@ambionics

A @LexfoSecurite solution. Ambionics is a native Continuous Threat Exposure Management (CTEM) solution that helps organizations reduce cyber exposure.

 Paris, France
ambionics.io
Joined September 2016
  • Tweets86
  • Following92
  • Followers2K
🚨 Critical File Upload to RCE in @NinjaForms File Uploads @WordPress plugin (CVE-2026-0740)! Deep dive & PoC: 👉blog.lexfo.fr/ninja-forms-up… 🔍By @whattheslime from @Ambionics CTEM solution 🛡️Patch available (v3.3.27) — Update now! #WordPress #RCE #InfoSec #CyberSecurity #CVE

Ninja Forms Uploads <= 3.3.26 - Arbitrary File Upload to RCE (CVE-2026-0740)

A technical deep dive into the discovery of an unauthenticated zero-day vulnerability in the Ninja Forms - File Uploads WordPress extension, which allows arbitrary file uploads, remote code executi...

blog.lexfo.fr
2
27
1
66
6,911
🚨 Casse-Spip: pre-auth RCE on SPIP, the CMS behind thousands of French public and media sites. 🔎 Our auditor @WaykoDev found the SQLi with Claude Opus 4.8. ⚡ Chained into RCE: 4 anonymous requests, no account. ✅ Fixed in 4.4.18 (CVE-2026-72708/9/10) blog.lexfo.fr/casse-spip-sql…

Casse-Spip - From an Unauthenticated SQL Injection to Remote Command Execution

Exploitation of multiple vulnerabilities in SPIP to gain remote code execution from unauthenticated privileges (CVE-2026-72708, CVE-2026-72709, CVE-2026-72710).

blog.lexfo.fr
2
13
2
25
2,813
🔓 On an asset under our continuous monitoring, our pentester @nol_tech turned a SELECT-only PostgreSQL SQLi in Drupal (CVE-2026-9082) into a full RCE when DB role is superuser. Details below 👇 📝 blog.lexfo.fr/drupal-postgre… 🛠️ github.com/ambionics/cve-202… #Drupal #PostgreSQL #RCE #SQLi

Drupal PostgreSQL SQL Injection: From SELECT-Only to RCE

Turning a SELECT-only PostgreSQL SQL injection into remote command execution when the injected role is a PostgreSQL superuser.

blog.lexfo.fr
2
20
2
67
9,109
Ambionics Security retweeted
Lexfo@LexfoSecuriteApr 16
Congratulations to our pentester @nol_tech on placing 2nd in the Web Senior category at the #FCSC2026 qualifications, with a score of 3,616 points. This kind of result speaks for itself. Best of luck for the next rounds! 🍀 #CTF #Cybersecurity
4
11
733
Ambionics Security retweeted
Lexfo@LexfoSecurite27 Oct 2025
🔔 New research from Lexfo on pre- & post-authentication vulnerabilities in WSO2 products — uncovering bypasses, RCE, SSRF, CSRF, and account-takeover risks. See our detail article → blog.lexfo.fr/wso2.html #cybersecurity #infosec #offensivesecurity #pentest #WSO2

Attacking WSO2 Products

Uncovering bypasses, RCE, SSRF, CSRF, and account-takeover vulnerabilities in WSO2 products.

blog.lexfo.fr
15
1
62
6,599
🚀 Huge thanks to @cfreal_ for the threading PR. Lightyear is now faster than ever! We truly appreciate continued contributions. If you haven’t yet, give lightyear a try and see the difference yourself! #opensource #lightyear #performance #php #pentest #infosec #cybersecurity
Charles Fol@cfreal_23 Jun 2025
lightyear just got 6 times faster! Although I now work at @Synacktiv, I proposed a PR for the tool to support threading and compression, greatly reducing the time required to dump a file. Dumping the demo /etc/passwd now takes 48s instead of 5m30. github.com/ambionics/lightye…

GitHub - ambionics/lightyear: lightyear is a tool to dump files in tedious (blind) conditions using...

lightyear is a tool to dump files in tedious (blind) conditions using PHP filters - ambionics/lightyear

github.com
2
10
1,208
GLPI, an open-source IT service management software suite, has released version 10.0.18, addressing two critical vulnerabilities found by our experts : an SQL injection (CVE-2025-24799) and a remote code execution (CVE-2025-24801). Checkout our blog post: blog.lexfo.fr/glpi-sql-to-rc….
2
22
1
78
7,649
The discovered chain contains interesting new vectors : Pre-authentication SQLi on the Inventory native feature ->Authentication bypass by fetching api_token or personal_token -> Either plugin command injection through the Marketplace or a new LFI vector via PDF exports->RCE.
1
4
616
New #PHP research by @ptswarm ! Using our tools wrapwrap (github.com/ambionics/wrapwra…) and our latest one lightyear (github.com/ambionics/lightye…) developed by @cfreal_ ! #php #xxe #infosec #CyberSecurity

GitHub - ambionics/wrapwrap: Generates a `php://filter` chain that adds a prefix and a suffix to...

Generates a `php://filter` chain that adds a prefix and a suffix to the contents of a file. - ambionics/wrapwrap

github.com
PT SWARM@ptswarm11 Mar 2025
🔥 The "impossible" XXE in PHP? Not so impossible anymore. Our researcher Aleksandr Zhurnakov discovered an interesting combination of PHP wrappers and a feature of XML parsing in libxml2 to exploit it. Read: swarm.ptsecurity.com/impossi…
5
1
13
1,825
We're proud to announce LIGHTYEAR, a tool that let you dump files, blind, in PHP, based on a new algorithm. ambionics.io/blog/lightyear-…
90
6
245
28,669
Kudos to @cfreal_ for his talk @defcon a few weeks ago ! You can watch it now on Youtube ! youtube.com/watch?v=11Yv2Ru7…

DEF CON 32 - Iconv, set the charset to RCE exploiting glibc to hack...

Upon its discovery, CVE-2024-2961, a very old buffer overflow in th...

youtube.com
1
9
619
At long last: Iconv, set the charset to RCE (part 3): in this final part of the iconv series, @cfreal_ demonstrates how you can use CVE-2024-2961 to convert BLIND file reads to RCE. ambionics.io/blog/iconv-cve-…
1
53
3
144
44,850
In August, @cfreal_ will be at @defcon to talk about CVE-2024-2961. Don't miss Iconv, set the charset to RCE: Exploiting the glibc to hack the PHP engine ! #DEFCON32
1
2
2
25
11,484
Iconv, set the charset to RCE (part 2): @cfreal_ exploits direct iconv() calls to hack the PHP engine, and its most popular webmail, @Roundcube (CVE-2024-2961). ambionics.io/blog/iconv-cve-…
65
2
164
26,045
Scalpel is here: this @Burp_Suite extension lets you edit your requests, in Python 3, in the repeater or on-the-fly. ambionics.io/blog/scalpel
1
15
3
50
9,716
more replies
📷 Modify the entire traffic with Scalpel. Implement custom logic to manipulate requests globally using the request function:
1
1
340
📷 Learn more and contribute: Scalpel is in Alpha and your feedback is valuable. Check the docs and join us on GitHub! github.com/ambionics/scalpel

GitHub - ambionics/scalpel: Scalpel is a Burp extension for intercepting and rewriting HTTP...

Scalpel is a Burp extension for intercepting and rewriting HTTP traffic, either on the fly or in the Repeater using Python 3 scripts. - ambionics/scalpel

github.com
1
288
Iconv, set the charset to RCE: in the first blog post of this series, @cfreal_ will show a new exploitation vector to get RCE in PHP from a file read primitive, using a bug in iconv() (CVE-2024-2961) ambionics.io/blog/iconv-cve-…
3
121
2
296
54,778
Load more