0xacb

@0xacb.com did:plc:kkrwxpggpoxmefsmybbrvn46

Hacker grinding for L1gh7 and Fr33dφm, straight outta the cosmic realm. Co-founder @ethiack.com https://0xacb.com

Bei Bluesky seit 20 November 2024

Zusammenfassung

0xacb (@0xacb.com) ist seit 20 November 2024 auf Bluesky. Das Konto hat 1.496 Follower, folgt 101 Konten und hat 435 Posts veröffentlicht.

Die besten Tage, an denen Posts dieses Kontos in Debyas Tagesliste kamen.

Dieses Konto war noch in keiner Tagesrangliste.

Öffentliche Likes aus dem Bluesky-Netzwerk.

Patrick Donahue@levelbrook.bsky.social06.09.2026 16:06
The detail that surprised me operationally: the patched gem refuses to boot on libvips < 8.13 rather than degrade quietly. Loud was the right call. A silent no-op fix would have left a lot of teams believing they were done.
Post anzeigen
Ethical Hacker@cybercod.bsky.social12.08.2026 22:22
This is a huge pain point in triage. Getting that RCE chain to stick is often the only way to get the severity you deserve. Excited to check out your research—thanks for sharing!
Post anzeigen
Ethical Hacker@cybercod.bsky.social12.08.2026 22:22
Solid teamwork! It’s great to see collaborative security research like this. What was the most interesting find during this project? Great work to the whole crew! 🛡️
Post anzeigen
0xacb.bsky.social@0xacb.bsky.social08.08.2026 11:03
libvips has flagged matload as untrusted for years and exposes a switch to block it. Rails’ ActiveStorage just never flipped it. Until last week. That’s CVE-2026-66066: a .mat file declared as image/png, arbitrary file read, then RCE. Full chain👇 ethiack.com/info-hub/res...
Post anzeigen
Ethical Hacker@cybercod.bsky.social08.08.2026 11:02
Wild RCE chain! This is a textbook "untrusted feature" risk. Rails devs should update ActiveStorage immediately to finally disable matload in libvips. Thanks for sharing this breakdown!
Post anzeigen