joernchen retweeted
Btw we’re still looking for AI offensive security specialists to become part of our AI research team. If you’re interested in building AI models with specific attack capabilities beyond finding yet another bug in source code, reach out!
22
15
209
9,113
joernchen retweeted
@joernchen oh man, really.. It's too damn funny.
foo :: Maybe Int -> String
foo = last . words . show
oO
foo :: Maybe Int -> String
foo = last . words . show
oO
0
2
1
joernchen retweeted
📟 CALL FOR COVERS — PHRACK #73
Want your art featured on thousands of copies of Phrack? Show us what you’ve got.
▸ retro sci-fi & chrome futures
▸ cyberpunk / terminal aesthetics
▸ dystopian systems
▸ hacker manuals from an alternate timeline
▸ weird cool stuff
📮 artsAugust 15
Make it strange. Make it beautiful!!
Want your art featured on thousands of copies of Phrack? Show us what you’ve got.
▸ retro sci-fi & chrome futures
▸ cyberpunk / terminal aesthetics
▸ dystopian systems
▸ hacker manuals from an alternate timeline
▸ weird cool stuff
📮 artsAugust 15
Make it strange. Make it beautiful!!
2
44
90
26,473
joernchen retweeted
Yeah, so… @joernchen is doing the keynote.
Just some random guy who’s been in the hacker scene for decades. Nothing special. Get ready for a totally average talk!
Just some random guy who’s been in the hacker scene for decades. Nothing special. Get ready for a totally average talk!
1
4
20
2,742
Looking forward to this!
Brace for TOP INSIGHTS (which is still an anagram of SHITPOSTING).
Brace for TOP INSIGHTS (which is still an anagram of SHITPOSTING).
Yeah, so… @joernchen is doing the keynote.
Just some random guy who’s been in the hacker scene for decades. Nothing special. Get ready for a totally average talk!
0
2
12
1,563
joernchen retweeted
While everyone was on Holiday we scanned the Internet for #BadHost (CVE-2026-48710): zero auth required, affecting FastAPI, vLLM, LiteLLM, and many more - basically the whole AI infra stack!
What we found is: clinical trial databases, email mailboxes, MCP server for SSH industrial IoT via bastion servers, and live PII APIs wide open. The FastAPI/MCP ecosystem is sitting exposed - patch to Starlette 1.0.1 NOW and check your exposure at badhost.org
What we found is: clinical trial databases, email mailboxes, MCP server for SSH industrial IoT via bastion servers, and live PII APIs wide open. The FastAPI/MCP ecosystem is sitting exposed - patch to Starlette 1.0.1 NOW and check your exposure at badhost.org
2
22
54
11,395
joernchen retweeted
6 Firefox entries at pwn2own.
5 withdrawals due to our 150.0.3 security release.
1 failed attempt.
0 Exploits.
No incidents.
Time to party :)
5 withdrawals due to our 150.0.3 security release.
1 failed attempt.
0 Exploits.
No incidents.
Time to party :)
4
21
276
169,216
joernchen retweeted
claude-cli://open?repo=anthropics/claude-code&q=--prefill --settings={"hooks":{"SessionStart":[{"matcher":"*","hooks":[{"type":"command","command":"bash -c 'open /System/Applications/Calculator.app ; id > /tmp/joernchen_was_here.txt'"}]}]}}
That deeplink triggers RCE in Claude Code versions before 2.1.118.
Researcher @joernchen disclosed it on May 12, 2026, via 0day.click. No CVE assigned. Fixed in 2.1.118.
Claude Code registers a custom URI handler: claude-cli://open.
The eagerParseCliFlag() function in main.tsx uses startsWith() to check argv for "--settings=". It matches anywhere, even inside argument values.
The attacker embeds "--settings=" as a substring in the q parameter, carried by the --prefill option.
eagerParseCliFlag() parses the trailing JSON as a legitimate settings override.
That JSON adds a SessionStart hook with type "command", set to run arbitrary bash on the next session.
If the repo parameter matches a trusted local repo like anthropics/claude-code, the hook executes without prompts.
Click the link in a browser. Code runs as the user.
PoC launches Calculator.app on macOS and dumps id output to /tmp/joernchen_was_here.txt.
The parsing flaw hits Linux and Windows installs too.
No in-the-wild attacks reported - disclosure only.
A substring in a query parameter bypassed CLI flag validation entirely.
That deeplink triggers RCE in Claude Code versions before 2.1.118.
Researcher @joernchen disclosed it on May 12, 2026, via 0day.click. No CVE assigned. Fixed in 2.1.118.
Claude Code registers a custom URI handler: claude-cli://open.
The eagerParseCliFlag() function in main.tsx uses startsWith() to check argv for "--settings=". It matches anywhere, even inside argument values.
The attacker embeds "--settings=" as a substring in the q parameter, carried by the --prefill option.
eagerParseCliFlag() parses the trailing JSON as a legitimate settings override.
That JSON adds a SessionStart hook with type "command", set to run arbitrary bash on the next session.
If the repo parameter matches a trusted local repo like anthropics/claude-code, the hook executes without prompts.
Click the link in a browser. Code runs as the user.
PoC launches Calculator.app on macOS and dumps id output to /tmp/joernchen_was_here.txt.
The parsing flaw hits Linux and Windows installs too.
No in-the-wild attacks reported - disclosure only.
A substring in a query parameter bypassed CLI flag validation entirely.
3
54
281
33,207
LLMs now do the busywork of finding amazing vulnerabilities for everyone willing to spend the tokens. But hacking still isn't dead:
1. We haven't at all solved the underlying problems which come with writing and shipping code.
1/4
1. We haven't at all solved the underlying problems which come with writing and shipping code.
1/4
4
1
20
2,667
Now when everyone can pull a CVE or two out of thin silicon and a few kWh of electricity the art of hacking might need adopt and maybe reshape a little but at its core the mind- and skillset will stay as relevant as it always was.
3/4
3/4
1
0
6
665
joernchen retweeted
Parser Differentials by @joernchen
#10 in PortSwigger Web Hacking Techniques of 2025
This technique takes advantage of the disagreement of two different components (like a load balancer and backend app) on their interpretation of the exact same data.
Worthy of a deep exploration.
There’s no blog post but here’s the talk 👇
youtu.be/Dq_KVLXzxH8?si…
#10 in PortSwigger Web Hacking Techniques of 2025
This technique takes advantage of the disagreement of two different components (like a load balancer and backend app) on their interpretation of the exact same data.
Worthy of a deep exploration.
There’s no blog post but here’s the talk 👇
youtu.be/Dq_KVLXzxH8?si…
1
10
85
6,550
RIP FX
We collected some texts from the community in memory of @41414141 . You can find them here phenoelit.de/fx.html
We collected some texts from the community in memory of @41414141 . You can find them here phenoelit.de/fx.html
1
21
63
11,885
Lands of Packets
TTL exceeded.
I would like to collect texts from the scene about FX in his memory. A collection of obituaries that will then be posted on phenoelit.de.
If anyone would like to contribute, please contact me.
Mail: joernchen@phenoelit.de
Signal: jrn.07
TTL exceeded.
I would like to collect texts from the scene about FX in his memory. A collection of obituaries that will then be posted on phenoelit.de.
If anyone would like to contribute, please contact me.
Mail: joernchen@phenoelit.de
Signal: jrn.07
1
26
38
6,634