/
attack_type:credential_theft × latest_source_host:hacktron.ai × limpar

Resultados

2 casos · pág. 1/1

hacktron.ai · high

Breaking Into PostHog Prod Database

TLDR: PostHog used Playwright Chromium with --no-sandbox for heatmap screenshots. I used Claude to write a V8 n-day (CVE-2026-7899) exploit, got production RCE in a worker container with prod db access. I then used the same exploit as an evaluation for open-weight models. With the increasing number of supply chain attacks, I was thinking …

CVE-2026-7899 CVE-2026-5873 Play government media
hacktron.ai · high

VS Code Copilot Chat applyPatchTool TOCTOU bypass lets prompt injection write arbitrary files and achieve RCE, exfiltrating GITHUB_TOKEN

Researcher ahacker1, using the Hacktron AI tooling, disclosed a bypass of earlier fixes for prompt-injection-to-RCE in VS Code Copilot Chat agent mode. A TOCTOU flaw in the applyPatchTool component lets a crafted prompt write files outside the workspace without user confirmation. The attack can be triggered by pasting a prompt into Copilo…

technology