redfr0g

4 ms·

1. 1.▲
   Breaking n8n's Expression Sandbox into RCE (CVE-2026-27577) with striga.ai(striga.ai)

   9 points by redfr0g 7mo ago|1 comments
2. 2.▲
   by redfr0g 7mo ago

   How Striga uncovered a critical sandbox escape and unsanitized node name injection in n8n's expression engine, chaining them into full Remote Code Execution.
3. 3.▲
   by redfr0g 7mo ago

   I think "as long as it was not a terminating action" is crucial here. The way how Cloudflare dashboard is designed right now may put you in false sense of security by implying that all rules will be evaluated one after another. In
4. 4.▲
   Why Cloudflare rule order matters?(brzozowski.io)

   66 points by redfr0g 7mo ago|13 comments
5. 5.▲
   One year with bug bounty automation(brzozowski.io)

   1 points by redfr0g 8mo ago|0 comments
6. 6.▲
   by redfr0g 9mo ago

   Cybersecurity and research blog: https://www.brzozowski.io/
7. 7.▲
   Show HN: Atri Reports – Automated security report writing with DOCX(github.com)

   2 points by redfr0g 2y ago|0 comments
8. 8.▲
   by redfr0g 3y ago

   Blog post disclosing security research done on LG WebOS 'Signage' TVs.
9. 9.▲
   LG WebOS 'Pwnage' – getting unauthenticated code execution on LG Signage TVs(brzozowski.io)

   5 points by redfr0g 3y ago|1 comments