Hacker News: traekfuglenehttps://news.ycombinator.com/user?id=traekfugleneHacker News RSShttps://hnrss.org/hnrss v2.1.1Sat, 04 Jul 2026 09:58:13 +0000<![CDATA[New comment by traekfuglene in "Ask HN: What are you working on? (May 2026)"]]>Striga (https://www.striga.ai/) - Source code auditing built on artificial intelligence. Auditing source code with local LLMs, ensuring full data sovereignty. The latest noteworthy discovery - Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 (CVE-2026-23918)

]]>Mon, 11 May 2026 14:29:06 +0000https://news.ycombinator.com/item?id=48095473traekfuglenehttps://news.ycombinator.com/item?id=48095473https://news.ycombinator.com/item?id=48095473<![CDATA[CSRF and LDAP injection found and fixed in pac4j security framework]]>Article URL: https://www.pac4j.org/blog/security-advisory-pac4j-core-and-ldap.html

Comments URL: https://news.ycombinator.com/item?id=47611851

Points: 2

# Comments: 0

]]>Thu, 02 Apr 2026 09:05:09 +0000https://www.pac4j.org/blog/security-advisory-pac4j-core-and-ldap.htmltraekfuglenehttps://news.ycombinator.com/item?id=47611851https://news.ycombinator.com/item?id=47611851<![CDATA[New comment by traekfuglene in "Exploiting a 32-year-old buffer overflow in GNU telnetd (CVE-2026-32746)"]]>Pre-auth buffer overflow in telnetd's SLC handler, sitting in the codebase since 1994. We used Striga, our AI-driven source code auditing platform, to reproduce the exploitation path and work out the byte constraints. The writeup covers the math for GOT overwrite on 32-bit and why the same approach is probably impossible on 64-bit.

]]>Wed, 01 Apr 2026 12:13:49 +0000https://news.ycombinator.com/item?id=47599804traekfuglenehttps://news.ycombinator.com/item?id=47599804https://news.ycombinator.com/item?id=47599804<![CDATA[Exploiting a 32-year-old buffer overflow in GNU telnetd (CVE-2026-32746)]]>Article URL: https://www.striga.ai/research/pre-auth-rce-in-gnu-inetutils-telnetd

Comments URL: https://news.ycombinator.com/item?id=47599803

Points: 7

# Comments: 1

]]>Wed, 01 Apr 2026 12:13:49 +0000https://www.striga.ai/research/pre-auth-rce-in-gnu-inetutils-telnetdtraekfuglenehttps://news.ycombinator.com/item?id=47599803https://news.ycombinator.com/item?id=47599803<![CDATA[New comment by traekfuglene in "Taking Down the Internet's Most Popular HTTP Client with a Single JSON Key"]]>We used Striga to discover a high-severity vulnerability in axios, the most downloaded HTTP client in JavaScript. Any Node.js service that forwards user-controlled JSON through axios can be crashed with a single request. CVE-2026-25639. Patched in 1.13.5.

]]>Fri, 27 Mar 2026 10:25:57 +0000https://news.ycombinator.com/item?id=47540916traekfuglenehttps://news.ycombinator.com/item?id=47540916https://news.ycombinator.com/item?id=47540916<![CDATA[Taking Down the Internet's Most Popular HTTP Client with a Single JSON Key]]>Article URL: https://www.striga.ai/research/crashing-axios-with-proto

Comments URL: https://news.ycombinator.com/item?id=47540915

Points: 10

# Comments: 1

]]>Fri, 27 Mar 2026 10:25:57 +0000https://www.striga.ai/research/crashing-axios-with-prototraekfuglenehttps://news.ycombinator.com/item?id=47540915https://news.ycombinator.com/item?id=47540915