iiinova — where your digital self keeps evolving

Sasha @mxsash.bsky.social · 03/06/2026

meshcore-card was fixed within a day in v0.3.3 (CVE-2026-45323). Around 20 MeshCore analyzer websites are likely affected too, including CoreScope, where a vibecoding bot seems to have broken the XSS filter while hallucinating a bugfix.

000

Sasha @mxsash.bsky.social · 03/06/2026

The attacker doesn't need to be near the target, because MeshCore advertisements relay through the mesh, which is dense in the Netherlands. Names can only be 32 bytes, so I needed three of them and an iframe srcdoc trick I'd never heard of to run a longer payload.

100

Sasha @mxsash.bsky.social · 03/06/2026

A crafted MeshCore node name on a LoRa mesh could compromise a Home Assistant instance running meshcore-card, with an XSS chaining to remote root on the HA host. Some other sites are vulnerable too, likely along with MeshCore-Home-Assistant-Panel-v2 mxsasha.eu/posts/meshco...

mxsasha.eu

Rooting Home Assistant through MeshCore: XSS attacks with a LoRa node name

A crafted MeshCore node name could compromise any Home Assistant instance running meshcore-card as soon as someone viewed a dashboard with that card. MeshCore …

130

Sasha @mxsash.bsky.social · 28/05/2026

Two ways to exploit it: XSS in RIPEstat via DNS NS records, or a free Atlas probe. Installing a web server and one HTML page was all it took. Fixed in 20 days. This all took place before my #RIPE92 talk from last week, only some of it made it into that talk. More structural fixes pending.

000

Sasha @mxsash.bsky.social · 28/05/2026

A RIPE Atlas probe could have been enough to hijack a RIPE NCC user's next login. Full member portal access, including RPKI and the RIPE Database. Session fixation in RIPE NCC's SSO: token not rotated on login. mxsasha.eu/posts/ripe-n...

mxsasha.eu

RIPE NCC session fixation: poaching logins with an Atlas probe

RIPE NCC’s single sign-on did not rotate session tokens on login, leaving 12000 Atlas probe hosts in a position to compromise other RIPE NCC users’ …

100

Sasha @mxsash.bsky.social · 06/05/2026

Resolved 3 months after my report, by adding two DNS records. The impact went further than last week's XSS+CSRF post: full session access, persistent admin users and API keys. RIPE NCC has not publicly acknowledged this.

000

Sasha @mxsash.bsky.social · 06/05/2026

RIPE NCC gave over 1000 third parties the ability to steal session tokens from any logged-in user. RIPE NCC had placed strangers under the same domain as their most critical systems. Full member portal access from one link click. mxsasha.eu/posts/ripe-n...

mxsasha.eu

1000 third parties could have stolen RIPE NCC session tokens - by design

The RIPE NCC made its all-powerful single sign-on tokens available to over 1000 third parties. From a single link click, any logged-in RIPE NCC user would leak …

130

Sasha @mxsash.bsky.social · 29/04/2026

All vulnerabilities have been fixed. Disclosure took 14 months across 5 communication channels, with two incorrect fixes for the same issue mxsasha.eu/posts/ripe-n... Presenting this and more at #RIPE92: "Manipulating RPKI (and more) with marquees in TLS certificates (and more)"

mxsasha.eu

Inside a 14-month responsible disclosure with the RIPE NCC

This post covers the disclosure process for the vulnerabilities described in my RPKI exploit chain, through RIPE NCC’s Responsible Disclosure Policy. What …

120

Sasha @mxsash.bsky.social · 29/04/2026

I found a chain of vulnerabilities at RIPE NCC, one of five RPKI trust anchors. One click on an innocuous link could disconnect a network from the internet. Entry points: debugging fields in DNS and crafted TLS certificates, escalating to RPKI Dashboard and RIPE Database mxsasha.eu/posts/ripe-n...

mxsasha.eu

Taking down a European network with a TLS certificate: my RIPE NCC RPKI exploit chain

One click on a malicious, but not suspicious, link. That is all it could take for a network operator to get disconnected from the internet, through a chain of …

1106

Sasha @mxsash.bsky.social · 14/04/2026

I have been working on a set of vulnerabilities for 14(!) months, but the end is in sight! Just sent the draft blogs to the vendor for review, got € 3200 in bug bounties, and in two weeks I should be able to publish my attack chain on critical internet infrastructure 🕵️‍♀️

Screenshot of Intigriti bug bounty platform, showing an award for an exceptional severity find on April 13, 2026.

010

Sasha @mxsash.bsky.social · 02/04/2026

Are you still only using two factor authentication? I'm way ahead of you with my 7 factor authentication 🔐

Photo of a USB hub, with 6 yubikey USB tokens inserted, of various types and colors.

130

Sasha @mxsash.bsky.social · 19/03/2026

Rooting OpenWRT from the parking lot: I discovered an XSS in the OpenWRT SSID scan page, that can be chained to remote root access 👾 Write-up and demo: mxsasha.eu/posts/openwr... CVE-2026-32721, fixed in 24.10.6 / 25.12.1

111

Reposted by Sasha

PyCon UK @pyconuk.org · 05/09/2025

⭐️ Talk spotlight! ⭐️ 🎙10 Python Performance Mistakes I Won’t Make Again by @mxsash.bsky.social Find out more here: buff.ly/JoEMgv2 🎟️ Grab your ticket! buff.ly/fZ6GaUh #PyConUK2025 #Python

053

Sasha @mxsash.bsky.social · 13/11/2024

Django people, what do we use these days for simple decent looking web interfaces, with limited effort? Some forms, a text page, a few tables, etc. Is it still Bootstrap? Is it Tailwind with some additional things (seems very bare on its own)? Easy integration with Django form rendering is a plus.

222