on Any Unitree G1 Humanoid Robot Within Bluetooth Range

Root on a $20,000 humanoid robot from Bluetooth range. One chain crossing Bluetooth, Unitree’s cloud, mobile, and the firmware running the G1 itself. Here’s the complete technical breakdown of the...

boschko.ca
9
83
10
226
24,346
sebsrt retweeted
elttam@elttamAug 14
New blog post: Ruby 4.0 Universal RCE Deserialization Gadget Chain elttam.com/blog/ruby-4-0-uni…

Ruby 4.0 Universal RCE Deserialization Gadget Chain - elttam

This post releases a new universal chain that turns a single Marshal.load into command execution on Ruby, built with new gadgets from untapped sources as well as old gadgets put to new use.

elttam.com
3
30
2
81
11,024
This came from an interesting experiment. I gave Opus 4.8 my original Cookieless DuoDrop article and asked it to find a bypass. It found one. 🤔 Makes me wonder how many older security fixes are worth revisiting with modern AI-assisted research.
Soroush Dalili
@irsdlAug 11
A URL-encoded ASP .NET Cookieless marker could partially bypass the CVE-2023-36899 fix and cross IIS application boundaries.

Cookieless DuoDrop Was Back: A Partial CVE-2023-36899 Patch Bypass

Article · @irsdl
1
3
25
2,601
sebsrt retweeted
Tom Stacey@t0xodileAug 12
portswigger.net/research/crl…

CRLF-Powered Desync Attacks: Beheading HTTP Streams

Abstract In this paper we’ll show that HTTP Header Injection is severely underestimated. Forget open redirects or Cross-Site Scripting and instead, embrace the catastrophic potential of the CRLF-Power

portswigger.net
2
23
563
sebsrt retweeted
Assetnote
@assetnoteJul 14
Our research team discovered a critical pre-authentication RCE inside ServiceNow by bypassing their scripting sandbox (CVE-2026-6875). You can read more here: slcyber.io/research-center/s…

Smashing the ServiceNow Sandbox – Pre Authentication RCE

Searchlight Cyber researchers discover a second pre-auth RCE in ServiceNow (CVE-2026-6875) by escaping the script sandbox via a JavaScript gadget chain, allowing full instance compromise without...

slcyber.io
1
46
149
10,916
sebsrt retweeted
Calif
@calif_ioJul 1
MAD Bugs: My Cousin Vinyl (CVE-2026-50052) So the story went like this: Squid was bleeding from a 29-year-old heap overread in her default config. Naturally, she did the only sensible thing: she called her cousin, Vinyl. It turns out Vinyl also had a family problem of his own. blog.calif.io/p/mad-bugs-my-…
2
18
4
71
27,422
mhackeroni is going to Vegas! We qualified for the eighth time to the DEF CON CTF Finals - top 12 in the world. We're putting together our 2026 sponsors: backing Italy's leading ethical hacking team is a unique opportunity. Want in? Let's talk: [email protected] #infosec #CTF
12
1
34
1,180
sebsrt retweeted
Calif
@calif_ioJun 18
We sent Claude Mythos Preview spelunking through Squid’s guts, and it surfaced clutching a 29-year-old bug. Meet Squidbleed: a Heartbleed-style vulnerability that leaks internal memory from every version of Squid Proxy, in its default configuration. Full story: blog.calif.io/p/squidbleed-c…
6
90
5
334
66,460
We published a new research article on the Chromium 146 Renderer Process! In this article, we start from the CVE-2026-3910 Maglev write barrier elision bug and walk through the full exploit chain: building a V8 heap R/W primitive via a GC-induced UAF, achieving an out-of-sandbox read using WebAssembly internals, abusing JSPI UAF and StackMemory / JumpBuffer, and ultimately reaching renderer process RCE. Our goal was to provide a structured explanation of how modern V8 exploitation works in practice, from compiler-level bug analysis to sandbox-boundary primitives and final code execution. Huge thanks to our team member @m411k_ for conducting this research! Check out the PoC! Full article: research.rewritelab.org/2026…
1
34
169
12,889
Shellcode execution as a service! To exploit an argument injection in Jellyfin, we searched and found a gadget in the .NET runtime to turn file writes into code execution. Learn about the bug and this new technique: sonarsource.com/blog/jellyfi… #appsec #security #vulnerability
1
31
1
100
18,096
💿Crafting shared object/image polyglots by abusing a forgotten image format: blog.babelo.xyz/posts/elf-in…

ELF in the Pixels: Building Shared Object-Image Polyglots

In this post, I will show how to build shared object/image polyglots that can bypass image validation in Python applications. I will start from a challenge I …

blog.babelo.xyz
5
12
614
Load more