Ax Sharma

Ax Sharma is a Security Researcher, Engineer, and Tech Columnist. His works and expert analyses have frequently been featured by leading media outlets like Fortune, BleepingComputer, The Register, TechRepublic, CIO, etc. Ax's expertise lies in vulnerability research, reverse engineering, software development, and web app security. He's an active community member of the OWASP Foundation and the British Association of Journalists (BAJ). News tips welcome via Twitter DM (@Ax_Sharma) or email (ax@hey.ax).

Cloudflare WAF bypass exploits revealed 3 min read

Cloudflare WAF bypass exploits revealed

Ax Sharma January 4, 2021

A Cross-Site Scripting (XSS) protection bypass technique has been revealed for Cloudflare Web Application Firewall (WAF). The exploit has been publicly known since 2019 but remains unpatched.... Read More

Amey suffers cyber attack from ransomware 4 min read

Amey suffers cyber attack from ransomware

Ax Sharma January 1, 2021

UK's prominent infrastructure management company Amey has been hit by Mount Locker ransomware group in what the company has called a "complex" cyber attack.... Read More

Backdoor master password for thousands of Zyxel firewalls revealed 3 min read

Backdoor master password for thousands of Zyxel firewalls revealed

Ax Sharma January 1, 2021

Thousands of Zyxel firewalls and access point controllers contain a secret, undocumented hardcoded password giving anyone admin access through this zero-day.... Read More

New Golang malware runs Monero miner on servers 2 min read

New Golang malware runs Monero miner on servers

Ax Sharma December 31, 2020

The Golang malware breaches Windows, Linux servers and exploits popular vulnerabilities such as a critical RCE in Oracle WebLogic. ... Read More

Kaggle fixes vulnerability that disclosed private leaderboard data via API 3 min read

Kaggle fixes vulnerability that disclosed private leaderboard data via API

Ax Sharma December 30, 2020

Kaggle, an online community of data scientists and machine learning practitioners had been exposing private competition data due to a misconfigured API. This could potentially give an unfair competitive advantage to participants.... Read More

Hacker selling Vodafone’s Ho Mobile database of 2.5M users 3 min read

Hacker selling Vodafone’s Ho Mobile database of 2.5M users

Ax Sharma December 29, 2020

The database contains ICCID that can be used in SIM swapping attacks. Other information in the leaked dump includes mobile number, customer PII, SIM PUK, IMSI and security hashes.... Read More

Joomla fixes ACL violation vulnerability after 2 years 2 min read

Joomla fixes ACL violation vulnerability after 2 years

Ax Sharma December 29, 2020

Joomla! CMS project has fixed an access control violation flaw, CVE-2020-35616 nearly after 2 years of its reporting.... Read More

Google ‘Send Feedback’ bug could expose your sensitive data to attackers 3 min read

Google ‘Send Feedback’ bug could expose your sensitive data to attackers

Ax Sharma December 28, 2020

Google Docs "Send Feedback" feature vulnerability which could expose your sensitive files to attackers earns researcher a $3,134 bounty.... Read More

Word malware uses GitHub and Imgur pic to run Cobalt Strike script 1 min read

Word malware uses GitHub and Imgur pic to run Cobalt Strike script

Ax Sharma December 28, 2020

A new strand of malware uses Word files with macros to download a PowerShell script from GitHub. This PowerShell script further downloads a legitimate image file from... Read More

time lapse photography of square containers at night

UK energy supplier E.ON erroneously takes out Direct Debit payments early 2 min read

UK energy supplier E.ON erroneously takes out Direct Debit payments early

Ax Sharma December 27, 2020

UK energy provider E.ON has apologised for mistakenly debiting customer bank accounts earlier than expected for their energy bill payments.... Read More

Ax Sharma

Cloudflare WAF bypass exploits revealed

Amey suffers cyber attack from ransomware

Backdoor master password for thousands of Zyxel firewalls revealed

New Golang malware runs Monero miner on servers

Kaggle fixes vulnerability that disclosed private leaderboard data via API

Hacker selling Vodafone’s Ho Mobile database of 2.5M users

Joomla fixes ACL violation vulnerability after 2 years

Google ‘Send Feedback’ bug could expose your sensitive data to attackers

Word malware uses GitHub and Imgur pic to run Cobalt Strike script

UK energy supplier E.ON erroneously takes out Direct Debit payments early

You may have missed

Phishing kit screenshots your email domain on the fly to appear real

Royal Mail online tracking returns — with a frustrating captcha that works half the time

New convincing phishing campaign targets Booking.com and Blockchain.com customers

A spreadsheet hosted on Intel.com is flagged as malware—but is it?