PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

One-click RCE on OpenClaw in under 2 hours with an Autonomous Hacking Agent

ethiack.com | research | #ai-security | #rce | #zero-day | #account-takeover | #ai-pentesting | #openclaw | #ethiack
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Ethiack's Hackian agent found a one-click account-takeover-to-RCE chain in OpenClaw fully autonomously in under two hours, leaking the Gateway Control UI's auth token from an attacker-controlled site.
Published
Collected

Related coverage

Critical · vulnerability · github.com
php2shell-zeros: Unpatched 0-Day RCE Flaws and Weaponized Exploit Chains in PHP and NativePHP
These surviving flaws bypass earlier patches and demonstrate that core PHP deserialization and memory management remain fundamentally fragile, posing critical unauthenticated RCE risks to WordPress and production PHP services.
research · ethiack.com
Evaluating Pentesting Agents for the Real-World Part 2
Ethiack's EthiBench part 2 evaluates AI pentesting agents beyond single runs, covering significance under budget limits, cumulative detection, temporal behavior, and cost-effective target subsets.
research · ethiack.com
Evaluating Pentesting Agents for the Real-World
Ethiack launches EthiBench, an open evaluation protocol for AI pentesting agents using realistic targets, structured ground truth with LLM-as-a-judge matching, and richer metrics than success rates.
research · ethiack.com
Hackian and the Ghosts in Your Business Logic
Ethiack's Hackian agent exploited business-logic flaws scanners miss, chaining a SonarQube branch-metadata permission gap and a second access-control issue to reach private projects it shouldn't see.
research · ethiack.com
AI Pentesting Without the Noise: Hackbots and the Verifier
Ethiack explains how its hackbot pairs autonomous vulnerability discovery with a Verifier to curb AI hallucinations, and how OWASP Benchmark testing validates precision in black-box conditions.
research · github.com
Steal My Bitcoin Challenge Writeup: PHP 8.4.26 Session Upload Progress Memory Exhaustion Analysis
Provides a detailed binary-level case study on PHP Zend memory manager behavior and worker state persistence after fatal out-of-memory errors.
Back