4404 Founders2d ago · 5 min readOracle EBS CVE-2026-101767: Unauthenticated SQL Injection That Chains to RCEA crafted unauthenticated request to the Thin Client Framework servlet gives an attacker SQL execution as the APPS database user, and the attack chain goes on to operating system commands. Probing sta404-founders.com
4404 Founders5d ago · 9 min readNode2Shell: How a Boolean Return Value Became a Critical Brotli RCEA function that returns true or false when three outcomes exist. CVE-2026-111497, the Brotli decoder out-of-bounds write, starts right there. On 22 October 2026, Imperva's red team used it for code ex404-founders.com
4404 FoundersOct 22 · 7 min readGitLab CVE-2026-110264: CVSS 10.0 RCE Hits 12 Years of ReleasesOne researcher found four Onigmo regex engine flaws in GitLab in a single month. The latest, CVE-2026-110264, could under certain conditions let an unauthenticated attacker execute arbitrary code on s1D404-founders.com
LLưu Tuấn AnhOct 22 · 14 min readFrom PDF file uploads to server hijacking: An in-depth analysis of the Ghostscript vulnerability CVE-2026-39919Introduction to Ghostscript If you are running a WordPress website, a content management system (CMS) or an online application portal, chances are your server is running Ghostscript every day without 1Ablog.fiscybersec.com
Cc0wkingOct 6 · 10 min readA Certificate Name That Runs as Root: Five Bugs in Sophos Firewall, Found with CodexA firewall appliance is one of those boxes where the job description and the threat model are the same sentence. It sits at the edge of the network, it terminates the VPN, it holds the credentials forblogs.night-wolf.io
Cc0wkingOct 6 · 17 min readFrom Graph Editor to Webshell: Finishing the Job CVE-2026-40079 Left OpenMost advisories end with "fixed." This one ended with a sentence that read like an open invitation: Status: PARTIALLY FIXED. The tune function is fixed. The graph rendering shell_exec path has residublogs.night-wolf.io
JJebitokSep 23 · 16 min readBeach Bar: Web x Boot2Root - RCE X Django (TryHackMe)Link to the challenge on TryHackMe: Beach Bar Concierge Briefing Welcome back to the Byte Lotus — this time the sand is warm, the deck lights are coming up, and the beach bar's jukebox takes requestssharonjebitok.com
YYogeshwar PeelaSep 10 · 10 min readTryHackMe - Olympus WriteupSummary Olympus is a Linux box built around an old Victor CMS 1.0 install hidden under /~webmaster/. An unauthenticated SQL injection in the CMS search feature was the root of the entire chain: it dumexploitnotes.hashnode.dev
JJebitokSep 9 · 25 min readShells & Listeners Fundamentals (TryHackMe)Link to the challenge on TryHackMe: Shells & Listeners Fundamentals Introduction In many real-world assessments, a minor bug becomes a foothold. Imagine a file upload feature that fails to validate cosharonjebitok.com
JJebitokSep 6 · 11 min readChallenge: Expose (TryHackMe)Challenge on TryHackme: Expose Introduction Expose is a TryHackMe room focused on the risks of leaving unnecessary services running on a machine. The attack surface includes FTP, SSH, DNS, HTTP on a nsharonjebitok.com