Post #1787827
2026-04-22 22:27 UTC
@danielkennedy74 @wendynather I am normally with you.
In this case, I’m not.
https://www.mchange.com/projects/c3p0/#security-note
This was one of about a dozen RCEs I found one morning with a simple prompt and about 1,000 tokens against Claude
Anything that’s tuned to find these problems is very dangerous.
DM me an email address and I’ll send you the results of the prompt
Replies (1)
-
@danielkennedy74@infosec.exchange 2026-04-22 23:45
@dpp @wendynather That's a little more clinical of a statement than a lot of what I'm being presented with. "I did X, this was the result, I'm concerned that..." with the ... being everything from 'this is better at chaining exploits' to 'just automating what a bug hunter can do against the world of in-use open-source is going to be a problem', etc.. In any case, happy to read anything you want to send.