Session-ception and User Namespaces Strike Again

API hacking and bypassing Ubuntu's user namespace restrictions feature in this week's episode, as well as a bug in CimFS for Windows and revisiting the infamous NSO group WebP bug. Links and vulnerability summaries for this episode are available at: [00:00:00] Introduction [00:00:28] Next.js and the corrupt middleware: the authorizing artifact [00:06:15] Pwning Millions of Smart Weighing Machines with API and Hardware Hacking [00:20:37] oss-sec: Three bypasses of Ubuntu's unprivileged user namespace restrictions [00:32:10] CimFS: Crashing in memory, Finding SYSTEM (Kernel Edition) [00:43:18] Blasting Past Webp [00:47:50] We hacked Google’s A.I Gemini and leaked its source code (at least some part) Podcast episodes are available on the usual podcast platforms: -- Apple Podcasts: -- Spotify: -- Google Podcasts: -- Other audio platforms can be found at You can also join our discord:

You can listen to Session-ception and User Namespaces Strike Again online on Radio and Podcast. Open the player on this page to stream the available audio.

Session-ception and User Namespaces Strike Again is an episode from Day[0] by dayzerosec.

This episode is 00:49:36 long.

This episode was published on Apr 1, 2025.

Yes. Use the heart button on the episode page to add it to your favorite episodes list.

Yes. This page shows related episodes from Day[0] when more episodes are available from the podcast feed.