September 3, 2026
- "The Validator Can Lie": SSRF through URL parser differentials in GitLab, Mealie, Apache ShenYu and Thumbor — the validator and the fetching library disagree about the same URL. Good pattern material for anyone auditing allowlist-based SSRF defences (xclow3n). · Vulnerabilities & Exploitation
in Ten Hours, Fifty Techniques: AI Agents Ran the Whole Ransomware Intrusion