Ostorlab (@OstorlabSec) header
Ostorlab (@OstorlabSec) profile picture

Ostorlab

@OstorlabSec

Security testing for mobile, web, APIs and code. Agentic Deep Scan backs each confirmed finding with a working exploit.

 Delaware, USA
ostorlab.co
Joined April 2015
  • Tweets603
  • Following1.1K
  • Followers562
287Media
Photo by Ostorlab (@OstorlabSec)Photo by Ostorlab (@OstorlabSec)Photo by Ostorlab (@OstorlabSec)Photo by Ostorlab (@OstorlabSec)Photo by Ostorlab (@OstorlabSec)Photo by Ostorlab (@OstorlabSec)Photo by Ostorlab (@OstorlabSec)Photo by Ostorlab (@OstorlabSec)Photo by Ostorlab (@OstorlabSec)Photo by Ostorlab (@OstorlabSec)
🚀 We’re launching Agentic Deep Scan Our next-generation vulnerability scanner for web, APIs, and mobile apps (iOS, Android, soon HarmonyOS). We’re the first and only platform delivering deep agentic scanning for mobile, while also covering web & APIs, helping security teams go beyond traditional scans with greater confidence and control.
1
6
1
14
1,119
Ostorlab found a heap OOB read in Assimp: the MD2 importer multiplied numFrames × numVertices in 32 bits. Overflow it: the bounds check passes and the loader reads past the buffer. CVE-2026-117608, CVSS 4.0: 6.9. Affects ≤ 6.0.5, fix merged upstream. ostorlab.co/research?utm_sou…
Image from Ostorlab (@OstorlabSec)
2
1
54
Ostorlab found a stored XSS on Keycloak's login page: kcSanitize neutralized the payload, fixURLs() re-activated it. A manage-realm admin plants it, every realm user runs it. CVE-2026-107889, CVSS 3.1: 5.5. Affects 26.1.3 to 26.8.0, fixed upstream. ostorlab.co/research?utm_sou…
Image from Ostorlab (@OstorlabSec)
3
3
80
Ostorlab found an out-of-bounds write in HarfBuzz's wasm shaper: a wrong WAMR signature on font_glyph_to_string lets a crafted font write glyph names into host memory. CVE-2026-113679, CVSS 4.0: 7.3. Fixed in 15.0.0. ostorlab.co/research?utm_sou…
Image from Ostorlab (@OstorlabSec)
2
2
82
Ostorlab found another flaw in llama.cpp's RPC server: one oversized length field throws an uncaught std::length_error and aborts rpc-server for every client. No auth needed. CVE-2026-119052, CVSS 4.0: 8.7. Fixed in b11935. ostorlab.co/research?utm_sou…
Image from Ostorlab (@OstorlabSec)
3
4
83
Active Directory is now a scan target in Ostorlab 🔑 Add your domain controller IPs, then run a ~20-minute targeted check or an Agentic Deep Scan that chains weaknesses into attack paths with working exploits. Internal DCs run from the on-prem scanner. docs.ostorlab.co/tutorials/a…
3
3
47
rConfig runs Redis-backed Horizon jobs, so anyone who can write to the queue can run code as the worker. Default Redis has no password. CVE-2026-124079 CVSS v3.1 9.8 Critical (VulnCheck) No exploitation known, not in CISA KEV Fixed in Core 8.2.19, Pro 8.4.1 #CVE #rConfig
Image from Ostorlab (@OstorlabSec)
1
3
4
138
Read the full article: blog.ostorlab.co/rconfig-rce…
rConfig RCE via Redis Job Queue (CVE-2026-124079)

rConfig RCE via Redis Job Queue (CVE-2026-124079)

rConfig Core 8.0.0 through 8.2.18 and Pro before 8.4.1 let an attacker run code through the Redis job queue, fixed in 8.2.19 and 8.4.1.

blog.ostorlab.co
2
38
Ostorlab found a stack buffer overflow in Poppler, the PDF engine behind Evince, Okular and LibreOffice. The PDF spec caps R6 passwords at 127 bytes. Poppler didn't apply the limit. CVE-2026-107705, CVSS 4.0: 8.3. Affects 0.42.0 to 26.10.0. Fix merged. ostorlab.co/research?utm_sou…
Image from Ostorlab (@OstorlabSec)
1
2
3
136
Metabase's password reset was meant to check a token. It ran the attacker's SQL first. One extra field was enough to become admin and reach every database Metabase is connected to. No login needed. CVE-2026-72898 was exploited as a zero-day.
Image from Ostorlab (@OstorlabSec)
1
1
2
172
more replies
Image from Ostorlab (@OstorlabSec)
1
12
JPCERT/CC lists attacks on Metabase among the methods behind Japan's recent wave of breaches. Fixed versions, indicators of compromise and the full technical breakdown are in The Breach Brief: substack.com/home/post/p-221…
Image from Ostorlab (@OstorlabSec)
35
New Breach Brief is out ! Japan's breaches got serious enough to be called an emergency. Sourcenext, Burger King Japan and Studio disclosed breaches within days. Inside: ShopServe, where even stores tha were affected. Full Issue: ostorlab.substack.com/p/japa…
🤖 Made with AI
Image from Ostorlab (@OstorlabSec)
2
2
80
New in Ostorlab Threat Center: detection for PHP2Shell (CVE-2026-109618, CVE-2026-109619). Ostorlab scans flag web servers that report an affected PHP version, without sending any exploit. If you're affected, update to the 21 October PHP release.
Image from Ostorlab (@OstorlabSec)
1
3
3
380
Run a scan to check your servers: report.ostorlab.co/scan/new
1
24
Every security team has tickets that matter but never get picked up. Ticket Agents take them on. Give one a job in plain words, and it picks up matching tickets and opens a PR for your engineers to review. Watch one find out why a server hit 100% CPU. Setup guide below 👇
1
3
51
Load more