Greek coastguards on Friday rescued 26 people, including a woman and a minor, hoping to reach Europe. They had spent six days at sea in a rubber boat. According to survivors, 22 have lost their lives during the journey. The number of migrants who have…
Houthis Enter War as Iran Retaliates Over Nuclear Site Attacks – Bloomberg.com
Houthis Enter War as Iran Retaliates Over Nuclear Site Attacks Bloomberg.comLive updates: Houthis enter Iran war with missile strike against Israel CNNLimited Houthi Attack Result of Competing Pressures, Analysts Say WS…
What are European countries doing to keep fuel costs down?
War in the Middle East has caused energy market volatility around the globe, forcing governments in Europe to intervene and keep fuel costs down for consumers.
Chaining file upload bypass and stored XSS to create admin accounts: walkthrough with Docker PoC lab
Write up of a vulnerability chain from a recent SaaS pen test. Two medium-severity findings (file upload bypass and stored XSS) chained together for full admin account creation.
The target had CSP restricting script sources to self, CORS locked down, and CSRF tokens on forms. All functioning correctly. The chain bypassed everything by staying same-origin the entire way.
The file upload had no server-side validation (client-side accept=".pdf" only), so we uploaded a JS payload. It got served back from the app’s own download endpoint on the same origin. The stored XSS in the admin inbox messaging system loaded it via an <img onerror> handler that fetched the payload and eval’d it. The payload created a backdoor admin account using the admin’s session cookie.
CSP didn’t block it because the script was hosted same-origin via the upload. CORS irrelevant since nothing crossed an origin boundary. CSRF tokens didn’t matter because same-origin JS can read the DOM and grab them anyway.
Full write up with attack steps, code, and screenshots: https://kurtisebear.com/2026/03/28/chaining-file-upload-xss-admin-compromise/
Also built a Docker lab that reproduces the exact chain with the security controls in place. PHP app, both vulns baked in, admin + user accounts seeded. Clone and docker-compose up: https://github.com/echosecure/vuln-chain-lab
submitted by /u/kurtisebear
[link] [comments]
Verstappen calls his Red Bull ‘undriveable’ after more F1 woes at Japan GP
Kimi Antonelli and George Russell claim a Mercedes 1-2 at Suzuka but Max Verstappen’s Red Bull struggles continue.
Colombian navy says it shut down 30 drug labs, seized 2 tons of cocaine
The Colombian navy said it also seized thousands of gallons of smuggled fuel, preventing “the strengthening of illicit economies.”
L3Harris wins deal for submarine-launched AUV system
L3Harris Technologies has secured a contract from the U.S. Department of Defense Innovation Unit to provide a system enabling submarines to deploy and recover autonomous underwater vehicles through torpedo tubes.
The post L3Harris wins deal for submarine-launched AUV system first appeared on UK Defence Journal.
How EVs could be part of answer to UK’s fuel reserve worries
More use of two-way charging will earn money for owners and could avoid the need to expand North Sea oil drillingThe Iran war has sent petrol and diesel prices to their highest levels in years, sparked warnings of fuel rationing across Europe and trigg…
As US troops sail to Middle East, how likely is Trump to order boots on the ground?
Secretary of state Marco Rubio repeats administration’s belief that US can achieve its aims without a ground warAmid tentative White House efforts at diplomacy to end the war in Iran, US troops have also been arriving in the region to deliver what Dona…
Bills to pay FAA and TSA workers during shutdowns get introduced but keep stalling in Congress
Members of Congress have repeatedly introduced bills to ensure the federal employees who control air traffic and conduct airport security screenings get paid during government shutdowns