EQST

@EQSTLab

#SKshieldus: Korea's leading cybersecurity firm with 20+ yrs of tech expertise & a vast customer base. #1 in full-cycle services. Contact : 1800-6400

경기도 성남시 분당구 판교로227번길 23 (삼평동)

skshieldus.com/eng/index.do

Joined April 2023

11 Following

1,037 Followers

Pinned
EQST
@EQSTLab
Jan 21
📢 Big News! #Pwn2Own #P2OAuto Taejin Kim (@tae3), Junsu Yeo (@junactually), Sunmin Park (@sunminpark4503), Sungmin Son (@_ssm98), and Hoseok Lee of SKShieldus (@EQSTLab) of 299 exploited a hardcoded credential (CWE-798) to achieve code execution via CWE-494 on the Grizzl-E Smart 40A, earning $40,000 USD and 4 Master of Pwn points.
1
EQST
@EQSTLab
Sep 29
⚠️ CVE-2026-94545 (CVSS 9.5) ⚠️ Your Next.js OG image endpoint can hand an attacker a shell. 😱 If you use next/og on the Node runtime with sharp installed (what Next recommends for prod), one unauthenticated POST to that route runs commands on your server. Here's why: Satori
8
EQST
@EQSTLab
Sep 29
⚠️CVE-2026-49869 (CVSS 10.0)⚠️ Unauthenticated RCE in Kestra OSS workers. A `/configs` suffix bypasses Basic Auth, letting attackers create and run shell-task flows. It affects OSS instances using Basic Auth when an attacker can reach the API; no credentials or pre-existing flow are required. 🔥PoC + Vulnerable environment: github.com/EQSTLab/CVE-20… #Kestra #RCE #CyberSecurity #CVE #PoC #Exploit #CVE_2026_49869
1
EQST
@EQSTLab
Sep 28
⚠️CVE-2026-6951 (CVSS 8.2)⚠️ Remote Code Execution in simple-git. In simple-git before 3.36.0, attackers may bypass Git option filtering using --config and execute arbitrary commands when user-controlled options are passed to simple-git. 🔥PoC + Vulnerable environment: github.com/EQSTLab/CVE-20… #simplegit #RCE #CommandInjection #NodeJS #CyberSecurity #CVE #PoC #Exploit #CVE_2026_6951
EQST
@EQSTLab
Sep 28
⚠️CVE-2026-85706 (CVSS 10.0)⚠️ Your GitLab will hand a stranger its files. 😱 No login. No account. An attacker just URL-encodes one letter of commits → %63ommits, and GitLab-Workhorse waves the request through — so a single unauthenticated POST to the repository commits API
19

EQST

EQST’s posts