How we chained three vulnerabilities into a full Chrome exploit in just 6 days—claiming Google’s first $250,000 full-chain reward of 2026 for an attack affecting an estimated 1 billion users. 🧵
A thread on how XBOW identified an unauthenticated, Critical-severity Remote Code Execution vulnerability in a public web application belonging to the U.S. Election Assistance Commission (@EACgov), the independent, bipartisan federal commission that focuses on election
PHP2Shell: just another critical vulnerability but on a much faster clock...
AI didn’t make PHP vulnerable. It changed the economics of finding and exploiting the bugs already there.
@fede_k breaks down what happened and the shrinking window for defenders:
