Tomorrow at @SEC_T_org, Iβll be breaking down the journey of how I found paths to compromise software supply chainS.
Weβre going down the Linux side this time ;)
bug bounty still works, sure
problem is how much critical infra sits nowhere near it
most of it hasn't even had someone lazily throw a "hey chatgpt, find a 0-day for me make no mistakes" prompt at it yet
so i actually got more than one RCE chain (~2.5?) for SharePoint at Pwn2Own this year, even though i ended up using the freakishly simple one (for strategic reasons :p)
here's another one of them:
msrc.microsoft.com/update-guide/vβ¦
