Video wird geladen...

Video konnte nicht geladen werden

Zur Startseite

Blind file read to RCE in PHP - without access to files, we need to build reliable arbitrary read primitive from the ISO-2022-CN-EXT overflow (CVE-2024-2961) #CNEXT

cfreal_'s profile picture

Charles Fol

4,363 subscribers

34,260 Aufrufe • vor 2 Jahren •via X (Twitter)

Wissenschaft & TechnologieNachrichten & PolitikBildung#CNEXT
LIVE

Anya Rossi• Live Now

Private livecam show

1 Kommentare

Profilbild von DreyAnd
DreyAndvor 2 Jahren

i'm starting to make good guesses heh

Ähnliche Videos

I found a Remote Code Execution in MECCHA CHAMELEON! If you play a map, that map can abuse a few cool neat bugs to write arbitrary files with (semi-)arbitrary content anywhere on your system, eventually leading to RCE 🧮 🧵 Want to know how? Read this thread 👇
0:42

I found a Remote Code Execution in MECCHA CHAMELEON! If you play a map, that map can abuse a few cool neat bugs to write arbitrary files with (semi-)arbitrary content anywhere on your system, eventually leading to RCE 🧮 🧵 Want to know how? Read this thread 👇

PinkDraconian

42,850 Aufrufe • vor 18 Tagen

NGINX rift: We autonomously discovered this 18 yr old heap overflow (CVE-2026-42945) in NGINX impacting version 0.6.27 to 1.30.0. If you use rewrite and set directive, you maybe impacted! Please update your NGINX or change the config to mitigate it. Read more at
0:36

NGINX rift: We autonomously discovered this 18 yr old heap overflow (CVE-2026-42945) in NGINX impacting version 0.6.27 to 1.30.0. If you use rewrite and set directive, you maybe impacted! Please update your NGINX or change the config to mitigate it. Read more at

Zhenpeng (Leo) Lin

211,715 Aufrufe • vor 4 Monaten

We're excited to introduce the Retrieval Harness in LlamaParse - which is the 2026 version of RAG over documents Generalized agents need the right set of tools to scalably search and read through an arbitrary corpus of data (from 10 docs to 1m+ docs). They can already demonstrate great retrieval performance over a local filesystem, need a proper backend for a large collection of managed data. The Retrieval Harness exposes a diverse set of tools for various needs: 1. Hybrid Retrieval: Combine vector search with keyword search, let the agent set the alpha value to toggle between the two 2. List Files: a scalable version of `ls` to list files within an index 3. File Grep: enable regex search within a given file 4. File Read: Allow agents to read a subsection from an existing document. The agent can choose to interleave any sequence of these tools in order to complete a variety of tasks, from simple to hard. Come check it out! Blog: Sign up to LlamaParse:
0:53

We're excited to introduce the Retrieval Harness in LlamaParse - which is the 2026 version of RAG over documents Generalized agents need the right set of tools to scalably search and read through an arbitrary corpus of data (from 10 docs to 1m+ docs). They can already demonstrate great retrieval performance over a local filesystem, need a proper backend for a large collection of managed data. The Retrieval Harness exposes a diverse set of tools for various needs: 1. Hybrid Retrieval: Combine vector search with keyword search, let the agent set the alpha value to toggle between the two 2. List Files: a scalable version of `ls` to list files within an index 3. File Grep: enable regex search within a given file 4. File Read: Allow agents to read a subsection from an existing document. The agent can choose to interleave any sequence of these tools in order to complete a variety of tasks, from simple to hard. Come check it out! Blog: Sign up to LlamaParse:

Jerry Liu

18,615 Aufrufe • vor 2 Monaten

Basketmouth released this in August 2022. Too many were blind to read between the lines. This is painful but this is Nigeria.
3:02

Basketmouth released this in August 2022. Too many were blind to read between the lines. This is painful but this is Nigeria.

@𝗼𝗻𝗲𝗷𝗼𝗯𝗹𝗲𝘀𝘀𝗯𝗼𝘆

1,104,437 Aufrufe • vor 2 Jahren

We need to ban the burqa. Read my column in today’s The Telegraph 👇
1:16

We need to ban the burqa. Read my column in today’s The Telegraph 👇

Suella Braverman

1,999,906 Aufrufe • vor 1 Jahr

We helped secure Perplexity's comet browser from a critical vulnerability that could let attackers hijack the agent to exfiltrate local files, read emails, and bypass SOP. Read the full blog:
0:56

We helped secure Perplexity's comet browser from a critical vulnerability that could let attackers hijack the agent to exfiltrate local files, read emails, and bypass SOP. Read the full blog:

s1r1us

22,550 Aufrufe • vor 10 Monaten

We absolutely need to continue teaching cursive writing. The Constitution is written in cursive. They need to be able to read it for themselves in the future.
0:22

We absolutely need to continue teaching cursive writing. The Constitution is written in cursive. They need to be able to read it for themselves in the future.

Derrick Evans

18,819 Aufrufe • vor 22 Tagen

🔥Arbitrary Code Execution in AWS Kiro with Indirect Prompt Injection Multiple ways actually... 1) Write to settings.json to put Kiro into YOLO mode by adding: "kiroAgent.trustedCommands": ["*"] -> immediate arbitrary OS command execution without user approval 2) Write to kiro's mcp.json file to add a fake mcp server that runs arbitrary python code -> immediate arbitrary code execution AWS fixed the issues quickly, but no CVE issued. If you use Kiro make sure to run the latest version, before someone else updates it for you.
12:01

🔥Arbitrary Code Execution in AWS Kiro with Indirect Prompt Injection Multiple ways actually... 1) Write to settings.json to put Kiro into YOLO mode by adding: "kiroAgent.trustedCommands": ["*"] -> immediate arbitrary OS command execution without user approval 2) Write to kiro's mcp.json file to add a fake mcp server that runs arbitrary python code -> immediate arbitrary code execution AWS fixed the issues quickly, but no CVE issued. If you use Kiro make sure to run the latest version, before someone else updates it for you.

Johann Rehberger

12,632 Aufrufe • vor 1 Jahr

Up to 20% of Americans are dyslexic, according to an estimate from the American Psychological Association, and Sen. Bill Cassidy (R-LA) believes the federal government should take on a larger role in helping identify dyslexia in children from an early age. "If 20% of the children learn to read differently and we are not accommodating the difference in how they learn to read, then they're going to be stuck, and we lose that social capital," Cassidy told Margaret Brennan in an interview Thursday. "...If someone cannot read, if they cannot be accommodated and learn to read, we just snuffed that out, and we need to enhance it."
1:30

Up to 20% of Americans are dyslexic, according to an estimate from the American Psychological Association, and Sen. Bill Cassidy (R-LA) believes the federal government should take on a larger role in helping identify dyslexia in children from an early age. "If 20% of the children learn to read differently and we are not accommodating the difference in how they learn to read, then they're going to be stuck, and we lose that social capital," Cassidy told Margaret Brennan in an interview Thursday. "...If someone cannot read, if they cannot be accommodated and learn to read, we just snuffed that out, and we need to enhance it."

CBS News

32,033 Aufrufe • vor 2 Monaten

In our latest analysis, we dive into CVE-2026-4802, a high-severity vulnerability discovered by our team in Cockpit that allows a remote attacker to achieve arbitrary command execution on the host by exploiting unsanitized user-controlled parameters within crafted links in the system logs user interface (UI). Read the full analysis on our blog:
0:47

In our latest analysis, we dive into CVE-2026-4802, a high-severity vulnerability discovered by our team in Cockpit that allows a remote attacker to achieve arbitrary command execution on the host by exploiting unsanitized user-controlled parameters within crafted links in the system logs user interface (UI). Read the full analysis on our blog:

Hakai Offsec

11,409 Aufrufe • vor 4 Monaten

Most people who read the Quran do not understand what they are reading. Here's what you need to know from someone who has read the Quran in Arabic.
2:38

Most people who read the Quran do not understand what they are reading. Here's what you need to know from someone who has read the Quran in Arabic.

Brigitte Gabriel

263,386 Aufrufe • vor 1 Jahr

In Cowork, you give Claude access to a folder on your computer. Claude can then read, edit, or create files in that folder. Try it to create a spreadsheet from a pile of screenshots, or produce a first draft from scattered notes.
0:32

In Cowork, you give Claude access to a folder on your computer. Claude can then read, edit, or create files in that folder. Try it to create a spreadsheet from a pile of screenshots, or produce a first draft from scattered notes.

Claude

7,158,722 Aufrufe • vor 8 Monaten

Do you use a virtual machine to browse dangerous links safely? If you use the Chrome browser inside that virtual machine, is it secure enough? As you might have guessed, the answer is not so much. We chained six unique CVEs from 2023 listed below. • Chrome Renderer RCE : CVE-2023-3079 • Chrome Sandbox Escape : CVE-2023-21674 • LPE in guest OS : CVE-2023-29360 • VMware Info Leak : CVE-2023-34044 • VMware Escape : CVE-2023-20869 • LPE in host OS : CVE-2023-36802
0:34

Do you use a virtual machine to browse dangerous links safely? If you use the Chrome browser inside that virtual machine, is it secure enough? As you might have guessed, the answer is not so much. We chained six unique CVEs from 2023 listed below. • Chrome Renderer RCE : CVE-2023-3079 • Chrome Sandbox Escape : CVE-2023-21674 • LPE in guest OS : CVE-2023-29360 • VMware Info Leak : CVE-2023-34044 • VMware Escape : CVE-2023-20869 • LPE in host OS : CVE-2023-36802

Theori

139,831 Aufrufe • vor 2 Jahren

Big news. We’re excited to announce our $21m Series A! Inngest now powers 30B monthly executions, helping product teams build reliable products efficiently, at scale. As AI moves to production, the need for fast, durable workflows is essential. Read the announcement post👇
1:00

Big news. We’re excited to announce our $21m Series A! Inngest now powers 30B monthly executions, helping product teams build reliable products efficiently, at scale. As AI moves to production, the need for fast, durable workflows is essential. Read the announcement post👇

Inngest

98,801 Aufrufe • vor 1 Jahr

Reporter: What do you need from Delcy Rodríguez? Trump: We need total access. We need access to the oil and to other things in their country that allow us to rebuild their country.
0:24

Reporter: What do you need from Delcy Rodríguez? Trump: We need total access. We need access to the oil and to other things in their country that allow us to rebuild their country.

Clash Report

16,422 Aufrufe • vor 8 Monaten

AI agents can read any file the user has access to. That is a much larger surface than most security teams realize. Classification-based access policies in Box now give admins read access control for AI agents. Restrict which agents can read which content based on Box Shield classifications. Enforced automatically across every agent, regardless of which AI tool is making the request. This demo shows it in action.
1:41

AI agents can read any file the user has access to. That is a much larger surface than most security teams realize. Classification-based access policies in Box now give admins read access control for AI agents. Restrict which agents can read which content based on Box Shield classifications. Enforced automatically across every agent, regardless of which AI tool is making the request. This demo shows it in action.

Box

105,605 Aufrufe • vor 1 Monat

‼️ Dirty Frag: A Universal Linux Local Privilege Escalation via Page-Cache Write Primitives GitHub: Patches: CVE-2026-43284: A page-cache write flaw in the Linux kernel's xfrm-ESP (IPsec) subsystem that lets a local user corrupt read-only file pages via in-place decryption on shared skb fragments CVE-2026-43500: A sibling page-cache write flaw in the Linux kernel's RxRPC subsystem (AFS protocol) where the same fast-path pattern enables arbitrary plaintext writes into attacker-chosen pages, escalating to root
0:22

‼️ Dirty Frag: A Universal Linux Local Privilege Escalation via Page-Cache Write Primitives GitHub: Patches: CVE-2026-43284: A page-cache write flaw in the Linux kernel's xfrm-ESP (IPsec) subsystem that lets a local user corrupt read-only file pages via in-place decryption on shared skb fragments CVE-2026-43500: A sibling page-cache write flaw in the Linux kernel's RxRPC subsystem (AFS protocol) where the same fast-path pattern enables arbitrary plaintext writes into attacker-chosen pages, escalating to root

Dark Web Informer

18,534 Aufrufe • vor 4 Monaten