Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Breaking Into PostHog Prod Database

hacktron.ai | blog | #rce | #vulnerability-research | #claude | #posthog | #v8-exploit | #llm-assisted

Summary

Escalating a Hacktron finding into a PostHog production RCE using Claude, and challenging open-weight models to write the same V8 exploit.
Published
Collected

original ↗

Related coverage

blog · projectzero.google
Taming the wild copy: Parallel Thread Corruption
A Google Project Zero post on a 'wild copy' parallel thread memory corruption bug and its exploitation.
research · starlabs.sg
Dirty Cert: Cisco Smart Software Manager's Silently Patched RCE
Post-auth RCE in Cisco Smart Software Manager (CSSM): command injection in nginx certificate upload, where openssl checks run via childProcess.execSync. Cisco silently patched it in 10-202608.
research · idnsec.com
Mitigating RCE Impact Like in OpenAI Hack with Defense-in-Depth
Using HacktronAI's OpenAI Discourse hack disclosure, this article covers sandboxing, runtime protection, and AI-assisted defense to shrink the blast radius of RCE across interconnected apps.
vulnerability · idnsec.com
[CVE-2026-93485] Comment2XSS: Zero-Click Pre-Auth XSS to Potential RCE in WordPress Core
An unauthenticated stored XSS (CVE-2026-93485) in WordPress core's wpautop() turns crafted comments into zero-click XSS, escalating to RCE via the admin session. Fixed in 7.1.1, backported to 4.7.36.
research · projectzero.google
Finding and exploiting ntpd vulnerabilities
A Google Project Zero guest post telling how one of the researchers found and exploited vulnerabilities in the ntpd network time server.
blog · bishopfox.com
AI Finds Vulnerabilities. Security Experts Find Impact.
A Bishop Fox consultant walks through an assessment where Claude sped up source review to roughly 80% of the effort, but validating findings and proving impact still demanded human judgment.
back