watchTowr Labs
labs.watchtowr.com · Company blog · on HN since 2024
watchTowr Labs is a security research team publishing detailed technical write-ups of vulnerabilities in enterprise software like Fortinet, Ivanti, and cPanel.
What HN saysHN links it for vulnerability breakdowns and proofs of concept. One commenter finds its older posts funnier and less LLM-sounding than a recent one.
39HN people shared it
7linked it in comments
40stories submitted
2.3Kstory points
3 months agolast shared
2024people per year2026
Most-shared posts
- 18M Requests Later, We Made SolarWinds Supply Chain Attack Look Amateur8 people · 19 points · first shared 2025 · 1 comments on HN
- 2CPanel and WHM Authentication Bypass Affecting 70M Domains4 people · 4 points · first shared 2026 · discussion on HN
- 3Backdooring Your Backdoors – Another $20 Domain, More Governments3 people · 452 points · first shared 2025 · 73 comments on HN
- 4Check Point – Wrong Check Point (CVE-2024-24919)3 people · 6 points · first shared 2024 · discussion on HN
- 5Stop Putting Your Passwords into Random Websites (Yes, Seriously, You Are the PR2 people · 40 points · first shared 2025 · 10 comments on HN
- 6Pots and Pans, a.k.a. an Sslvpn Palo Alto Pan-OS CVE-2024-0012 and CVE-2024-94742 people · 7 points · first shared 2024 · 2 comments on HN
- 7Bypassing Authentication Like It's the '90s – Pre-Auth RCE Chain(s)2 people · 3 points · first shared 2025 · discussion on HN
- 8Get FortiRekt, I Am the Super_Admin Now – Fortinet FortiOS Authentication Bypass2 people · 2 points · first shared 2025 · discussion on HN
- 9Someone knows bash far too well and we love it ivanti epmm pre auth rces cve 2026 1281 cve 2026 13402 people · first shared 2026
- 10We spent $20 to achieve RCE and accidentally became the admins of .mobi1 people · 1.6K points · first shared 2024 · 367 comments on HN
- 11Insufficiently sanitized data allows unauthenticated access to FreePBX Admin1 people · 52 points · first shared 2025 · 10 comments on HN
- 12Is This Bad? This Feels Bad. (Fortra GoAnywhere CVE-2025-10035)1 people · 44 points · first shared 2025 · 16 comments on HN
- 13Palo Alto – Putting the Protecc in GlobalProtect (CVE-2024-3400)1 people · 44 points · first shared 2024 · 32 comments on HN
- 14SOAPwn: Pwning .NET Framework Applications Through HTTP Client Proxies and WSDL1 people · 12 points · first shared 2025 · 2 comments on HN
- 15Auth. Bypass in (Un)Limited Scenarios – Progress MOVEit Transfer (CVE-2024-5806)1 people · 5 points · first shared 2024 · discussion on HN
What HN people wrote when they linked it
chillax · 2026-02-09
Related: Someone Knows Bash Far Too Well, And We Love It (Ivanti EPMM Pre-Auth RCEs CVE-2026-1281 & CVE-2026-1340) https://labs.watchtowr.com/someone-knows-bash-far-too-well-and-we-love…
ghostly_s · 2026-02-09
It seems you forgot to note this comment is a quote from [1].
1. https://labs.watchtowr.com/someone-knows-bash-far-too-well-and-we-love…
Chu4eeno · 2026-06-12
The original article, with the PoC, was both funnier and didn't feel like it was written by an LLM (though the sign-off almost seem to be parodying some chatgpt-ism):
https://labs.watchtowr.com/more-evidence-that-words-dont-mean-what-we-…
ChrisArchitect · 2026-05-01
A full breakdown of the vulnerability: https://labs.watchtowr.com/the-internet-is-falling-down-falling-down-f…
acdha · 2025-11-10
This is like seeing a food poisoning outbreak at a fast food restaurant and concluding that it must be CIA/FSB/Mossad bogeymen trying a bioweapon. These breaches are things like not validating authentication tokens (at all, not just correctly) and that would be a big drop in professionalism from what we’ve seen from nation-state level attacks:
https://labs.watchtowr.com/get-fortirekt-i-am-the-super_admin-now-fort…
easton · 2025-02-12
Original article: https://labs.watchtowr.com/8-million-requests-later-we-made-the-solarw…
I suppose the lesson is to not publicize your bucket names, if possible? Or if not, leave them present but empty in AWS and don't actually delete the buckets?
EvanAnderson · 2024-11-25
The details of the "hole" are a bit horrifying (but, sadly, unsurprising): https://labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-alto-pan-o…