← Feed

Posts

• View post

  Released a PowerShell IoC triage script for detecting the Notepad++ supply chain attack, including the previously known Rapid7 IoCs and now the newly released IoCs for chains 1 (ProShow) & 2 (Lua/Adobe) published by Securelist (https://securelist.com/notepad-supply-chain-attack/118708/): https://github.com/moltenbit/NotepadPlusPlus-Attack-Triage #cybersecurity #vulnerability #incidentresponse #notepadplusplus #supplychainattack

• View post

  Found a bypass in Wazuh's UNC path validation for Windows agents. The existing mitigation (CVE-2025-30201) blocked standard UNC paths like \\server\share, but extended-length UNC paths using the \\?\UNC\ prefix slipped right through. This affects the OSQuery wodle's log_path and config_path fields. Impact: An attacker who controls the centralized agent config can coerce domain-joined Windows agents into authenticating to an attacker-controlled SMB server, leaking the machine ac...

• View post

  New blog post: I found two authorization bypasses in Zammad's new AI text tools feature, two weeks after 7.0 shipped. Any agent could execute group-restricted tools and pull ticket data from other groups via a single API call. Patched in 7.0.1, three CVEs from this audit. https://moltenbit.net/posts/bypassing-zammad-ai-text-tool-authorization-via-rest-api/ #infosec #zammad #cybersecurity #responsibleDisclosure #security

• View post

  released should-i-care, a skill for single-CVE applicability triage. scanners tell you a product/version matches a CVE. this checks whether the CVE actually applies: deployment model, feature flags, config, distro backport status. it reasons against an environment profile it maintains for you and returns affected / not affected / needs verification, every condition cited to its source. built and tested on claude code and codex. MIT, keyless. github.com/moltenbit/should-i-care #infosec #cve #...

• View post

  New Gitea vulnerability found by me, tracked as CVE-2026-58418, just published: https://github.com/go-gitea/gitea/security/advisories/GHSA-rqhx-647v-wx32 #cybersecurity #security #infosec #security

• View post

  three critical (9.1) advisories for wazuh i reported were published today. same trust assumption broken in three places: the cluster fernet key authenticates membership, and the cluster protocol then lets that peer pick filesystem paths. CVE-2026-49441: the peer-supplied metadata key in process_files_from_worker is used directly as the destination path. write etc/ossec.conf, root rce via wazuh-logcollector. CVE-2026-48024: same function, merged-file branch. traversal in the merged header name...

• View post

  i just published codex tripwire. it runs alongside codex cli and gives you a live audit view of executed commands, mcp calls, web searches and sandbox network activity, including allow/block decisions and session correlation. everything stays local. https://github.com/moltenbit/codex-tripwire #codex #opensource #cybersecurity #infosec #securityresearch

• View post

  found a vuln in openssl's QUIC stack, now CVE-2026-75804. a remote peer can make an openssl QUIC endpoint hold ~100 MB of heap per connection. the flow control window is supposed to cap that at 768 KiB. ten connections --> a gigabyte. cause: connection-level flow control wasn't enforced, only the per-stream limit. rated low. affects 3.4 through 4.0, fixed in 4.0.3, 3.6.5, 3.5.9 and 3.4.8. https://openssl-library.org/news/vulnerabilities/index.html#CVE-2026-75804 #Open...

• View post

  two of my findings are in today's Microsoft Patch Tuesday. CVE-2026-88156, Outlook RCE, 9.8 critical. stack-based buffer overflow, no click needed: previewing the mail in the reading pane is enough. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88156 CVE-2026-70343, MPEG-2 Video Extension RCE, 8.8. heap-based buffer overflow, the user has to open a crafted file. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70343 #InfoSec #PatchTuesday #CVE #Outlook #...

• View post

  I audited #OpenReception, a recently released open-source appointment booking platform. Found and reported 16 vulnerabilities, now 16 CVEs assigned. 4 critical: - WebAuthn passkey injection → account takeover - tenant admin self-promotes to GLOBAL_ADMIN - unauth GLOBAL_ADMIN account creation - staff crypto poisoning breaks the E2E recipient directory rest: info disclosure, stored XSS, auth and IDOR bugs, all patched before public disclosure. https://moltenbit.net/disclosures/ #infosec #secur...

• View post

  two advisories i reported against globaleaks went public today. globaleaks is the whistleblowing platform a lot of ngos, newsrooms and public bodies run their leak sites on, so tenant separation is load bearing there. CVE-2026-46648 (moderate): db_toggle_escrow runs three adjacent ORM updates. two of them are missing the User.tid == tid filter, so a non-root tenant admin disabling escrow wipes crypto_escrow_bkp2_key for every user on every tenant, while those tenants keep escrow nominally enabl...

• View post

  new writeup: three bugs in vinext's alpha, cloudflare's next.js reimplementation that one engineer built with an AI model in about a week for roughly $1,100 in tokens. the good one: vinext checks middleware matchers against the path with the i18n locale prefix still on it, then strips the locale when it resolves the route. /fr/dashboard misses /dashboard/:path*, the auth middleware never runs, and the router serves /dashboard anyway. also a middleware header allowlist that is really a...

• View post

  RE: https://infosec.exchange/@moltenbit/116608526922719220 Writeup is online: https://moltenbit.net/posts/auditing-openreception/ #cybersecurity #vulnerability #infosec #security