Excavating Exploits and PHP Footguns

This week features a mix of topics, from polyglot PDF/JSON to android kernel vulnerabilities. Project Zero also publishes a post about excavating an exploit strategy from crash logs of an In-The-Wild campaign. Links and vulnerability summaries for this episode are available at: [00:00:00] Introduction [00:07:48] Attacking Hypervisors - From KVM to Mobile Security Platforms [00:12:18] Bypassing File Upload Restrictions To Exploit Client-Side Path Traversal [00:19:41] How an obscure PHP footgun led to RCE in Craft CMS [00:34:44] oss-security - RSYNC: 6 vulnerabilities [00:42:13] The Qualcomm DSP Driver - Unexpectedly Excavating an Exploit [00:59:59] security-research/pocs/linux/kernelctf/CVE-2024-50264_lts_cos/docs/exploit.md [01:10:35] GLibc Heap Exploitation Training Podcast episodes are available on the usual podcast platforms: -- Apple Podcasts: -- Spotify: -- Google Podcasts: -- Other audio platforms can be found at You can also join our discord:

You can listen to Excavating Exploits and PHP Footguns online on Radio and Podcast. Open the player on this page to stream the available audio.

Excavating Exploits and PHP Footguns is an episode from Day[0] by dayzerosec.

This episode is 01:12:18 long.

This episode was published on Jan 20, 2025.

Yes. Use the heart button on the episode page to add it to your favorite episodes list.

Yes. This page shows related episodes from Day[0] when more episodes are available from the podcast feed.