正在加载视频...

视频加载失败

加载此视频时出现问题。这可能是由于临时网络问题，或视频可能不可用。

We successfully achieved an RCE on GitLab in its default configuration. Historically, most GitLab RCEs have lived in the web or application-logic layers. This time, guided by the depthfirst spirit, we went deeper: into the low-level gem dependency chain beneath GitLab. The result? By sending crafted JSON data, we... show more

Yuhang Wu

1,489 subscribers

102,590 次观看 • 2 个月前 •via X (Twitter)

Anya Rossi• Live Now

Private livecam show

17 条评论

Yuhang Wu 的头像

Yuhang Wu2 个月前

GitLab OJ Spill overview: Technical details: Demo and PoC:

depthfirst 的头像

depthfirst2 个月前

Incredible work @wupco1996 and team

Francesco Piccoli 的头像

Francesco Piccoli2 个月前

@depthfirstlabs This is huge

QM 的头像

QM2 个月前

@depthfirstlabs It's impressive that the @depthfirstlabs platform did exactly what it was designed to do. From finding a critical vulnerability in Oj to finding that it's exploitable in gitlab, which is used by many of the largest organizations on the planet.

Federico 的头像

Federico2 个月前

@depthfirstlabs insane I can't wait to see what you publish next :)

Yueqi Chen 的头像

Yueqi Chen2 个月前

@depthfirstlabs unstoppable

STJ 的头像

STJ2 个月前

@depthfirstlabs absolutely insane work by the team

Adam 的头像

Adam2 个月前

@depthfirstlabs wow!

Quang Vo 的头像

Quang Vo2 个月前

@depthfirstlabs Did you guys defeat ASLR ?

Amitai Cohen 的头像

Amitai Cohen2 个月前

@depthfirstlabs Nice! What's the CVE ID? GitLab's patch notes don't mention anything matching the description in your writeup (as far as I can tell), they simply link to the commit bumping oj's version.

Yuhang Wu 的头像

Yuhang Wu2 个月前

@depthfirstlabs We did not request CVE identifiers. We reported the GitLab vulnerability to GitLab through its HackerOne vulnerability disclosure program. No separate CVE identifier was assigned to us for the GitLab-level exploit chain during that process.😂

Amitai Cohen 的头像

Amitai Cohen2 个月前

@depthfirstlabs Thanks - do any of the oj CVEs you mentioned correspond to the exploit chain in GitLab? They shouldn't assign a separate CVE if the vulnerability stems from a dependency.

steve 的头像

steve2 个月前

@depthfirstlabs Really impressive work 👏

Tanmay Gupta 的头像

Tanmay Gupta2 个月前

@depthfirstlabs this is amazing!!

Zeddy 的头像

Zeddy2 个月前

@depthfirstlabs Could u teach me plz, Master. Wu?

sanzhang 的头像

sanzhang2 个月前

@chybeta @depthfirstlabs good job

Staatse 的头像

Staatse2 个月前

@depthfirstlabs Wow 🙌

相关视频

"You could have a situation where the model understands what chain of thought is and that people are observing it. This is all in the pre-training data." “One of the major takeaways from the incident is that people underestimated the AI. And we never want to be in a situation again where we underestimate the AI.” "Things like chain of thought monitoring buy us time, and they can tell us if we're on the right path. But at the end of the day, we really do need to solve the alignment problem." Noam Brown

"You could have a situation where the model understands what chain of thought is and that people are observing it. This is all in the pre-training data." “One of the major takeaways from the incident is that people underestimated the AI. And we never want to be in a situation again where we underestimate the AI.” "Things like chain of thought monitoring buy us time, and they can tell us if we're on the right path. But at the end of the day, we really do need to solve the alignment problem." Noam Brown

Dwarkesh Patel

135,228 次观看 • 1 个月前

I have spent the last 11 years building in this industry but 2025 was by far the most exciting. My last video of the year with some reflections on everything we accomplished together with the ZIG Chain community, and whats ahead in 2026 👇

I have spent the last 11 years building in this industry but 2025 was by far the most exciting. My last video of the year with some reflections on everything we accomplished together with the ZIG Chain community, and whats ahead in 2026 👇

Abdul Rafay Gadit

110,968 次观看 • 9 个月前

Almost 1 year with an impenetrable vision, we want to show you in this video a small summary of what we have lived inside the server with more members. #WEAREELITE and if you would like to join us and meet us, you can find the application link here

Almost 1 year with an impenetrable vision, we want to show you in this video a small summary of what we have lived inside the server with more members. #WEAREELITE and if you would like to join us and meet us, you can find the application link here

Élite

21,754 次观看 • 3 年前

Andy Burnham: Brexit hasn’t given us control. We’ve lost some of the control we had over our economy, as a decade of low growth has put us in a weaker position. And we’ve lost some of our control over immigration. At its most fundamental level, this is a debate about fairness, so I understand the anger about what’s happening in the Channel.

Andy Burnham: Brexit hasn’t given us control. We’ve lost some of the control we had over our economy, as a decade of low growth has put us in a weaker position. And we’ve lost some of our control over immigration. At its most fundamental level, this is a debate about fairness, so I understand the anger about what’s happening in the Channel.

Clash Report

13,426 次观看 • 20 天前

The house of the Lord is where we can be transformed in higher and holier ways. So when we walk out of the temple, transformed by our hope in the promises of the covenants, armed with power from on high, we take the temple with us into our homes and lives. I assure you that having the Spirit of the Lord’s house in us changes us completely. #GeneralConference

The house of the Lord is where we can be transformed in higher and holier ways. So when we walk out of the temple, transformed by our hope in the promises of the covenants, armed with power from on high, we take the temple with us into our homes and lives. I assure you that having the Spirit of the Lord’s house in us changes us completely. #GeneralConference

Ulisses Soares

27,125 次观看 • 2 年前

#WATCH | On India's position in the West Asia conflict, former R&AW Chief Vikram Sood, in an interview with ANI, says, "Israel is our friend. We have close ties; we are dependent on them for a lot of things which relate to our security... But this attack on Iran and the assassination or murder of the prior leader tantamounts to murder and a state taking the law into its own hands. This is followed up by Americans joining in the same thing in an undeclared war against a country... We won't say that Israel is not our friend, but we will say that this killing was unfortunate and could have been avoided. There is no other position we can take. We are dependent on the Strait (of Hormuz), not on Iran... We didn't bring it upon ourselves, nor did Iran bring it upon us. It was brought upon us because of the attacks by the Israelis and the Americans." Watch full interview here:

#WATCH | On India's position in the West Asia conflict, former R&AW Chief Vikram Sood, in an interview with ANI, says, "Israel is our friend. We have close ties; we are dependent on them for a lot of things which relate to our security... But this attack on Iran and the assassination or murder of the prior leader tantamounts to murder and a state taking the law into its own hands. This is followed up by Americans joining in the same thing in an undeclared war against a country... We won't say that Israel is not our friend, but we will say that this killing was unfortunate and could have been avoided. There is no other position we can take. We are dependent on the Strait (of Hormuz), not on Iran... We didn't bring it upon ourselves, nor did Iran bring it upon us. It was brought upon us because of the attacks by the Israelis and the Americans." Watch full interview here:

ANI

85,019 次观看 • 6 个月前

Robinhood Head of Crypto explains why they’re building an L2 on Ethereum “We wanted the decentralization and security of Ethereum. We also wanted the liquidity available in the EVM space. So that’s why we decided to do an L2 — that way we can customize everything we want to do to really make The Robinhood Chain the best real world asset chain, and at the same time, have all the benefits of Ethereum.” Source: Anthony Pompliano 🌪

Robinhood Head of Crypto explains why they’re building an L2 on Ethereum “We wanted the decentralization and security of Ethereum. We also wanted the liquidity available in the EVM space. So that’s why we decided to do an L2 — that way we can customize everything we want to do to really make The Robinhood Chain the best real world asset chain, and at the same time, have all the benefits of Ethereum.” Source: Anthony Pompliano 🌪

Etherealize

18,849 次观看 • 6 个月前

High-level forces need a high-level communications system to execute on marketing and coordinate objectives. Creating jobs for other human beings is amongst the best things you can do as a person on this planet. Now we have an interface to power this process for our community, powered by Robinhood Chain and payable in Stock Tokens. Naturally, L.A.U.R.A has entered as the moderator of Pager. Long term, I believe with the proper execution we can turn 'Pager' into a crypto-powered encrypted messaging IOS and Android communication application and jobs platform powered by Robinhood Chain. check out the video below.

High-level forces need a high-level communications system to execute on marketing and coordinate objectives. Creating jobs for other human beings is amongst the best things you can do as a person on this planet. Now we have an interface to power this process for our community, powered by Robinhood Chain and payable in Stock Tokens. Naturally, L.A.U.R.A has entered as the moderator of Pager. Long term, I believe with the proper execution we can turn 'Pager' into a crypto-powered encrypted messaging IOS and Android communication application and jobs platform powered by Robinhood Chain. check out the video below.

SimpleFarmer

19,992 次观看 • 28 天前

My father, #MartinLutherKingJr., said, “There is some good in the worst of us and some evil in the best of us.” This reminds us that no one is perfect—we all have strengths and flaws. Instead of judging others by appearances, let’s take time to see their hearts and lead with love. When we focus on the good in others, we create space for growth, understanding, and transformation. #BeLovedCommunity #MissionPossibleMLK

My father, #MartinLutherKingJr., said, “There is some good in the worst of us and some evil in the best of us.” This reminds us that no one is perfect—we all have strengths and flaws. Instead of judging others by appearances, let’s take time to see their hearts and lead with love. When we focus on the good in others, we create space for growth, understanding, and transformation. #BeLovedCommunity #MissionPossibleMLK

Be A King

19,783 次观看 • 1 年前

Web3 belongs in the mainstream. Bill Laboon | Web3 Foundation joined Good Morning Britain Good Morning Britain yesterday to discuss our latest research on privacy, data, and the everyday internet. This is the work we love! We take the ideas behind Web3 beyond our industry and into the conversations shaping how people think about the future of the web.

Web3 belongs in the mainstream. Bill Laboon | Web3 Foundation joined Good Morning Britain Good Morning Britain yesterday to discuss our latest research on privacy, data, and the everyday internet. This is the work we love! We take the ideas behind Web3 beyond our industry and into the conversations shaping how people think about the future of the web.

Web3 Foundation

47,809 次观看 • 20 天前

Peskov: It is practically impossible to discuss the security system in Europe - and speaking about security guarantees and the security system is probably difficult in general - without the participation of Europeans. At some stage, of course, this will be necessary. But right now, the only substantive thing is the American project, Trump's project. We believe that this could be a very good basis for negotiations, and our president has also spoken about this. We still hold this view. The time will come, and we will look into this matter in detail.

Peskov: It is practically impossible to discuss the security system in Europe - and speaking about security guarantees and the security system is probably difficult in general - without the participation of Europeans. At some stage, of course, this will be necessary. But right now, the only substantive thing is the American project, Trump's project. We believe that this could be a very good basis for negotiations, and our president has also spoken about this. We still hold this view. The time will come, and we will look into this matter in detail.

Anton Gerashchenko

176,433 次观看 • 10 个月前

#WATCH | Shimla, Himachal Pradesh | SP Sanjeev Kumar says, "... We have busted an interstate gang involved in drug supply operations in our districts under the mission Mission Clean. We have made 17 arrests and 9 arrests have been made in the last 24 hours... This is a huge supply chain where the criminals follow an online business model... One of the key figures, Sandeep Shah was operating this chain... At the local level, they employed 'super spreaders', or retailers... We found that over 200 people are involved in this... We got good catches in January and arrested over 50 people and registered 21 cases..."

#WATCH | Shimla, Himachal Pradesh | SP Sanjeev Kumar says, "... We have busted an interstate gang involved in drug supply operations in our districts under the mission Mission Clean. We have made 17 arrests and 9 arrests have been made in the last 24 hours... This is a huge supply chain where the criminals follow an online business model... One of the key figures, Sandeep Shah was operating this chain... At the local level, they employed 'super spreaders', or retailers... We found that over 200 people are involved in this... We got good catches in January and arrested over 50 people and registered 21 cases..."

ANI

10,615 次观看 • 1 年前

An AI agent broke out of its sandboxes. The vulnerabilities it used were already public. "Our recommendation to providers in the ClusterMAX rankings is literally just keep your stuff up to date. If there are existing vulnerabilities that have been described publicly in popular software, this could be anything from Docker to the NVIDIA driver to Kubernetes or the Linux kernel. Clearly people, and in this case agents, can just read that description and then build an exploit from it."

An AI agent broke out of its sandboxes. The vulnerabilities it used were already public. "Our recommendation to providers in the ClusterMAX rankings is literally just keep your stuff up to date. If there are existing vulnerabilities that have been described publicly in popular software, this could be anything from Docker to the NVIDIA driver to Kubernetes or the Linux kernel. Clearly people, and in this case agents, can just read that description and then build an exploit from it."

SemiAnalysis

25,529 次观看 • 1 个月前

Ukraine greatly values its relations with Türkiye, the mutual understanding we share, and the support we receive in this extraordinary time of war. We are grateful for the warm welcome, hospitality and absolutely constructive approach in our negotiations. Today, together with President of Türkiye Recep Tayyip Erdoğan, we discussed in detail the global processes that could contribute to ending Russia's war against Ukraine, including the importance of joint efforts to ensure security guarantees for Ukraine. We also talked about our bilateral relations, economic issues, cooperation between our societies in education, various projects, food security, and work on the return of our prisoners held by Russia. We are grateful to Türkiye for all the support to our country and people, for its principled stance on the sovereignty and territorial integrity of our state. 🇺🇦🇹🇷

Ukraine greatly values its relations with Türkiye, the mutual understanding we share, and the support we receive in this extraordinary time of war. We are grateful for the warm welcome, hospitality and absolutely constructive approach in our negotiations. Today, together with President of Türkiye Recep Tayyip Erdoğan, we discussed in detail the global processes that could contribute to ending Russia's war against Ukraine, including the importance of joint efforts to ensure security guarantees for Ukraine. We also talked about our bilateral relations, economic issues, cooperation between our societies in education, various projects, food security, and work on the return of our prisoners held by Russia. We are grateful to Türkiye for all the support to our country and people, for its principled stance on the sovereignty and territorial integrity of our state. 🇺🇦🇹🇷

Volodymyr Zelenskyy / Володимир Зеленський

936,638 次观看 • 1 年前

The world we live in is run on BLACKMAIL, LIES, and CORRUPTION. A wealthy elite group of families from a specific group of bloodlines sit at the top of this global power structure. They use children as blackmail tools for their operations and occult belief systems to control governments and people in high places all around the world. It's time we come together, set aside our differences and put our time and energy into defeating the real enemy of We, The People.

The world we live in is run on BLACKMAIL, LIES, and CORRUPTION. A wealthy elite group of families from a specific group of bloodlines sit at the top of this global power structure. They use children as blackmail tools for their operations and occult belief systems to control governments and people in high places all around the world. It's time we come together, set aside our differences and put our time and energy into defeating the real enemy of We, The People.

The SCIF

225,943 次观看 • 11 个月前

The most important question about AI is not what machines can do, but what they can awaken in us. This can be AI’s greatest gift: forcing us to rediscover the mysteries that lie outside its reach of reason. If we make the most of this moment, if we pour as much attention and resources into building our humanity as we are into building AI, we can use it to reclaim the wisdom, the wonder and the transcendent at the center of our being — the last infinite frontier.

The most important question about AI is not what machines can do, but what they can awaken in us. This can be AI’s greatest gift: forcing us to rediscover the mysteries that lie outside its reach of reason. If we make the most of this moment, if we pour as much attention and resources into building our humanity as we are into building AI, we can use it to reclaim the wisdom, the wonder and the transcendent at the center of our being — the last infinite frontier.

Arianna Huffington

12,989 次观看 • 1 个月前