SSD provides the quick and responsible way to get zero-day vulnerabilities reported to vendors.
Visit https://ssd-disclosure.com/ for more information.
Want to learn about Chrome exploitation and the role of WebAssembly in it?
In our new article, we'll break down the world of WASM, how it interacts with V8, and use CVE-2024-2887 as a case study to show how flaws in WASM can lead to remote code execution.
Read it here: https://ssd-disclosure.com/an-introduction-to-chrome-exploitation-webassembly-edition/
🚨 New advisory was just published! 🚨
A critical double-free vulnerability has been discovered in the pipapo set module of the Linux kernel’s NFT subsystem. An unprivileged attacker can exploit this vulnerability by sending a specially crafted netlink message, triggering a double-free error with high stability. This can then be leveraged to achieve local privilege escalation: https://ssd-disclosure.com/ssd-advisory-linux-kernel-pipapo-set-double-free-lpe/
💻 Have you read our recent publications?
ISPConfig Authenticated Remote Code Execution:
https://ssd-disclosure.com/ssd-advisory-ispconfig-authenticated-remote-code-execution/
Kerio Control Authentication Bypass and RCE:
https://ssd-disclosure.com/ssd-advisory-kerio-control-authentication-bypass-and-rce/
🚨 New advisory was just published! 🚨
Kerio Control has a design flaw in the implementation of the communication with GFI AppManager, leading to an authentication bypass vulnerability in the product under audit. Once the authentication bypass is achieved, the attacker can cause the execution of arbitrary code and commands: https://ssd-disclosure.com/ssd-advisory-kerio-control-authentication-bypass-and-rce/
🚨 New advisory was just published! 🚨
ISPConfig contains design flaws in the user creation and editing functionality, which allow a client user to escalate their privileges to superadmin. Additionally, the language modification feature enables arbitrary PHP code injection due to improper input validation: https://ssd-disclosure.com/ssd-advisory-ispconfig-authenticated-remote-code-execution/
Submit your pfSense, Sophos & KerioControl vulnerabilities at: https://ssd-disclosure.com/submit/
🌪️ TyphoonCon 2025 has officially wrapped up and it was an incredible experience, all thanks to YOU!
Shoutout to our attendees, crew, and sponsors for bringing the energy and making it an unforgettable event!
:sparkles_red: Stay tuned... TyphoonCon 2026 is already in the works, and we can't wait to see you there!
🌪️ Last but not least! Closing Remarks and TyphoonPWN winners with SSD Secure Disclosure's Aviram Jenik and Noam Rathaus
🌪️ Closing the day with @scannell_simon desyncing the planet
🌪️ Up next, Assaf Morag is unveiling the invisible pathways to breaching AWS accounts
🌪️ SOS! Thai Nguyen & Chuong Nguyen are showing us how to discover and exploit 0-days from 1-days at scale
🌪️ Now on stage, NeoTheone is showing us how to steal a drone!
🌪️ Up next, we’re attacking debug modules in the Android ecosystem with Lewei Qu
🌪️ Now on stage at TyphoonCon 2025: just having fun with binary polynomials with @arnaugamez
🌪️ Starting day 2 with our keynote Phuong Nguyen and his wonderful talk about building a low profile elite hacking team!
🌪️ Conference day 2 starts now. Get ready for another day of great talks!
It looks like Kerio Control was PWNed with a Pre auth RCE! We're going through the exploit now to see everything works like it should #TyphoonCon25
🌪️ Ending day one of #TyphoonCon25 with SeongJoon Cho’s Pwning shopping mall CMS
🌪️ Tapping into the past @typhooncon with @rdjgr & Carlo Meijer’s RCE via Fax Machine!
🌪️ Up next, Satoki Tsuji is explaining the hidden risks of URL protocol handler leaks
