PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Rickrolling the World Cup, unleashing AI across Google, 0-click stored XSS on Next.js – ethical hacker roundup

yeswehack.com | blog | #ai-security | #vulnerability-research | #github | #web-security | #xss | #vulnerability-disclosure | #nextjs | #roundup | #fifa
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Ethical hacker roundup: a FIFA platform flaw that could have rickrolled World Cup broadcasts, a one-click github.dev OAuth token theft, and a 0-click stored XSS in Next.js.
Published
Collected

Related coverage

research · vercel.com
DeepsecBench: evaluating model performance in finding cybersecurity vulnerabilities
Today we're releasing DeepsecBench, a benchmark that evaluates how well different models find security vulnerabilities in application code.
blog · vercel.com
The three types of AI bot traffic and how to handle them
Bots account for over 20% of all web traffic. A quarter of that is AI crawlers alone. But not all bots are bad. Some are key to how your site gets discovered. Learn how AI bots shape visibility and what happens if you block them.
blog · projectzero.google
Project Zero Patch Tuesday roundup, November 2014
A Google Project Zero roundup of the November 2014 Patch Tuesday advisories covering bugs reported by the team.
research · github.com
Steal My Bitcoin Challenge Writeup: PHP 8.4.26 Session Upload Progress Memory Exhaustion Analysis
Provides a detailed binary-level case study on PHP Zend memory manager behavior and worker state persistence after fatal out-of-memory errors.
tool · github.com
Apple Private Cloud Compute (PCC) Security Source Code and Research Tools
Provides unprecedented source-level visibility into Apple's cloud AI infrastructure, allowing security researchers to verify cryptographic privacy guarantees and audit components eligible for Apple's PCC Security Bounty.
Critical · advisory · github.com
[CVE-2026-94545] Remote Code Execution in next/og ImageResponse
Dynamic Open Graph image generation is common in Next.js apps; any route accepting user parameters to customize SVG cards could lead to full Node.js server compromise.
Back