PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Hacker Spotlight: Interview with cdl

hackerone.com | research | #bug-bounty | #cve | #hacker-spotlight | #interview | #hackerone
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Interview with Corben Leo (@cdl), a Dakota State student and bug bounty hunter with 13 CVE IDs, hall-of-fame recognition from Apple, Google, and Microsoft, and founder of Lynx Security.
Published
Collected

Related coverage

research · portswigger.net
Responsible denial of service with web cache poisoning
James Kettle shows how web cache poisoning can take down websites with a single request without collateral damage, earning bounties from Tesla and HackerOne along the way.
research · bishopfox.com
Separating Signal from Slop: Triaging CVEs in the Age of AI Security Research
CVE disclosures are up 85% while exploitation barely moved. Bishop Fox breaks down four Nginx CVEs that looked critical but rarely affect real deployments.
research · github.com
Steal My Bitcoin Challenge Writeup: PHP 8.4.26 Session Upload Progress Memory Exhaustion Analysis
Provides a detailed binary-level case study on PHP Zend memory manager behavior and worker state persistence after fatal out-of-memory errors.
research · projectdiscovery.io
PHP2Shell: finding and patching affected PHP
Two CVSS 9.2 bugs in the PHP runtime allow unauthenticated code execution; the patch is a package upgrade and a restart, and this guide shows how to find every PHP runtime you need to patch.
research · github.com
php2shell: Pure HTTP Full-Chain RCE and ASLR Bypass on Stock PHP 8.4 Configurations
Overcomes historical constraints where PHP heap exploitation required display_errors=On, restricted memory limits, or target application vulnerabilities, demonstrating reliable pure-HTTP RCE and ASLR defeat against standard production ini configurations.
research · crowdstrike.com
CrowdStrike Protects Customers from Threats Delivered via PHP2Shell
The Falcon platform provides out-of-the-box visibility and detection coverage for post-exploitation activities of CVE-2026-109618 and CVE-2026-109619.
Back