@ambionics profile picture
Ambionics Security @ambionics
Joined September 2016
  • Tweets 85
  • Following 92
  • Followers 1,989
9 Photos and videos
Pinned Tweet
Ambionics Security@ambionics
May 28
🔓 On an asset under our continuous monitoring, our pentester @nol_tech turned a SELECT-only PostgreSQL SQLi in Drupal (CVE-2026-9082) into a full RCE when DB role is superuser. Details below 👇 📝 blog.lexfo.fr/drupal-postgre… 🛠️ github.com/ambionics/cve-202… #Drupal #PostgreSQL #RCE #SQLi

Drupal PostgreSQL SQL Injection: From SELECT-Only to RCE

Turning a SELECT-only PostgreSQL SQL injection into remote command execution when the injected role is a PostgreSQL superuser.

blog.lexfo.fr
2
20
66
8,548
Ambionics Security retweeted
Lexfo@LexfoSecurite
Apr 16
Congratulations to our pentester @nol_tech on placing 2nd in the Web Senior category at the #FCSC2026 qualifications, with a score of 3,616 points. This kind of result speaks for itself. Best of luck for the next rounds! 🍀 #CTF #Cybersecurity
4
11
645
🚨 Critical File Upload to RCE in @NinjaForms File Uploads @WordPress plugin (CVE-2026-0740)! Deep dive & PoC: 👉blog.lexfo.fr/ninja-forms-up… 🔍By @whattheslime from @Ambionics CTEM solution 🛡️Patch available (v3.3.27) — Update now! #WordPress #RCE #InfoSec #CyberSecurity #CVE

Ninja Forms Uploads <= 3.3.26 - Arbitrary File Upload to RCE (CVE-2026-0740)

A technical deep dive into the discovery of an unauthenticated zero-day vulnerability in the Ninja Forms - File Uploads WordPress extension, which allows arbitrary file uploads, remote code executi...

blog.lexfo.fr
2
26
66
6,444
Ambionics Security retweeted
Lexfo@LexfoSecurite
27 Oct 2025
🔔 New research from Lexfo on pre- & post-authentication vulnerabilities in WSO2 products — uncovering bypasses, RCE, SSRF, CSRF, and account-takeover risks. See our detail article → blog.lexfo.fr/wso2.html #cybersecurity #infosec #offensivesecurity #pentest #WSO2

Attacking WSO2 Products

Uncovering bypasses, RCE, SSRF, CSRF, and account-takeover vulnerabilities in WSO2 products.

blog.lexfo.fr
15
62
6,416
🚀 Huge thanks to @cfreal_ for the threading PR. Lightyear is now faster than ever! We truly appreciate continued contributions. If you haven’t yet, give lightyear a try and see the difference yourself! #opensource #lightyear #performance #php #pentest #infosec #cybersecurity
Charles Fol@cfreal_
23 Jun 2025
lightyear just got 6 times faster! Although I now work at @Synacktiv, I proposed a PR for the tool to support threading and compression, greatly reducing the time required to dump a file. Dumping the demo /etc/passwd now takes 48s instead of 5m30. github.com/ambionics/lightye…
2
10
1,181
GLPI, an open-source IT service management software suite, has released version 10.0.18, addressing two critical vulnerabilities found by our experts : an SQL injection (CVE-2025-24799) and a remote code execution (CVE-2025-24801). Checkout our blog post: blog.lexfo.fr/glpi-sql-to-rc….
2
22
79
7,604
The discovered chain contains interesting new vectors : Pre-authentication SQLi on the Inventory native feature ->Authentication bypass by fetching api_token or personal_token -> Either plugin command injection through the Marketplace or a new LFI vector via PDF exports->RCE.
1
4
607
New #PHP research by @ptswarm ! Using our tools wrapwrap (github.com/ambionics/wrapwra…) and our latest one lightyear (github.com/ambionics/lightye…) developed by @cfreal_ ! #php #xxe #infosec #CyberSecurity

GitHub - ambionics/wrapwrap: Generates a `php://filter` chain that adds a prefix and a suffix to...

Generates a `php://filter` chain that adds a prefix and a suffix to the contents of a file. - ambionics/wrapwrap

github.com
PT SWARM@ptswarm
11 Mar 2025
🔥 The "impossible" XXE in PHP? Not so impossible anymore. Our researcher Aleksandr Zhurnakov discovered an interesting combination of PHP wrappers and a feature of XML parsing in libxml2 to exploit it. Read: swarm.ptsecurity.com/impossi…
5
13
1,806
We're proud to announce LIGHTYEAR, a tool that let you dump files, blind, in PHP, based on a new algorithm. ambionics.io/blog/lightyear-…
90
245
28,572
Kudos to @cfreal_ for his talk @defcon a few weeks ago ! You can watch it now on Youtube ! youtube.com/watch?v=11Yv2Ru7…

DEF CON 32 - Iconv, set the charset to RCE exploiting glibc to hack...

Upon its discovery, CVE-2024-2961, a very old buffer overflow in th...

youtube.com
1
9
612
At long last: Iconv, set the charset to RCE (part 3): in this final part of the iconv series, @cfreal_ demonstrates how you can use CVE-2024-2961 to convert BLIND file reads to RCE. ambionics.io/blog/iconv-cve-…

1
53
144
44,780
In August, @cfreal_ will be at @defcon to talk about CVE-2024-2961. Don't miss Iconv, set the charset to RCE: Exploiting the glibc to hack the PHP engine ! #DEFCON32
1
2
25
11,443
Iconv, set the charset to RCE (part 2): @cfreal_ exploits direct iconv() calls to hack the PHP engine, and its most popular webmail, @Roundcube (CVE-2024-2961). ambionics.io/blog/iconv-cve-…
65
165
25,980
Scalpel is here: this @Burp_Suite extension lets you edit your requests, in Python 3, in the repeater or on-the-fly. ambionics.io/blog/scalpel
1
15
50
9,698
more replies
đź“· Modify the entire traffic with Scalpel. Implement custom logic to manipulate requests globally using the request function:
1
340
đź“· Learn more and contribute: Scalpel is in Alpha and your feedback is valuable. Check the docs and join us on GitHub! github.com/ambionics/scalpel

GitHub - ambionics/scalpel: Scalpel is a Burp extension for intercepting and rewriting HTTP...

Scalpel is a Burp extension for intercepting and rewriting HTTP traffic, either on the fly or in the Repeater using Python 3 scripts. - ambionics/scalpel

github.com
1
288
Iconv, set the charset to RCE: in the first blog post of this series, @cfreal_ will show a new exploitation vector to get RCE in PHP from a file read primitive, using a bug in iconv() (CVE-2024-2961) ambionics.io/blog/iconv-cve-…

3
121
299
54,402
PHPGGC just reached 3000 stars on @github ! In 7 years, it went from a handful of gadget chains to more than 140, with more than 50 contributors. github.com/ambionics/phpggc Thank You !
4
22
2,202
Load more