NEW BLOG URL
Please update your RSS feed Here is the new new blog address: https://blog.phor.net/
Privacy Log
Finding privacy and security issues online. Includes live case studies!
Latest posts
Log4j2 more zero days [MOVED]
THIS POST MOVED TO MY NEW BLOG AT https://blog.phor.net/log4j2-more-zero-days
NPM zero-day: npm installation runs unspecified scripts with shell access [MOVED]
THIS POST MOVED TO MY NEW BLOG AT https://blog.phor.net/npm-zero-day-npm-installation-runs
OpenSea allows unauthenticated access to "private" token lists [MOVED]
THIS POST MOVED TO MY NEW BLOG AT https://blog.phor.net/opensea-private-token-list-exploit
Implementation issues make Number Board marketplace bidding vulnerable [MOVED]
THIS POST MOVED TO MY NEW BLOG AT https://blog.phor.net/number-board-bidding-vulnerability
Mexican federal government COVID vaccination certificates are vulnerable to photo manipulation attack (en/es) [MOVED]
THIS POST MOVED TO MY NEW BLOG AT https://blog.phor.net/mexican-covid-certificate-vulnerability
GitHub Pages Zero Day with Wildcard Subdomains Allows Anyone to Publish on Your Site [MOVED]
THIS POST MOVED TO MY NEW BLOG AT https://blog.phor.net/github-pages-wildcard-vulnerability
Upcoming Event: Zero Day Live 2021-05-01 2PM New York Time [MOVED]
THIS POST MOVED TO MY NEW BLOG AT https://blog.phor.net/upcoming-zero-day-live
The Ethics of Not Disclosing Vulnerabilities [MOVED]
THIS POST MOVED TO MY NEW BLOG AT https://blog.phor.net/the-ethics-of-not-disclosing
Poker Players Getting Scammed by Venmo Password Reset/Instant Withdraw [MOVED]
THIS POST MOVED TO MY NEW BLOG AT https://blog.phor.net/poker-venmo-instant-withdraw-scam
Google Apps Publishes Administrator Contact Information [MOVED]
THIS POST MOVED TO MY NEW BLOG AT https://blog.phor.net/google-apps-admin-contacts
WeWorked 0-day: Unauthorized users can gain admin access and change their own pay rate [MOVED]
THIS POST MOVED TO MY NEW BLOG AT https://blog.phor.net/weworked-full-exploit
The Second SHA Collision [MOVED]
THIS POST MOVED TO MY NEW BLOG AT https://blog.phor.net/second-sha-collision
Compound Finance zero-day: prices can move faster than advertised [MOVED]
THIS POST MOVED TO MY NEW BLOG AT https://blog.phor.net/compound-finance-oracle-error
IPv6 hurts your privacy, removes plausible deniability and is on by default [MOVED]
THIS POST MOVED TO MY NEW BLOG AT https://blog.phor.net/ipv6-privacy-failure
Zno User-Uploaded Photos are Publicly Accessible, Again [MOVED]
THIS POST MOVED TO MY NEW BLOG AT https://blog.phor.net/all-zno-photos-public
Safari zero-day: any website can request your admin password through indistinguishable popup [MOVED]
THIS POST MOVED TO MY NEW BLOG AT https://blog.phor.net/safari-admin-password-vulnerability
Security Flaws With Apple's Two-Factor Authentication [MOVED]
THIS POST MOVED TO MY NEW BLOG AT https://blog.phor.net/security-flaws-with-apples-two-factor
What is Ethical Hacking? [MOVED]
THIS POST MOVED TO MY NEW BLOG AT https://blog.phor.net/ethical-hacking
American Express Prepaid Holiday Cards Vulnerable to Enumeration Attack [MOVED]
THIS POST MOVED TO MY NEW BLOG AT https://blog.phor.net/amex-enumeration-vulnerability
Security Vulnerability with United's Ticketing System (0-day) [MOVED]
THIS POST MOVED TO MY NEW BLOG AT https://blog.phor.net/united-ticketing-vulnerability
Information in Apple's data about you that I did not expect [MOVED]
THIS POST MOVED TO MY NEW BLOG AT https://blog.phor.net/apple-weird-data-about-you
99% of Pennsylvania Parents Give Newborn DNA to State Database [MOVED]
THIS POST MOVED TO MY NEW BLOG AT https://blog.phor.net/pennsylvania-collects-newborn-dna
Pennsylvania Corporate Tax Records Were Available to Public [MOVED]
THIS POST MOVED TO MY NEW BLOG AT https://blog.phor.net/pennsylvania-corporate-tax-records-published
What Happens When You Send a Zero-Day to a Bank? [MOVED]
THIS POST MOVED TO MY NEW BLOG AT https://blog.phor.net/how-to-zero-day-a-bank