Original write-up on the fastjson 1.2.83 gadget-free RCE. Have fun reading, I hope you missed writeups without AI slop. Comment here your opinion. fearsoff.org/research/fastjs…

Bitget lost $351.6 million this week. The private keys were never touched. According to CEO @GracyBitget , the attacker compromised a backend system in the wallet infrastructure, spoofed transaction data, and let the exchange's own authorization process move the funds out. That's the same shape as Bybit in 2025. The vault held. The process that decides what gets signed didn't. I won't claim anyone would have stopped this. Nobody outside Bitget knows the full chain yet, and their team is handling it in the open. But this class of attack lives in one assumption: that the approval layer can trust what upstream systems tell it. A point-in-time pentest scoped to apps and APIs rarely touches that assumption. A team attacking continuously, with "move funds out" as its objective, goes after it first, and again every time the infrastructure changes. That's why the annual pentest has quietly stopped being security. It survives as a compliance artifact: regulators ask for it, auditors file it, boards tick the box. None of it tells you whether you can be breached this week. Coinbase's Chief Security Officer @JLunglhofer recently named the alternative: Continuous Adversarial Testing. Their version runs AI agents against every commit, deployment and newly discovered service, on a simple premise: adversaries don't pause between pentest engagements. And adversaries now have AI. This year a frontier lab disclosed that its own unreleased model, told to escape a secured test sandbox, built a multi-step exploit, reached the internet, and published details of the escape without being asked. An exchange or major chain operates in one of the most adversary-dense environments that exists: global attackers, an attack surface that changes daily, enormous payouts, and losses that settle irreversibly in minutes. A report describing how secure you were last quarter is a historical document. This is the problem we built FearsOff's model around. For several of the largest exchanges and blockchain networks, our operators don't arrive, hand over a PDF and disappear. They attack continuously under agreed rules of engagement, hitting new code, new infrastructure and new techniques as they land. In practice we operate as an extension of the internal security team. AI agents will find volume. The breaches that end companies still come from chained logic flaws a determined human spots and an agent walks past. Continuous testing needs both. So stop asking "When was our last pentest?" Ask "Who is trying to break us today: someone we hired, or someone we haven't met yet?" Continuous adversarial testing isn't the future of offensive security. It's becoming the floor.

We'd have done exactly the same thing. We have spent years fighting to prove impact on almost every submission. A lot of bug bounty teams are insecure as hell, they think their job is to cover their asses and tell the bosses there was no real impact. The second you actually prove the impact is huge and critical, they start playing games: out of scope, you shouldn't have done that, etc. Fuck all that. A real attacker doesn't give a shit about your program scope. That scope only exists to protect the bounty team.

Trying the Hebrew appeal lifehack on my HackerOne account.

After a lot of back-and-forth we proved the critical impact and got the maximum bounty. Always stand your ground when they try to lowball you.

North Korea used servers vulnerable to a bug we found as C2 in its latest campaign targeting the defence, aerospace, and aviation sectors. Check Point's report last week: Lazarus exploited a Windows kernel zero-day, CVE-2026-68820 in afd.sys, since at least early July against defense, aerospace and aviation targets in France, Germany, Brazil and India. The campaign ran two parallel infection chains. One used signed-binary DLL sideloading to execute MISTPEN in memory. The other used a trojanized PDF viewer to deploy a new backdoor, Troy. Both could escalate to SYSTEM through CVE-2026-68820, followed by a new FudModule build designed to disable EDR visibility. MISTPEN ultimately deployed ForestTiger for long-term access. Microsoft patched the zero-day on 11 August. Much of the C2 infrastructure wasn't theirs. Check Point found compromised Roundcube, WordPress and PrestaShop servers being used as relay infrastructure. It assesses that Lazarus likely authenticated to vulnerable Roundcube servers using leaked credentials, exploited CVE-2025-49113, and planted RelayShell. The researchers identified at least 17 likely relay nodes. One compromised organization headquartered in France was then used to spear-phish targets worldwide - borrowing a legitimate organization's infrastructure and reputation to make the messages more credible. CVE-2025-49113 is ours. Our co-founder @k_firsov discovered and reported it in May 2025: authenticated RCE via PHP object deserialization, CVSS 9.9, sitting in the Roundcube codebase for more than a decade. Roundcube patched it on 1 June 2025. Attackers diffed and weaponized the vulnerability within 48 hours of the patch becoming available, with a working exploit offered for sale days later. We published the full technical breakdown to give defenders parity. CISA added CVE-2025-49113 to its Known Exploited Vulnerabilities catalog in February 2026, with a 13 March remediation deadline for covered US federal agencies. And Lazarus was still exploiting unpatched Roundcube servers in this campaign. We know the tradecraft because we spend our year on the other end of it. Lazarus is heavily involved in cryptocurrency theft, and we run continuous adversarial simulation against exchanges and protocols that sit high on the DPRK targeting list. The objectives differ, but the tradecraft overlaps: recruitment lures, signed-binary sideloading, credential theft, and kernel-level evasion. Theft there. Espionage here. If you build aircraft, satellites, drones, avionics, sensors or related defense technology, your engineers fit the targeting profile. And your internet-facing Roundcube, WordPress or PrestaShop infrastructure can become someone else's C2 if it isn't secured and patched. We find the bugs that might end up in campaigns like this one. We also run the campaign against our own clients first, on purpose, with a scope document. Our research: lnkd.in/dzS-RYcz