PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Why ‘HTTP/1.1 must die’, Intel exploits, C# Random hack with no maths – ethical hacker news roundup

yeswehack.com | blog | #bug-bounty | #http-desync | #responsible-disclosure | #intel | #csharp | #roundup
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Roundup: James Kettle's 'HTTP/1.1 must die' desync research, Eaton Zveare's Intel exploits, Doyensec's black-box C# Random account takeover, and a US court ruling's implications for disclosure.
Published
Collected

Related coverage

blog · yeswehack.com
US court ruling on Uber breach slammed, red teamers cautious on AI, OffSec offers ‘strategic edge’ – OffSec roundup for CISOs
Roundup: a US court ruling on Uber's breach case raises concerns for responsible disclosure; a UK report finds red teams rarely use AI beyond basics; PwC calls offensive security a necessity.
blog · yeswehack.com
James Kettle’s ‘autonomous research cascade’, CRLF-powered desync attacks, RCE on humanoid robots – ethical hacker news roundup
This roundup covers James Kettle's autonomous research cascade, CRLF-powered desync attacks, a CSS bomb in webmail, and unauthenticated root RCE on Unitree G1 robots.
blog · yeswehack.com
‘I usually choose targets that offer value to society’: krevetk0 on his principled approach to Bug Bounty hunting
Berlin-based Bug Bounty hunter krevetk0 talks about moving from QA into hacking, choosing socially valuable targets such as healthcare and banking, and the findings that shaped his career.
blog · yeswehack.com
How to use Claude Code for Bug Bounty: find fast, validate manually
In blind bug bounty labs, Claude Code excelled at recon and source review for DOM XSS and H2.TE request smuggling but stalled at proving exploitability — a teammate, not a replacement.
blog · yeswehack.com
‘AI a force multiplier not a replacement’, small vs large models, the state of vibe-coded security – ethical hacker news roundup
Roundup: Xclow3n argues AI is a force multiplier but expert judgment still separates noise from CVEs; LiveOverflow finds smaller LLMs win on cost-to-recall; plus the state of vibe-coded security.
blog · yeswehack.com
The Mythos moment, accelerating exploits, CVE Program under pressure – offsec roundup for CISOs
A CISO roundup: Anthropic's Mythos delay as part of exploitation-automation trends, why Bug Bounty still matters amid record Google payouts, shrinking time-to-exploitation and CVE Program pressure.
Back