Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Mitigating RCE Impact Like in OpenAI Hack with Defense-in-Depth

idnsec.com | research | #ai-security | #rce | #vulnerability-research | #web-security | #sandboxing | #libheif | #discourse | #application-security | #openai | #defense-in-depth | #imagemagick | #openai-hack | #hacktronai | #landlock | #seccomp

Summary

Using HacktronAI's OpenAI Discourse hack disclosure, this article covers sandboxing, runtime protection, and AI-assisted defense to shrink the blast radius of RCE across interconnected apps.
Published
Collected

original ↗

Related coverage

research · starlabs.sg
Dirty Cert: Cisco Smart Software Manager's Silently Patched RCE
Post-auth RCE in Cisco Smart Software Manager (CSSM): command injection in nginx certificate upload, where openssl checks run via childProcess.execSync. Cisco silently patched it in 10-202608.
research · github.com
[CVE-2024-6100] CyberKimi Benchmarks: Autonomous Exploitation Traces & Evidence
Provides verifiable, transparent evidence of advanced LLMs performing complex, multi-step binary and browser exploitation autonomously under strict ASLR and memory randomization defenses.
research · starlabs.sg
When AI Makes 0-Days Feel Like N-Days
The author used AI to find a UAF bug in Linux net/sched and built an LPE exploit for CentOS 9 at TyphoonPwn 2026. AI sped things up, but deep subsystem knowledge still mattered.
research · projectzero.google
Finding and exploiting ntpd vulnerabilities
A Google Project Zero guest post telling how one of the researchers found and exploited vulnerabilities in the ntpd network time server.
vulnerability · idnsec.com
[CVE-2026-93485] Comment2XSS: Zero-Click Pre-Auth XSS to Potential RCE in WordPress Core
An unauthenticated stored XSS (CVE-2026-93485) in WordPress core's wpautop() turns crafted comments into zero-click XSS, escalating to RCE via the admin session. Fixed in 7.1.1, backported to 4.7.36.
blog · bugcrowd.com
Savant Forge: Automated offensive testing to keep pace with AI-generated code
Bugcrowd's Savant Forge combines fuzz testing with symbolic execution to surface real exploitable vulnerabilities in CI/CD pipelines, while Savant Runtime tracks live third-party components in production to support SBOM compliance.
back