Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Nonce CSP bypass using disk cache, ‘quiet side channel’ for request smuggling, Amazon Q and the malicious pull request – ethical hacker news roundup

yeswehack.com | blog | #csp | #gemini-cli | #roundup | #disk-cache | #http-smuggling | #amazon-q

Summary

Roundup: Jorian Woltjer's nonce CSP bypass via bfcache and disk cache, d3d's trust-based HTTP smuggling C2 channel, Tracebit's Gemini CLI hijack, and the malicious Amazon Q pull request.
Published
Collected

original ↗

Related coverage

  1. Chunked-body parsing flaws, making self-XSS great again, using HTTP redirect loops to achieve non-blind SSRFs – ethical hacker news roundup (yeswehack.com)
  2. Rickrolling the World Cup, unleashing AI across Google, 0-click stored XSS on Next.js – ethical hacker roundup (yeswehack.com)
  3. ‘AI a force multiplier not a replacement’, small vs large models, the state of vibe-coded security – ethical hacker news roundup (yeswehack.com)
  4. The Mythos moment, accelerating exploits, CVE Program under pressure – offsec roundup for CISOs (yeswehack.com)
  5. Notepad++ hijack, pwning Claude Code, top web hacking techniques of 2025 – ethical hacker news roundup (yeswehack.com)
  6. LLM bug hunters lack intuition, ‘security teams will consolidate visibility’ in 2026, EU Cyber Act vuln disclosure revisions – offsec roundup for CISOs (yeswehack.com)

back