Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Inside CertiK's Independent Security Research on Besu

certik.com | research | #web3 | #vulnerability-research | #security-research | #vulnerability-disclosure | #blockchain | #chaos-engineering | #besu | #testnet | #blockchain-network | #certik | #resource-exhaustion

Summary

CertiK's chaos-engineering-style testing against a private multi-node Besu testnet uncovered five resource-exhaustion vulnerabilities, patched in Besu 26.7.1 and credited in Besu's release notes.
Published
Collected

original ↗

Related coverage

blog · projectzero.google
Announcing Project Zero
The founding announcement of Google Project Zero, a team dedicated to researching and reporting security bugs with the goal of making the internet safer.
research · bughunters.google.com
Google's PageBreak Project – Real-World Findings
This post provides a technical deep dive into specific, real-world vulnerabilities discovered by Google's PageBreak scanner
research · starlabs.sg
[CVE-2025-39964] How I Found a $113,337 AF_ALG Linux Local Privilege Escalation Before Copy Fail
A retrospective on CVE-2025-39964, an AF_ALG race condition causing out-of-bounds scatterlist access in the Linux kernel. Exploitation yields root and a Docker container escape.
research · starlabs.sg
Dirty Cert: Cisco Smart Software Manager's Silently Patched RCE
Post-auth RCE in Cisco Smart Software Manager (CSSM): command injection in nginx certificate upload, where openssl checks run via childProcess.execSync. Cisco silently patched it in 10-202608.
research · idnsec.com
Hacking Campaign and SEO Cloaking of Indonesian Illegal Gambling
Cybercrime-as-a-Service crews hack websites into ad infrastructure for Indonesia's illegal gambling market, abusing SEO cloaking and AMP pages to rank gambling content in targeted search results.
research · idnsec.com
Mitigating RCE Impact Like in OpenAI Hack with Defense-in-Depth
Using HacktronAI's OpenAI Discourse hack disclosure, this article covers sandboxing, runtime protection, and AI-assisted defense to shrink the blast radius of RCE across interconnected apps.
back