PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Hacking Unicode Like a Boss

bugcrowd.com | vulnerability | #github | #guest-post | #password-reset | #unicode | #case-mapping | #hands-on-lab
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Charlie Eriksen breaks down the Unicode case mapping collision behind GitHub's password-reset flaw and ships a hands-on lab so researchers can practice exploiting this vulnerability class safely.
Published
Collected

Related coverage

vulnerability · bugcrowd.com
[GUEST POST] The Impact of our Researchers – StackPath and Vulnerability Disclosure
Edge CDN StackPath credits Bugcrowd's managed VDP with scaling its vulnerability disclosure, noting that creative P3/P4 submissions often prove as valuable as critical P1s for training and hardening.
vulnerability · bugcrowd.com
[Guest Post] Instructure’s Proven Security Vulnerability Disclosure Program
Instructure's security VP describes its Bugcrowd-hosted VDP, prompted by a DEF CON talk on hard-to-report school software flaws, and invited the young researcher behind it to its private bounty.
vulnerability · bugcrowd.com
[Guest Post] Vulnerability Disclosure at Okta: Everything You Need to Know
Okta announces a formal vulnerability disclosure policy after five years of bug bounties, standardizing scope, coordinated disclosure terms, and reporting channels alongside its Bugcrowd program.
Medium · vulnerability · github.com
CVE-2026-84636: Apple iOS/macOS SCDynamicStore Wi-Fi SSID Info Disclosure PoC
Wi-Fi SSID data is strictly guarded as sensitive location telemetry on iOS. This PoC shows that third-party applications could bypass sandbox entitlement checks via SCDynamicStore to silently track user network environments and physical locations.
Critical · vulnerability · github.com
php2shell-zeros: Unpatched 0-Day RCE Flaws and Weaponized Exploit Chains in PHP and NativePHP
These surviving flaws bypass earlier patches and demonstrate that core PHP deserialization and memory management remain fundamentally fragile, posing critical unauthenticated RCE risks to WordPress and production PHP services.
Critical · vulnerability · github.com
php2shell (CVE-2026-109618 / CVE-2026-109619): PHP Pre-Auth RCE PoC, Source Patch & Comprehensive Defense Guide
Provides critical stopgap mitigations, source-level patches, and multi-web-server WAF rules for teams securing PHP deployments, especially for unpatched legacy and end-of-life installations.
Back