Developer Security on 思安录 | Thinking's Security Notes

0day Hunting the Day After xAI Open-Sourced grok-build (Part 3): Grok-Build-CLI's folder-trust Blind Spot and the Zero-Prompt RCE

Thinking — Sat, 18 Jul 2026 00:00:00 +0000

0day Hunting the Day After xAI Open-Sourced grok-build (Part 1): The cargo check RCE Chain in Grok-Build-CLI

Thinking — Thu, 16 Jul 2026 00:00:00 +0000

0day Hunting the Day After xAI Open-Sourced grok-build (Part 2): The bypassPermissions RCE in Grok-Build-CLI and Claude Code CLI

Thinking — Thu, 16 Jul 2026 00:00:00 +0000

Grok CLI Whole-Repo Upload Reverse Analysis: How a Single Prompt Ships Your .env to the Cloud

Thinking — Wed, 15 Jul 2026 00:00:00 +0000

CVE-2017-9841 PHPUnit eval-stdin.php Remote Code Execution: When a PHP Testing Framework Becomes a Web Entry Point

Thinking — Mon, 15 May 2017 00:00:00 +0000

PHPUnit is one of the most popular unit testing frameworks in the PHP ecosystem, but its eval-stdin.php file is designed as a tool to “accept PHP code via the CLI” — if this file is accidentally deployed to the production environment’s web directory, an attacker can execute arbitrary PHP code through a simple POST request, CVSS 9.8, no authentication required.