Top all-time · #1698
watchTowr Labs
Company blog · labs.watchtowr.comsecurity
watchTowr Labs is the company blog at labs.watchtowr.com, writing about security. Since 2024, 42 different Hacker News readers have linked it 50 times, most often “8M Requests Later, We Made SolarWinds Supply Chain Attack Look Amateur”. It is still writing: the last post was on 2026-10-09, and you can follow it by feed.
watchTowr Labs is the epicentre of offensive security expertise at watchTowr - where research, innovation, and real attacker insight power our Preemptive Exposure Management technology.
Most-linked posts?
- 8M Requests Later, We Made SolarWinds Supply Chain Attack Look Amateur8 people · 8 mentions · first linked 2025-02-04
- CPanel and WHM Authentication Bypass Affecting 70M Domains4 people · 4 mentions · first linked 2026-04-29
- Check Point – Wrong Check Point (CVE-2024-24919)3 people · 3 mentions · first linked 2024-05-30
- Backdooring Your Backdoors – Another $20 Domain, More Governments3 people · 3 mentions · first linked 2025-01-08
- Pots and Pans, a.k.a. an Sslvpn Palo Alto Pan-OS CVE-2024-0012 and CVE-2024-94742 people · 3 mentions · first linked 2024-11-19
- /someone-knows-bash-far-too-well-and-we-love-it-ivanti-epmm-pre-auth-rces-cve-2026-1281-cve-2026-1340/2 people · 2 mentions · first linked 2026-02-09
- Bypassing Authentication Like It's the '90s – Pre-Auth RCE Chain(s)2 people · 2 mentions · first linked 2025-03-17
- Stop Putting Your Passwords into Random Websites (Yes, Seriously, You Are the PR2 people · 2 mentions · first linked 2025-11-25
- Get FortiRekt, I Am the Super_Admin Now – Fortinet FortiOS Authentication Bypass2 people · 2 mentions · first linked 2025-01-27
What Hacker News says?
This is like seeing a food poisoning outbreak at a fast food restaurant and concluding that it must be CIA/FSB/Mossad bogeymen trying a bioweapon. These breaches are things like not validating authentication tokens (at all, not just correctly) and that would be a big drop in professionalism from what we’ve seen from nation-state level attacks: https://labs.watchtowr.com/get-fortirekt-i-am-the-super_admi...
Comment linking /get-fortirekt-i-am-the-super_admin-now-fortios-authentication-bypass-cve-2024-55591/
on “Drilling down on Uncle Sam's proposed TP-Link ban”Submitted We spent $20 to achieve RCE and accidentally became the admins of .mobi as a story · 1624 points
HN discussionIt seems you forgot to note this comment is a quote from [1]. 1. https://labs.watchtowr.com/someone-knows-bash-far-too-well-a...
Comment linking /someone-knows-bash-far-too-well-and-we-love-it-ivanti-epmm-pre-auth-rces-cve-2026-1281-cve-2026-1340/
on “Sleeper Shells: Attackers Are Planting Dormant Backdoors in Ivanti EPMM”Submitted Backdooring Your Backdoors – Another $20 Domain, More Governments as a story · 433 points
HN discussionRelated: Someone Knows Bash Far Too Well, And We Love It (Ivanti EPMM Pre-Auth RCEs CVE-2026-1281 & CVE-2026-1340) https://labs.watchtowr.com/someone-knows-bash-far-too-well-a...
Comment linking /someone-knows-bash-far-too-well-and-we-love-it-ivanti-epmm-pre-auth-rces-cve-2026-1281-cve-2026-1340/
on “Sleeper Shells: Attackers Are Planting Dormant Backdoors in Ivanti EPMM”Submitted A 32-year-old bug walks into a Telnet server as a story · 112 points
HN discussionOriginal article: https://labs.watchtowr.com/8-million-requests-later-we-made-... I suppose the lesson is to not publicize your bucket names, if possible? Or if not, leave them present but empty in AWS and don't actually delete the buckets?
Comment linking /8-million-requests-later-we-made-the-solarwinds-supply-chain-attack-look-amateur/
on “Delivering Malware Through Abandoned Amazon S3 Buckets”Submitted Insufficiently sanitized data allows unauthenticated access to FreePBX Admin as a story · 52 points
HN discussionThe details of the "hole" are a bit horrifying (but, sadly, unsurprising): https://labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-...
Comment linking /pots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474/
on “1,000s of Palo Alto Networks firewalls hijacked miscreants exploit critical hole”Submitted Is This Bad? This Feels Bad. (Fortra GoAnywhere CVE-2025-10035) as a story · 44 points
HN discussionThe original article, with the PoC, was both funnier and didn't feel like it was written by an LLM (though the sign-off almost seem to be parodying some chatgpt-ism): https://labs.watchtowr.com/more-evidence-that-words-dont-mea...
Comment linking /more-evidence-that-words-dont-mean-what-we-thought-they-meant-ivanti-sentry-pre-auth-os-command-injection-cve-2026-10520/
on “Ivanti Sentry pre-auth RCE (CVE-2026-10520) – CVSS 10.0, public PoC, CISA KEV”Submitted Palo Alto – Putting the Protecc in GlobalProtect (CVE-2024-3400) as a story · 44 points
HN discussionA full breakdown of the vulnerability: https://labs.watchtowr.com/the-internet-is-falling-down-fall...
Comment linking /the-internet-is-falling-down-falling-down-falling-down-cpanel-whm-authentication-bypass-cve-2026-41940/
on “Hackers are actively exploiting a bug in cPanel and WHM”Submitted Stop Putting Your Passwords into Random Websites (Yes, Seriously, You Are the PR as a story · 33 points
HN discussionSubmitted Backdooring your backdoors – Another $20 domain, more governments as a story · 14 points
HN discussionSubmitted SOAPwn: Pwning .NET Framework Applications Through HTTP Client Proxies and WSDL as a story · 12 points
HN discussionSubmitted 8M Requests Later, We Made SolarWinds Supply Chain Attack Look Amateur as a story · 8 points
HN discussionSubmitted Stop Putting Your Passwords into Random Websites as a story · 7 points
HN discussionSubmitted Pots and Pans, a.k.a. an Sslvpn Palo Alto Pan-OS CVE-2024-0012 and CVE-2024-9474 as a story · 6 points
HN discussionSubmitted Atlassian Jira, Confluence Pre-Auth Arbitrary File Read (CVE-2026-21589) as a story · 5 points
HN discussionSubmitted Citrix NetScaler PreAuth Command Injection CVE-2026-88771 as a story · 5 points
HN discussionSubmitted Backdooring Your Backdoors – Another $20 Domain, More Governments as a story · 5 points
HN discussionSubmitted Auth. Bypass in (Un)Limited Scenarios – Progress MOVEit Transfer (CVE-2024-5806) as a story · 5 points
HN discussionSubmitted Citrix NetScaler Memory Disclosure (CitrixBleed 2 CVE-2025-5777) as a story · 4 points
HN discussionSubmitted The One Where We Just Steal the Vulnerabilities as a story · 3 points
HN discussionSubmitted Delivering Malware Through Abandoned Amazon S3 Buckets as a story · 3 points
HN discussionSubmitted CVE-2024-23113 a Super Complex Vulnerability in a Super Secure Appliance in 2024 as a story · 3 points
HN discussionSubmitted Check Point – Wrong Check Point (CVE-2024-24919) as a story · 3 points
HN discussionSubmitted CPanel and WHM Authentication Bypass Affecting 70M Domains as a story · 2 points
HN discussionSubmitted It Is Bad (Exploitation of Fortra GoAnywhere MFT CVE-2025-10035) – Part 2 as a story · 2 points
HN discussion
