PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

How HackerOne Disproved an MFA Bypass With a Spot Check

hackerone.com | blog | #bug-bounty | #incident-response | #authentication | #security-testing | #mfa | #hackerone | #spot-check
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

HackerOne's internal security team used a focused Spot Check to disprove an unverified claim of an MFA bypass in its platform, after a threat actor offered the alleged details for sale on X.
Published
Collected

Related coverage

blog · netspi.com
Why TOTP Won’t Cut It (And What to Consider Instead)
NetSPI examines why TOTP codes no longer stop determined attackers, walking through a brute force scenario and recommending stronger 2FA alternatives to replace time-based one-time passwords.
blog · netspi.com
Multi-Factor Authentication: The Bare Minimum of IAM
Sectigo CTO Jason Soroko joins the Agent of Influence podcast to explain why MFA is the bare minimum of IAM, covering symmetric vs. asymmetric secrets and digital certificate best practices.
research · projectdiscovery.io
PHP2Shell: finding and patching affected PHP
Two CVSS 9.2 bugs in the PHP runtime allow unauthenticated code execution; the patch is a package upgrade and a restart, and this guide shows how to find every PHP runtime you need to patch.
blog · hackerone.com
Measuring The Fix: How We Evaluate Frontier Models on Remediation Quality
HackerOne tested frontier models on security fix quality and found the judge mattered more than the model. See how CTEM remediation earns engineer trust.
blog · hackerone.com
Critical PHP Vulnerabilities: What Security Teams Need to Know
Learn about the critical PHP vulnerabilities, HackerOne’s response, and the rise in reports. Review patching guidance and coordinated disclosure practices.
blog · hackerone.com
Project Glasswing: What We Learned Running a Frontier Model on Our Own Codebase
HackerOne ran Anthropic's Mythos 5 model against its own production code; it surfaced a critical RCE spanning three safe-in-isolation commits, illustrating compositional risk that diff review misses.
Back