@rez0__ @sshell_ @Cloudflare @hash_kitten @SLCyberSec @infosec_au Prob just salty this got dropped at 5pm EST on a Friday. 🤷
English
Nate Robb
659 posts
Nate Robb
@NateRobb
Senior Threat Enablement Operator @BishopFox
Phoenix, AZ Katılım Şubat 2009
315 Takip Edilen202 Takipçiler
How in the world could @Cloudflare post this blog without crediting the amazing research from @hash_kitten and @SLCyberSec (@infosec_au) at all!?
blog.cloudflare.com/wordpress-vuln…
English
CVE-2026-27886 is another CVE we researched/reproduced as part of @bishopfox's Emerging Threat process. Full admin account takeover in Strapi, ~20k internet-facing instances via Shodan.
Also, check out our detection tool: github.com/BishopFox/CVE-…
Bishop Fox@bishopfox
This Strapi bug is a great example of how small trust-boundary mistakes become major security problems.
English
Nate Robb retweetledi
After not receiving a raise in the four years I’ve worked at BHIS they’ve now decided to reduce my pay by $40k after coming back from maternity leave and moving my role to solely pentesting. So I am looking for a new position effective immediately if anyone has any leads 😇
English
LiteLLM Proxy has a pre-auth SQL injection (CVE-2026-42208) I recently reproduced as part of @bishopfox's Emerging Threat process. Below is a technical analysis I put together with a safe detection payload that can be used to identify vulnerable deployments.
Bishop Fox@bishopfox
A failed login should not take 6 seconds. Bishop Fox researchers reproduced CVE-2026-42208 in LiteLLM’s proxy. The attack requires no authentication, still returns HTTP 401 responses, and uses timing delays to extract sensitive data. Observed in the wild roughly 36 hours after disclosure. Upgrade to 1.83.7 or higher.
English
Nate Robb retweetledi
We’re heading to @CactusCon 14! 🌵
Bishop Fox is sponsoring again this year, with talks from Dan Petro and Nate Robb on EDR evasion and real-world CVE prioritization. We’ll be around all weekend to talk Red Team tradecraft, research, and offensive security.
See you in Mesa!
English
@CactusCon Just a heads up, not seeing a "Notes to Organizer" section to include a talk outline on the session submission page. Tried throwing the outline at the end of the session description but hit the character limit.
English
🥳 IT BEGINS 🥳
The CactusCon 14 CFP is now OPEN!
sessionize.com/cactuscon-14/
Theme is an oldie but a goodie, regardless as usual we are looking for those juicy technical talks that make CactusCon great.
#cc14
English
@vxunderground Looks to be an n-day disclosed in April (CVE-2025-31324), but appears to be the first full proof-of-concept available.
English
"Scattered Lapsus$ Hunters (UNC3944)", have released an alleged SAP7 0day exploit onto Telegram.
I can't confirm or deny if it's an actual 0day, I have no way to test or confirm anything. However, it is fully weaponized.
I've uploaded it to VXUG
vx-underground.org/tmp
English
@codewhitesec @_l0gg @mwulftange Isn't user interaction required to exploit CVE-2025-49706? via msrc.microsoft.com/update-guide/v…
English
We have reproduced "ToolShell", the unauthenticated exploit chain for CVE-2025-49706 + CVE-2025-49704 used by @_l0gg to pop SharePoint at #Pwn2Own Berlin 2025, it's really just one request! Kudos to @mwulftange
English
Ever feel overwhelmed by the constant firehose of newly disclosed vulnerabilities? Check out my latest blog post where I outline the methodology our Threat Enablement team at Bishop Fox uses to cut through the noise:
bfx.social/3GcLIdz
English
Nate Robb retweetledi
Our Threat Enablement and Analysis team built a better way to cut through the noise. This is how we triage the firehose, turning chaos into action. By Senior Operator Nate Robb: bfx.social/45Ltri1
English
Recently I ran into an unresolvable issue with one of my wordlists & content discovery.
I had to switch from FeroxBuster to FFuF
In security testing It will greatly benefit you to have redundancies in tools:
nmap <-> naabu <-> ++
httpx <-> httprobe
jaeles <-> nuclei
etc..
English
@_BalthazarBratt I just picked up the 16 inch M1 Pro a couple weeks ago and I love it. I'm impatient so I used this stock tracker app to jump on one when local apple store stock became available: worthbak.github.io/inventory-chec…
English
My team is hiring at @bishopfox! Come join the Adversarial Operations team for the Cosmos continuous attack surface testing platform.
bishopfox.com/jobs?gh_jid=36…
English
@jonathandata1 FYI: I could reproduce the Airdropped website auto accept only when both devices were signed in with the same Apple ID. When the Apple IDs were different (as would be the case in an attack) the victim device was prompted for permission to open the Airdropped website.
English
@Random_Robbie Sorry bud, thought you may want to buy a $250k gif of a rock.
English
@AndrivetSeb I ask because I could use it for an engagement I am currently on if you would be willing to share.
English
@AndrivetSeb I just stumbled upon your talk "The Security of MDM systems" from Hack in Paris 2013. Did you happen to publicly release the Java tool to decrypt passwords from identityconfig.xml files?
English