4404 Founders4h ago · 7 min readGitLab CVE-2026-110264: CVSS 10.0 RCE Hits 12 Years of ReleasesOne researcher found four Onigmo regex engine flaws in GitLab in a single month. The latest, CVE-2026-110264, could under certain conditions let an unauthenticated attacker execute arbitrary code on s404-founders.com
LLưu Tuấn Anh20h ago · 14 min readFrom PDF file uploads to server hijacking: An in-depth analysis of the Ghostscript vulnerability CVE-2026-39919Introduction to Ghostscript If you are running a WordPress website, a content management system (CMS) or an online application portal, chances are your server is running Ghostscript every day without 1Ablog.fiscybersec.com
Cc0wkingOct 6 · 10 min readA Certificate Name That Runs as Root: Five Bugs in Sophos Firewall, Found with CodexA firewall appliance is one of those boxes where the job description and the threat model are the same sentence. It sits at the edge of the network, it terminates the VPN, it holds the credentials forblogs.night-wolf.io
Cc0wkingOct 6 · 17 min readFrom Graph Editor to Webshell: Finishing the Job CVE-2026-40079 Left OpenMost advisories end with "fixed." This one ended with a sentence that read like an open invitation: Status: PARTIALLY FIXED. The tune function is fixed. The graph rendering shell_exec path has residublogs.night-wolf.io
JJebitokSep 23 · 16 min readBeach Bar: Web x Boot2Root - RCE X Django (TryHackMe)Link to the challenge on TryHackMe: Beach Bar Concierge Briefing Welcome back to the Byte Lotus — this time the sand is warm, the deck lights are coming up, and the beach bar's jukebox takes requestssharonjebitok.com
YYogeshwar PeelaSep 10 · 10 min readTryHackMe - Olympus WriteupSummary Olympus is a Linux box built around an old Victor CMS 1.0 install hidden under /~webmaster/. An unauthenticated SQL injection in the CMS search feature was the root of the entire chain: it dumexploitnotes.hashnode.dev
JJebitokSep 9 · 25 min readShells & Listeners Fundamentals (TryHackMe)Link to the challenge on TryHackMe: Shells & Listeners Fundamentals Introduction In many real-world assessments, a minor bug becomes a foothold. Imagine a file upload feature that fails to validate cosharonjebitok.com
JJebitokSep 6 · 11 min readChallenge: Expose (TryHackMe)Challenge on TryHackme: Expose Introduction Expose is a TryHackMe room focused on the risks of leaving unnecessary services running on a machine. The attack surface includes FTP, SSH, DNS, HTTP on a nsharonjebitok.com
4404 FoundersSep 5 · 5 min readCyber Alert: Kestra CVE-2026-49869 Gives Unauthenticated Attackers Root RCE in the Worker ContainerCyber Alert: Kestra CVE-2026-49869 Gives Unauthenticated Attackers Root RCE in the Worker Container CVE: CVE-2026-49869 Severity: Critical, CVSS 10.0 Affected: Kestra OSS before 1.0.45, and 1.1.0 thr404-founders.com
YYogeshwar PeelaAug 25 · 11 min readHackSmarter - Casino WriteupSummary Casino is a Flask-based "Guest WiFi & Portal" resort captive portal. A leaked JS source-map exposes an unauthenticated internal API endpoint (/api/v1/rooms/status) that dumps the entire guest exploitnotes.hashnode.dev
