BestHub
Sign in
Tagged articles

vulnerability analysis

22 articles · Page 1 of 1
Machine Heart
Machine Heart
Sep 1, 2026 · Artificial Intelligence

Can AI Discover Real Vulnerabilities? Researchers Embed Real Bugs into Model Parameters

The paper introduces CyberFactory, a pipeline that transforms scattered open‑source CVE data into executable security tasks, generates high‑quality agent trajectories, and uses them to train the OpenAegis model, which achieves up to 58.1% pass rate—significantly outperforming baseline LLMs in a one‑hour security challenge.

AI securityCyberFactoryLLM
0 likes · 15 min read
Can AI Discover Real Vulnerabilities? Researchers Embed Real Bugs into Model Parameters
Black & White Path
Black & White Path
Aug 12, 2026 · Information Security

Multiple Fixed High‑Risk EDUSRC and Corporate SRC Vulnerabilities Revealed

This article details several high‑severity vulnerabilities discovered in educational (EDUSRC) and corporate source‑code repositories, including session‑key leakage in WeChat mini‑programs, unauthorized API access, and SQL injection, and walks through the exploitation steps and how each issue was ultimately patched.

EDUSRCSQL injectionWeChat Mini Program
0 likes · 6 min read
Multiple Fixed High‑Risk EDUSRC and Corporate SRC Vulnerabilities Revealed
Black & White Path
Black & White Path
Jun 27, 2026 · Information Security

Using AI to Uncover a Long‑Hidden OAuth Combo Vulnerability

The article details a step‑by‑step recreation of an OAuth client‑credential leak in a web application, showing how hidden credentials in commented JavaScript enable registration of admin accounts, and compares three AI‑driven penetration testing approaches to exploit the vulnerability.

AI penetration testingOAuthWeb Security
0 likes · 10 min read
Using AI to Uncover a Long‑Hidden OAuth Combo Vulnerability
Black & White Path
Black & White Path
Jun 8, 2026 · Information Security

How a Single Authorization Header Bypassed Authentication and Earned a $3,000 Bounty

Security researcher ALR discovered that a web application only checks for the presence of the Authorization header, allowing any request with "Authorization: Basic"—even without credentials—to access around 50 API endpoints, leading to a critical authentication bypass and a $3,000 bounty.

Authentication BypassAuthorization HeaderHTTP Basic Authentication
0 likes · 5 min read
How a Single Authorization Header Bypassed Authentication and Earned a $3,000 Bounty
ITPUB
ITPUB
Apr 20, 2026 · Industry Insights

Why Cal.com Closed Its Source: AI‑Driven Threats Redefining Open‑Source Security

The article analyzes Cal.com’s abrupt shift to a closed‑source model, arguing that AI‑powered vulnerability discovery has turned open‑source transparency from a defensive advantage into a liability, and explores industry reactions, supporting data, and broader implications for the future of open‑source software.

AI securityindustry insightsopen source
0 likes · 11 min read
Why Cal.com Closed Its Source: AI‑Driven Threats Redefining Open‑Source Security
SuanNi
SuanNi
Apr 10, 2026 · Information Security

How Tiny Memory Files Turn AI Assistants into Hackable Backdoors

Researchers from UC Berkeley, NUS, Tencent and ByteDance reveal that a single hidden line in an AI assistant’s memory file can trigger OpenClaw to leak core keys or erase disks, detailing a three‑dimensional CIK attack model, real‑world tests on four top LLMs, and mitigation strategies.

AI securityCIK architectureMemory Injection
0 likes · 11 min read
How Tiny Memory Files Turn AI Assistants into Hackable Backdoors
Black & White Path
Black & White Path
Feb 9, 2026 · Information Security

How a One‑Click Flaw in OpenClaw Lets Attackers Steal the Master Key and Gain God‑Mode Access

A security analysis reveals that a high‑severity vulnerability in the open‑source AI assistant OpenClaw allows an attacker to steal the master authentication token and obtain unrestricted "god‑mode" control of the host through a single malicious link, and outlines the technical cause, attack chain, and mitigation steps.

AI agent securityOpenClawRemote Code Execution
0 likes · 4 min read
How a One‑Click Flaw in OpenClaw Lets Attackers Steal the Master Key and Gain God‑Mode Access
Tencent Technical Engineering
Tencent Technical Engineering
Dec 19, 2025 · Artificial Intelligence

How Safe Is AI-Generated Code? Real‑World Risks and Mitigation Strategies

This study investigates the security performance of AI‑generated code in real‑world software projects, revealing high vulnerability rates, language‑specific adoption patterns, and evolving roles in the vulnerability lifecycle, and proposes a multi‑dimensional framework for risk mitigation and safe AI‑assisted development.

AIEmpirical StudySoftware Security
0 likes · 16 min read
How Safe Is AI-Generated Code? Real‑World Risks and Mitigation Strategies
Tencent Technical Engineering
Tencent Technical Engineering
Jul 1, 2025 · Information Security

How Wukong AI Agent Uncovered a Critical RCE Vulnerability in LLaMA‑Factory (CVE‑2025‑53002)

This article details how the Wukong AI Agent automatically audited the popular LLaMA‑Factory project, discovered a high‑severity remote code execution vulnerability (CVE‑2025‑53002) caused by unsafe torch.load usage, reported it to the maintainers, and demonstrated the official fix that adds a secure weights_only flag.

AI securityCVE-2025-53002LLaMA-Factory
0 likes · 8 min read
How Wukong AI Agent Uncovered a Critical RCE Vulnerability in LLaMA‑Factory (CVE‑2025‑53002)
Sohu Tech Products
Sohu Tech Products
May 7, 2025 · Information Security

Why MCP Protocol Is a Security Nightmare: Real Attack Cases and Mitigations

This article provides a comprehensive security analysis of the Model Context Protocol (MCP), exposing multiple attack vectors such as prompt poisoning, tool poisoning, command and code injection, and illustrating how MCP’s design flaws make it more vulnerable than traditional applications while offering concrete mitigation recommendations.

AI safetyMCPcode injection
0 likes · 34 min read
Why MCP Protocol Is a Security Nightmare: Real Attack Cases and Mitigations
BanTech Think Tank
BanTech Think Tank
Mar 11, 2025 · Information Security

How ICBC Uses DeepSeek for Security Testing: A Practical Walkthrough

The Industrial and Commercial Bank of China details its end‑to‑end practice of leveraging the DeepSeek large‑model to automate security design analysis and vulnerability detection, describing knowledge‑base construction, keyword‑assisted judgments, false‑positive reduction, and measurable accuracy improvements exceeding 90%.

AI in financeDeepSeekSecurity Testing
0 likes · 11 min read
How ICBC Uses DeepSeek for Security Testing: A Practical Walkthrough
Practical DevOps Architecture
Practical DevOps Architecture
Mar 14, 2024 · Information Security

Comprehensive Penetration Testing Course Outline

This article provides a detailed curriculum for a penetration testing training program, covering operating system basics, web services, database setup, Kali Linux installation, various hacking tools, common web vulnerabilities, SQL injection techniques, command execution, file upload and inclusion flaws, XSS, CSRF, SSRF, privilege escalation, and internal network exploitation.

Penetration Testingethical hackinginformation security
0 likes · 10 min read
Comprehensive Penetration Testing Course Outline
OPPO Amber Lab
OPPO Amber Lab
Jan 19, 2024 · Information Security

Uncovering Android AIDL/HIDL Service Vulnerabilities: Methods and Real CVE Examples

This article explains how Android AIDL and HIDL services are generated, outlines systematic steps to enumerate services, filter Java implementations, and automate information gathering, then details common memory‑corruption bug patterns and demonstrates real CVE‑2023‑21008 and CVE‑2023‑20766 exploits, concluding with a risk assessment.

AIDLAndroidCVE
0 likes · 9 min read
Uncovering Android AIDL/HIDL Service Vulnerabilities: Methods and Real CVE Examples
Bilibili Tech
Bilibili Tech
Apr 18, 2023 · Cloud Native

Kubernetes Audit Log Analysis for Container Security

The article explains how to enable Kubernetes audit logging and use its detailed fields—such as userAgent, responseStatus, requestURI, and object references—to detect CDK‑generated attacks and other threats like CVE‑2022‑3172, privilege escalation, and backdoor deployment, offering practical detection examples and security recommendations.

API ServerAudit LoggingCDK
0 likes · 15 min read
Kubernetes Audit Log Analysis for Container Security
21CTO
21CTO
Dec 31, 2020 · Information Security

Which Languages Have the Worst Security Bugs? Veracode’s Latest Report

Veracode’s State of Software Security Volume 11 reveals that, among popular languages, C++ and PHP suffer the most severe vulnerabilities, while JavaScript and Python see rising issues, highlighting the need for developers to prioritize secure coding practices, regular updates, and careful management of third‑party dependencies.

Software SecurityVeracodedependency management
0 likes · 7 min read
Which Languages Have the Worst Security Bugs? Veracode’s Latest Report
Code Ape Tech Column
Code Ape Tech Column
Aug 20, 2020 · Information Security

How to Spot MyBatis SQL Injection Vulnerabilities: A Practical Guide

This article walks through the typical ways MyBatis can introduce SQL injection—through misuse of # and $ in LIKE, IN, and ORDER BY clauses—provides correct code examples, and demonstrates a step‑by‑step reverse‑engineering workflow on an open‑source CMS to locate and confirm the vulnerability.

Code AuditingJavaMyBatis
0 likes · 7 min read
How to Spot MyBatis SQL Injection Vulnerabilities: A Practical Guide
Meituan Technology Team
Meituan Technology Team
Mar 12, 2020 · Information Security

Cloud Native Security: Container Escape and Mitigation Strategies

Meituan's security team explains cloud‑native architecture, outlines container‑escape threats from kernel bugs, vulnerable runtimes and misconfigurations, and recommends mitigation through hardened kernels, secure‑container runtimes like gVisor or Kata, rigorous patch management, and collaborative feature development to strengthen runtime protection.

DockerKata ContainersKubernetes
0 likes · 20 min read
Cloud Native Security: Container Escape and Mitigation Strategies
Architects Research Society
Architects Research Society
Mar 30, 2017 · Information Security

Industrial Control System (ICS) Protocols and Security Overview

This article provides a comprehensive overview of industrial control system terminology, common SCADA‑related protocols such as Modbus, PROFIBUS, DNP3, OPC, BACnet, and Siemens S7, their security weaknesses, detection scripts, and vulnerability analysis resources.

Protocol SecuritySCADAindustrial control
0 likes · 9 min read
Industrial Control System (ICS) Protocols and Security Overview
Efficient Ops
Efficient Ops
Mar 12, 2017 · Information Security

Understanding the CVE-2017-5638 Struts2 RCE: Impact, Stats, and Fixes

The article examines the high‑risk CVE‑2017‑5638 vulnerability in Apache Struts2, detailing its remote code execution mechanism, global impact statistics across industries and regions, and provides comprehensive detection methods and three tiers of remediation solutions.

Apache StrutsCVE-2017-5638Remote Code Execution
0 likes · 6 min read
Understanding the CVE-2017-5638 Struts2 RCE: Impact, Stats, and Fixes