PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2025-29927] Middleware mayhem, Zoolander banter PoC, Malta to pardon hackers over ‘unfair’ charges – ethical hacker news roundup

yeswehack.com | blog | CVE-2025-29927 | #ai-security | #bug-bounty | #vulnerability-research | #poc | #nextjs | #openai | #cve-2025-29927
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Roundup: Next.js CVE-2025-29927 middleware auth-bypass research, OpenAI raising AI bug bounties to $100,000, a Zoolander-themed MSRC PoC video spat, and Malta's pardon plans for hackers.
CVE
CVE-2025-29927
Published
Collected

Related coverage

vulnerability · vercel.com
Postmortem on Next.js Middleware bypass
Last week, we published CVE-2025-29927 and patched a critical severity vulnerability in Next.js. Here’s our post-incident analysis and next steps.
vulnerability · slcyber.io
Doing the Due Diligence: Analyzing the Next.js Middleware Bypass (CVE-2025-29927)
Assetnote performs a deep-dive analysis of the Next.js middleware authentication bypass CVE-2025-29927, covering in-the-wild exploitability.
vulnerability · projectdiscovery.io
CVE-2025-29927: Next.js Middleware Authorization Bypass - Technical Analysis
Next.js is an open-source web framework built by Vercel that powers React-based apps with features like server-side and static rendering. Recently, a critical vulnerability (CVE) was disclosed that lets attackers bypass middleware-based authorization checks. The issue was originally discovered and analyzed by Rachid Allam (zhero). In this blog, we’ll break down the vulnerability and walk through their research and will create a Nuclei template to help you detect it across your assets. The vulne
research · github.com
Steal My Bitcoin Challenge Writeup: PHP 8.4.26 Session Upload Progress Memory Exhaustion Analysis
Provides a detailed binary-level case study on PHP Zend memory manager behavior and worker state persistence after fatal out-of-memory errors.
research · projectdiscovery.io
PHP2Shell: finding and patching affected PHP
Two CVSS 9.2 bugs in the PHP runtime allow unauthenticated code execution; the patch is a package upgrade and a restart, and this guide shows how to find every PHP runtime you need to patch.
Critical · vulnerability · github.com
Next.js next/og SVG Injection to Native RCE Exploit PoC (CVE-2026-94545)
This PoC turns the vulnerability into a reliable, unauthenticated native ROP exploit; any Node.js deployment using next/og with sharp and user-controlled SVG parameters is at acute risk of instant server takeover.
Back