PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Vyper hack timeline

osec.io | vulnerability | #incident-response | #compiler | #vyper | #reentrancy | #whitehat | #curve
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

OtterSec's timeline of the Vyper compiler reentrancy bug that drained Curve pools: discovery, the race against blackhats, whitehat rescues, and lessons on disclosure.
Published
Collected

Related coverage

vulnerability · borghq.io
PHP2Shell CVE-2026-109618: What to Do Right Now
Facing PHP2Shell CVE-2026-109618? Here is what is verified before the 14:00 UTC patch, what remains unconfirmed, and your patch-day checklist.
vulnerability · hunt.io
[CVE-2026-15409] UK Council Attack Linked to SonicWall SMA 1000 Campaign
Hunt.io links a UK council breach to mass exploitation of SonicWall SMA1000 CVE-2026-15409: LDAP credentials from 168 appliances, secretsdump run on-device, DCSync in five AD environments.
High · vulnerability · github.com
PHP 8.5.5: var_destroy __destruct Reentrancy Heap UAF and Exploitation
Demonstrates how subtle lock-free destructor reentry in complex serialization state machines can yield reliable memory corruption and RCE, even when explicit magic method dispatches are guarded.
vulnerability · vercel.com
Postmortem on Next.js Middleware bypass
Last week, we published CVE-2025-29927 and patched a critical severity vulnerability in Next.js. Here’s our post-incident analysis and next steps.
blog · osec.io
Compiler bug causes compiler bug: how a 12-year-old g++ bug took down Solidity
OtterSec explains how a 12-year-old G++ overload-resolution bug, C++20 comparison rewrites and legacy Boost code crash Solidity's compiler (solc) on valid code — and how to fix it.
blog · osec.io
Solidity compilers: memory safety
OtterSec explores the Solidity compilation pipeline and YUL optimizer assumptions to explain what 'memory-safe' assembly actually guarantees — and where inline assembly breaks those guarantees.
Back