Loading video...

Video Failed to Load

There was a problem loading this video. This could be due to a temporary network issue or the video might be unavailable.

Open-sourcing our RCE implementation for CVE-2026-42533! This is an incredibly powerful NGINX bug that provides both info leak and an out-of-bounds heap write primitives (so, yes, ASLR bypass!). F5 released the security advisory a week ago on July 15th. Fun fact: this bug appears to have been found concurrently... show more

Zhenpeng (Leo) Lin

3,757 subscribers

30,570 views • 3 months ago •via X (Twitter)

Science & Technology

Anya Rossi• Live Now

Private livecam show

7 Comments

Zhenpeng (Leo) Lin3 months ago

RCE implementation: CVE-2026-42533 security advisory: CVE-2026-42530 security advisory:

QM3 months ago

Nginx rift part 2 Found autonomously using @depthfirstlabs platform as part of the Open Defense Initiative (

Abhinav Kommula3 months ago

Insane Leo!

Tanmay Gupta3 months ago

nginx tokyo riftttt

Andrea Michi3 months ago

ASLR 👋

QM3 months ago

Exploitable even with ASLR enabled 👀

Sandeco3 months ago

Have you heard of the Reversa Framework? There is also a paper about it available on arXiv: Turn legacy systems into executable specifications for AI agents. This paper shows how to transform a legacy ATM system written in COBOL in 1994 into a modern Go application using only the Reversa Framework.

Related Videos

Here goes nginx-quicburst (CVE-2026-42530), a new RCE in Nginx discovered by our security agent VEGA and demonstrated by Nebula Security. This is only the third NGINX vulnerability since 2014 to receive NGINX’s “major” severity rating. If you use Nginx 1.31 with QUIC enabled, we recommend upgrading to the latest version. This bug has been patched in the latest Nginx release. We will publish the technical writeup, including the ASLR bypass, on July 18 together with the previous nginx-poolslip writeup.

Here goes nginx-quicburst (CVE-2026-42530), a new RCE in Nginx discovered by our security agent VEGA and demonstrated by Nebula Security. This is only the third NGINX vulnerability since 2014 to receive NGINX’s “major” severity rating. If you use Nginx 1.31 with QUIC enabled, we recommend upgrading to the latest version. This bug has been patched in the latest Nginx release. We will publish the technical writeup, including the ASLR bypass, on July 18 together with the previous nginx-poolslip writeup.

NebuSec

108,411 views • 4 months ago

CVE-2026-42530 NGINX RCE

CVE-2026-42530 NGINX RCE

Clandestine

57,981 views • 4 months ago

Every 3rd website you visit runs Nginx. 18,959,833 of them can be hijacked right now. A bug from 2008 just got a working exploit. CVE-2026-42945 (CVSS 9.2) No login. No access. Just one HTTP request. → Heap overflow → Worker process → RCE Patch ASAP to Nginx 1.31.0 or 1.30.1 PoC is already out:

Every 3rd website you visit runs Nginx. 18,959,833 of them can be hijacked right now. A bug from 2008 just got a working exploit. CVE-2026-42945 (CVSS 9.2) No login. No access. Just one HTTP request. → Heap overflow → Worker process → RCE Patch ASAP to Nginx 1.31.0 or 1.30.1 PoC is already out:

Het Mehta

153,593 views • 6 months ago

CVE-2026-81376: VS Code RCE via Security Feature Bypass; $4,000 bounty. Write-up:

CVE-2026-81376: VS Code RCE via Security Feature Bypass; $4,000 bounty. Write-up:

Dark Web Informer

25,626 views • 25 days ago

Attacks always get better. Here's a new nginx RCE that bypasses ASLR, tested on the latest nginx 1.30 and 1.31. This still requires a non-default config, but unlike some previous bugs, it does not depend on any additional vulnerabilities or external helpers to get to RCE. We reported the bug on May 15. F5 has confirmed it, and hopefully a patch will land soon. This is getting ridiculous 😅. We have enough nginx bugs to do an entire week of MAD Bugs on it. Who could have thought nginx is starting to feel like the new Linux kernel? This is the funniest time in computer hacking. And yet the world is completely unprepared for this new reality.

Attacks always get better. Here's a new nginx RCE that bypasses ASLR, tested on the latest nginx 1.30 and 1.31. This still requires a non-default config, but unlike some previous bugs, it does not depend on any additional vulnerabilities or external helpers to get to RCE. We reported the bug on May 15. F5 has confirmed it, and hopefully a patch will land soon. This is getting ridiculous 😅. We have enough nginx bugs to do an entire week of MAD Bugs on it. Who could have thought nginx is starting to feel like the new Linux kernel? This is the funniest time in computer hacking. And yet the world is completely unprepared for this new reality.

thaidn

33,368 views • 5 months ago

‼️ CVE-2026-22812: OpenCode v1.0.216 - Unauthenticated RCE CVSS: 8.8 CVE Published: January 12th, 2026 PoC/Exploit: Advisory/PoC: Original Post:

‼️ CVE-2026-22812: OpenCode v1.0.216 - Unauthenticated RCE CVSS: 8.8 CVE Published: January 12th, 2026 PoC/Exploit: Advisory/PoC: Original Post:

Dark Web Informer

28,847 views • 9 months ago

Since iOS 18 launched, the new Passwords app has been using unencrypted HTTP to download icons for password entries—a potential #security risk. We reported this bug to #Apple in September, and it’s finally fixed in #iOS 18.2 (CVE-2024-54492). Why does this matter? Watch 🎬 :

Since iOS 18 launched, the new Passwords app has been using unencrypted HTTP to download icons for password entries—a potential #security risk. We reported this bug to #Apple in September, and it’s finally fixed in #iOS 18.2 (CVE-2024-54492). Why does this matter? Watch 🎬 :

Mysk 🇨🇦🇩🇪

156,628 views • 1 year ago

NGINX rift: We autonomously discovered this 18 yr old heap overflow (CVE-2026-42945) in NGINX impacting version 0.6.27 to 1.30.0. If you use rewrite and set directive, you maybe impacted! Please update your NGINX or change the config to mitigate it. Read more at

NGINX rift: We autonomously discovered this 18 yr old heap overflow (CVE-2026-42945) in NGINX impacting version 0.6.27 to 1.30.0. If you use rewrite and set directive, you maybe impacted! Please update your NGINX or change the config to mitigate it. Read more at

Zhenpeng (Leo) Lin

212,002 views • 6 months ago

It's the bug of the month for June 2026! CVE-2026-45657 - A CVSS 9.8 vulnerability in Kernel that allows remote, unauthenticated code execution at SYSTEM without user interaction. Yikes!

It's the bug of the month for June 2026! CVE-2026-45657 - A CVSS 9.8 vulnerability in Kernel that allows remote, unauthenticated code execution at SYSTEM without user interaction. Yikes!

TrendAI Zero Day Initiative

34,389 views • 5 months ago

CVE-2026-0265, the PAN-OS auth bypass (when Cloud Auth Services are enabled) was fun to reproduce and load into the watchTowr Platform. Our friends @ Hacktron AI are publishing their analysis this week, so we won’t be publishing. Looking forward to it 🚀

CVE-2026-0265, the PAN-OS auth bypass (when Cloud Auth Services are enabled) was fun to reproduce and load into the watchTowr Platform. Our friends @ Hacktron AI are publishing their analysis this week, so we won’t be publishing. Looking forward to it 🚀

watchTowr

60,497 views • 5 months ago

Exploiting llama.cpp’s RPC Server - From Null Buffer to RCE Against PIE + Full RELRO + NX | CVE-2026-34159: The vulnerability is a one-line logic bug in the RPC server’s tensor deserialization pipeline. Youtube: Blog:

Exploiting llama.cpp’s RPC Server - From Null Buffer to RCE Against PIE + Full RELRO + NX | CVE-2026-34159: The vulnerability is a one-line logic bug in the RPC server’s tensor deserialization pipeline. Youtube: Blog:

NullSecurityX

19,600 views • 6 months ago

$🔥 ESET fixed CVE-2024-7400 found by our researcher Dmitriy Zuzlov! This is an LPE that affects 13 ESET solutions and allows a low-privileged attacker to delete arbitrary files, which can be used to obtain NT AUTHORITY\SYSTEM privileges! The advisory 👉$

🔥 ESET fixed CVE-2024-7400 found by our researcher Dmitriy Zuzlov! This is an LPE that affects 13 ESET solutions and allows a low-privileged attacker to delete arbitrary files, which can be used to obtain NT AUTHORITY\SYSTEM privileges! The advisory 👉

PT SWARM

15,381 views • 2 years ago

patch your wordpress. cve-2026-63030 is a pre-auth rce via sql injection. 6.8.5 and below: not affected 6.9.0–6.9.4: affected 7.0.0–7.0.1: affected props to our friends at Assetnote for the crazy find

patch your wordpress. cve-2026-63030 is a pre-auth rce via sql injection. 6.8.5 and below: not affected 6.9.0–6.9.4: affected 7.0.0–7.0.1: affected props to our friends at Assetnote for the crazy find

Hacktron AI

40,093 views • 3 months ago

OpenAI President Greg Brockman: "every time we've run into 'the model isn't scaling the way we expect, ' it turns out we have a bug — our math wasn't right, or the implementation didn't match the math That's an important thing to internalize

OpenAI President Greg Brockman: "every time we've run into 'the model isn't scaling the way we expect, ' it turns out we have a bug — our math wasn't right, or the implementation didn't match the math That's an important thing to internalize

Haider.

72,609 views • 4 months ago

🚨PoC for SysAid PreAuth RCE Chain (CVE-2025-2775, CVE-2025-2776, CVE-2025-2777, CVE-2025-2778) GitHub: Write-up:

🚨PoC for SysAid PreAuth RCE Chain (CVE-2025-2775, CVE-2025-2776, CVE-2025-2777, CVE-2025-2778) GitHub: Write-up:

Dark Web Informer

18,120 views • 1 year ago

🚨🇺🇸CEO OF CROWDSTRIKE ON GLOBAL IT OUTAGE “The system was sent an update, and that update had a software bug in it and caused an issue with the Microsoft operating system and we identified this very quickly and remediated the issue. We're always trying to stay one step ahead of the adversaries and in this case, you know, our systems are always looking for the latest attacks from these adversaries that that are out there. So, this content, update went out, and as it does and it's been doing for many, many years, obviously, we've got a robust team that's looking at the safety and security and the quality of these updates, and we must go back and see what happened here.” Source: TODAY

🚨🇺🇸CEO OF CROWDSTRIKE ON GLOBAL IT OUTAGE “The system was sent an update, and that update had a software bug in it and caused an issue with the Microsoft operating system and we identified this very quickly and remediated the issue. We're always trying to stay one step ahead of the adversaries and in this case, you know, our systems are always looking for the latest attacks from these adversaries that that are out there. So, this content, update went out, and as it does and it's been doing for many, many years, obviously, we've got a robust team that's looking at the safety and security and the quality of these updates, and we must go back and see what happened here.” Source: TODAY

Mario Nawfal

149,569 views • 2 years ago

We recently found a new RCE chain affecting the Node.js ImageResponse implementation in Next.js. Vercel has published CVE-2026-94545. Next.js versions from 16.2.0 through 16.3.5 are affected. Upgrade to Next.js 16.3.6. I'll share more details soon, once the remaining upstream advisories are out! Credit also to RagRocks, who discovered this together with me Post:

We recently found a new RCE chain affecting the Node.js ImageResponse implementation in Next.js. Vercel has published CVE-2026-94545. Next.js versions from 16.2.0 through 16.3.5 are affected. Upgrade to Next.js 16.3.6. I'll share more details soon, once the remaining upstream advisories are out! Credit also to RagRocks, who discovered this together with me Post:

sy.br1d

17,693 views • 1 month ago

Something meant to be shown a while ago, an implementation of OpenRGB for our hacking minigame. Still very unstable but when it works, it's super fun. #screenshotsaturday

Something meant to be shown a while ago, an implementation of OpenRGB for our hacking minigame. Still very unstable but when it works, it's super fun. #screenshotsaturday

PERIPETEIA out in Early Access

14,336 views • 10 months ago

In our latest analysis, we dive into CVE-2026-4802, a high-severity vulnerability discovered by our team in Cockpit that allows a remote attacker to achieve arbitrary command execution on the host by exploiting unsanitized user-controlled parameters within crafted links in the system logs user interface (UI). Read the full analysis on our blog:

In our latest analysis, we dive into CVE-2026-4802, a high-severity vulnerability discovered by our team in Cockpit that allows a remote attacker to achieve arbitrary command execution on the host by exploiting unsanitized user-controlled parameters within crafted links in the system logs user interface (UI). Read the full analysis on our blog:

Hakai Offsec

11,413 views • 6 months ago

depthfirst has raised an $80M Series B at a $580M valuation. Attackers are using AI to break into systems faster than ever before. depthfirst is on a mission to stop this. RT + Comment “depthfirst” and I’ll send you a FREE vibe coding security agent.

depthfirst has raised an $80M Series B at a $580M valuation. Attackers are using AI to break into systems faster than ever before. depthfirst is on a mission to stop this. RT + Comment “depthfirst” and I’ll send you a FREE vibe coding security agent.

Andrea Michi

1,576,979 views • 7 months ago