Security Researcher and Software Engineer. Playing with @pastenctf
Joined November 2008
- Tweets10
- Following62
- Followers52
- Likes79
I found a chain that turns a hidden instruction in a Word document into a root shell on the Azure Kubernetes node under Microsoft Copilot — and then into an interactive "shell" on the victim's Copilot itself.
New write-up + the talk I gave at @BlackHatEvents 2026. 🧵
@rubrikInc @RubrikZeroLabs @msftsecresponse @Oranav
The part that reaches past Copilot: that daemon is unauthenticated on localhost on AKS and Container Apps nodes with image streaming.
Any SSRF in any workload on such a node becomes root code execution on the node itself.
CVE-2026-32193, CVSS 8.8, fixed by MSRC.
The blog post is written as the actual research story - the dead ends, the breakthroughs - not just the final exploit.
Write-up: zerolabs.rubrik.com/blog/bre…
Demo: youtube.com/watch?v=Wonbqfi1…
Over the last few months, I researched Langflow, n8n, and Activepieces.
The result is 9 zero-days and a BlueHat IL talk 🛠️
🚨 CVE-2026-7524 (Critical - 9.8)
🚨 CVE-2026-48519 (Critical - 9.6)
⚠️ CVE-2026-7528 (High - 7.1)
🐛 CVE-2026-42228 (Moderate - 6.3)
🐛 CVE-2026-48520 (Moderate - 6.1)
🚨 CVE-not-yet-published (Critical - 9.0)
🚨 CVE-not-yet-published (Critical - 10.0)
⚠️ CVE-not-yet-published (High - 8.6)
⚠️ CVE-not-yet-published (High - 8.3)
Thanks to the vendors for the cooperation and fixes.
@Oranav and I will be breaking down some of these on stage at BlueHat IL 2026
Registration closes soon. Write-ups will be published after the con.
Abstract:
microsoftrnd.co.il/bluehatil…
@BlueHatIL @msftsecresponse
BlueHat IL 2026 presentation recording is live! 📽️
Exploiting AI Orchestration Zero-Days via PostgreSQL Internals
Presentation:
youtube.com/watch?v=71QAblR4…
Slides:
msrndcdn360.z6.web.core.wind…
Excited to share my research was accepted at @BlackHatEvents USA 2026! 🎩
I'll present how I achieved interactive access to users' AI assistants by chaining:
🔓 Prompt injection
🔓 Privilege escalation
🔓 Path traversal
🔓 `.toml` injection
🔓 and finally an `LD_PRELOAD` exploit
The impact:
🚨 CVE-2026-32193 (Critical)
🏆 $48,000 bug bounty from Microsoft
ChatMate: Remote Prompt Execution on AI Assistants through Sandbox Escaping
blackhat.com/us-26/briefings…
Special thanks to @msftsecresponse for the brilliant collaboration!
See you in Vegas 👋
#ChatMate #CVE_2026_32193 #BHUSA @BlackHatEvents @rubrikInc @Oranav