Gareth Heyes - gareth.heyes@portswigger.net - @garethheyes It's quite common for webmail clients to render untrusted CSS in a trusted UI. They attempt to make this safe using CSS sanitization. In this
New Technique Bypass File Upload This write-up focuses on bypass file upload. Introduction During my security research on Outlook Web, I encountered an unusual behavior that led me to discover a …
Exchange Online Protection Improves Zero-Hour Auto Purge (ZAP) - Microsoft 365 for IT Pros
ZAP, or zero-hour auto purge, is an Exchange Online Protection (EOP) feature that's getting some extra features to deal better with spam and phish malware. New policy controls are available to control the feature.
Zero-hour auto purge in Microsoft Defender for Office 365 - Microsoft Defender for Office 365
Zero-hour auto purge (ZAP) in all organizations with cloud mailboxes handles messages in mailboxes retroactively identified as spam, phishing, or malware.
Next-Gen Phishing Tactics Users Aren’t Ready For | Huntress
Move past basic credential harvesting. Discover how modern attackers use ClickFix, BitB, and OAuth consent phishing—and how to train your users with Huntress SAT.
Content-Type Override to Stored XSS on Public Objects
A single response-content-type query parameter on a public bucket object turns a forced image/png into text/html, which is stored XSS on the target's own origin. MinIO hands it to you for free. S3 takes one extra step.
STAR Labs’ advisory on CVE-2026-41873 in Apache Pony Mail by Li Jiantao and Tevel Sho (disclosed 28 April 2026). Two independent bugs reach the same outcome — full admin takeover — without any authentication. In the modern Foal (Python) build, an attacker-supplied "oauth_token" URL drives a blind SSRF against the local Elasticsearch SQL endpoint, leaking the admin session cookie character-by-character (CVSS 9.1). In the legacy Lua build (now retired, no patch), a single unescaped query parameter in "email.lua" lets the attacker inject CRLF bytes into the Elasticsearch HTTP request and smuggle a second request that creates an admin account outright.
A widely used Secure E-Mail Gateway "SeppMail" revealed critical vulnerabilities with little effort and without chaining of multiple vulnerabilities. RCE to compromise the device, LFI to read mails and more. (CVE-2026-2743, CVE-2026-7864, CVE-2026-44127, CVE-2026-44128)
RainLoop Webmail - Emails at Risk due to Code Flaw
Sonar researchers discovered a critical stored cross-site scripting vulnerability in RainLoop Webmail that allows attackers to hijack user sessions and steal emails simply by sending a malicious email. The article explains the root cause, exploitation, and security implications.
Gaining Initial Access and Outsmarting SmartScreen
I’ve had a number of people ask me what approaches I have taken to secure that initial foothold on a machine/network during a pentest engagement. Well, the blunt and honest answer to that question is…it depends 😸 Initial access comes in many forms and depending on the type of pentest engagement, you will be afforded or NOT afforded various types of “lures” you can use to acquire that first foothold. Most clients are open to the pentest team exhausting all their resources and offensive tooling to truly assess the client’s security controls. If not they should be. Because in a real world attack, you better believe the threat actor will not hold back! In today’s post, I’ll be going over a very traditional approach to achieving initial access using email as our attack vector of choice. I’ll go over various ways to send the email (gui and non-gui) and using attachments versus links. I’ll also explain how to contend with MOTW (Mark of the Web) and SmartScreen security restrictions on your downloaded payloads for the modern Windows 11 environment.
Windows’ primary mechanism for shortcuts, LNK files, is frequently abused by threat actors for payload delivery and persistence. This blog post introduces several new LNK file flaws that, amongst other things, allow attackers to fully spoof an LNK’s target. It also introduces lnk-it-up, a tool suite that can generate such deceptive LNK files, as well as detect anomalous ones.
-3.png?width=92&height=&ar=&mode=&dpr=2)
