Flameee

New Laravel one-day exploit by Yokai Research! 🔥 Full analysis, PoC, and exploit available here: github.com/hakaioffsec/GHSA-… We analyzed GHSA-f9x3-7vq9-cph6, a critical authentication bypass in Laravel affecting TokenGuard, the native mechanism used to protect auth:api routes. The issue was originally discovered by KIKOmanasijev(github.com/KIKOmanasijev) and disclosed through GitHub Security Advisory. After the advisory went public, our team reproduced the vulnerable behavior, analyzed the authentication flow, identified the conditions required for exploitation, and developed a working PoC and exploit. We break down how the bypass happens, why TokenGuard can fail to enforce authentication as expected, and what that means for applications relying on affected configurations. No CVE has been assigned at the time of publication. Authors: @biscoitomesmo and @Gabriel52489026 Blog post: yokai.hakaisecurity.io/en-gh… #HakaiSecurity #YokaiResearch #Laravel #SecurityResearch #authbypass #tokenguard

We showed up big at #BSidesJP2026! Our team hit the stage with two tech talks by Thiago Bispo & Rafael Felix Thiago covered how databases serve as the primary line of defense and why strict access policies are crucial to prevent data exposure. Rafael introduced and went deep on Lyra, an open-source, cargo-native LLVM IR obfuscator for Rust. Using RUSTC_WRAPPER, it intercepts crates during a standard build to run configurable transformations (string encryption, basic block shuffling, indirect branch obfuscation) before hitting the linker. Zero changes to code or the compiler—just a single CLI flag. Were you at the event? Drop your questions below! Biscoito @biscoitomesmo @BSidesJP Agenda: bsidesjp.com.br/#agenda

About a year ago, Hakai Security introduced the Beerus Framework, an initiative created to centralize security tools and streamline the penetration testing process directly on Android devices. Now, Beerus expands its capabilities to iOS. Following the same approach as the Android version, the framework aims to gather essential tools into a single environment and simplify device preparation for security testing, reducing complex configurations and operational friction during assessments. Authors: Daniel França Lima Daniel, known as Daniboy, is 19 years old, Brazilian, and works as a Pentester and Researcher at Hakai Security. Passionate about understanding how things work, building tools, and manipulating systems. In his free time, he enjoys gaming, especially titles like Hollow Knight, and he also loves foxes. Gabriel Rodrigues @Gabriel52489026 Gabriel Rodrigues, researcher and Pentester at Hakai Security. He has one year of experience in offensive security and holds the CPTS certification. As he says himself: “My friends call me Texugo (Badger) because one of them once said that I look like one." Check out the article on our newly redesigned blog: yokai.hakaisecurity.io/enbee… Github: github.com/hakaioffsec/beeru…

Hakai Security research recognized by Apple! Our analyst Gabriel Rodrigues, from Yokai Research team, was acknowledged by Apple in the security content for macOS Golden Gate 27, following security research related to iCloud that was reported to the company. The technical details of the vulnerability cannot be disclosed yet, so for now, the finding itself will have to remain under wraps. But as soon as we are able to disclose, we'll bring you some technical breakdown for sure! 👀 Congratulations, @Gabriel52489026, on the research and the recognition! 🔥

Apple Security Content:
support.apple.com/en-us/1490…  #HakaiSecurity #SecurityResearch #AppleSecurity #CyberSecurity

Rust is rapidly becoming the language of choice for red team tooling, implants, and security-critical software. Yet the offensive security ecosystem has almost no obfuscation tooling for it. Nearly every production obfuscator targets C/C++ binaries or operates on final PE/ELF images; Rust’s unique compile pipeline, name mangling, and LLVM IR patterns require a fundamentally different approach. This talk presents Lyra, an open-source, cargo-native LLVM IR obfuscator for Rust. Lyra intercepts each crate during a normal “cargo build” via RUSTC_WRAPPER, transforms the LLVM IR with a configurable pass pipeline - string encryption, basic-block shuffling, indirect-branch obfuscation - recompiles the result with llc + clang, and substitutes the object before the real MSVC linker runs. Zero changes to the Rust compiler, zero changes to the target project’s source code, one flag on the command line. We walk through the architecture, the engineering challenges unique to Windows/MSVC (UTF-16 response files, allocator-shim object preservation, inkwell’s undocumented panic guards), and live before-and-after demonstrations in IDA Pro, Ghidra, and Binary Ninja. We also show a YARA rule that confidently matches a plain demo build returning zero results on the obfuscated binary, and two consecutive unseeded builds producing different hex patterns, defeating a rule written on the first build. Lyra is released open-source at the time of the talk. All demos are reproducible from the release. Attendees leave with a working tool they can run against their own Rust projects the same day. Rafael Felix @biscoitomesmo and João Pedro Tricta @_tricta Breaking Ground, Tuesday 18:00-19:00 (4 of august) BSides La Vegas bsideslv.org/talks / @BSidesLV

A few months after the initial release of the Beerus Framework, we are publishing version v1.1, a minor update that brings support for new root environments, a relevant architectural change in data transport, integrated auto-update, and a set of accumulated fixes since the first release. In this post, we detail each change included in this version, the technical context behind each decision, and what it means in practice for those who use Beerus in their day-to-day Android testing. Authors @_tricta and @d3vchac Check it out surl.lt/osfnsr