<?xml version="1.0" encoding="utf-8"?><feed xmlns="http://www.w3.org/2005/Atom" ><generator uri="https://jekyllrb.com/" version="4.3.4">Jekyll</generator><link href="https://aydinnyunus.github.io/feed.xml" rel="self" type="application/atom+xml" /><link href="https://aydinnyunus.github.io/" rel="alternate" type="text/html" /><updated>2026-10-17T09:40:54+00:00</updated><id>https://aydinnyunus.github.io/feed.xml</id><title type="html">Yunus Aydın Blog</title><subtitle>Supply-chain security, CVE deep-dives, and open-source vulnerability research. npm malware analysis, browser extension reversing, GitHub Archive secret scanning, and responsible disclosure write-ups.</subtitle><author><name>Yunus Aydın</name></author><entry xml:lang="tr"><title type="html">Mage AI git config’inde command injection</title><link href="https://aydinnyunus.github.io/2026/10/06/command-injection-mage-ai-git-utils-tr/" rel="alternate" type="text/html" title="Mage AI git config’inde command injection" /><published>2026-10-06T00:00:00+00:00</published><updated>2026-10-06T00:00:00+00:00</updated><id>https://aydinnyunus.github.io/2026/10/06/command-injection-mage-ai-git-utils-tr</id><author><name>Yunus Aydın</name></author><summary type="html"><![CDATA[Mage AI'ın add_host_to_known_hosts fonksiyonunda command injection. Nisan 2024'te raporladım, 26 ay sessizlikten sonra Haziran 2026'da düzeltildi.]]></summary></entry><entry xml:lang="en"><title type="html">Command injection in Mage AI’s git config</title><link href="https://aydinnyunus.github.io/2026/10/06/command-injection-mage-ai-git-utils/" rel="alternate" type="text/html" title="Command injection in Mage AI’s git config" /><published>2026-10-06T00:00:00+00:00</published><updated>2026-10-06T00:00:00+00:00</updated><id>https://aydinnyunus.github.io/2026/10/06/command-injection-mage-ai-git-utils</id><author><name>Yunus Aydın</name></author><summary type="html"><![CDATA[Command injection in mage-ai's add_host_to_known_hosts via unvalidated git URL parsing. Reported April 2024, patched June 2026 after 26 months of silence.]]></summary></entry><entry xml:lang="tr"><title type="html">CVE-2024-27763: SLURM_NODELIST üzerinden BasicSR komut enjeksiyonu</title><link href="https://aydinnyunus.github.io/2026/09/22/cve-2024-27763-basicsr-slurm-command-injection-tr/" rel="alternate" type="text/html" title="CVE-2024-27763: SLURM_NODELIST üzerinden BasicSR komut enjeksiyonu" /><published>2026-09-22T00:00:00+00:00</published><updated>2026-09-22T00:00:00+00:00</updated><id>https://aydinnyunus.github.io/2026/09/22/cve-2024-27763-basicsr-slurm-command-injection-tr</id><author><name>Yunus Aydın</name></author><summary type="html"><![CDATA[CVE-2024-27763 (CVSS 5.3): BasicSR 1.4.2 ve öncesi, SLURM_NODELIST environment variable'ını doğrudan bir shell komutunun içine koyuyor. Lokal saldırgan keyfi komut çalıştırabiliyor.]]></summary></entry><entry xml:lang="en"><title type="html">CVE-2024-27763: Command injection in BasicSR via SLURM_NODELIST</title><link href="https://aydinnyunus.github.io/2026/09/22/cve-2024-27763-basicsr-slurm-command-injection/" rel="alternate" type="text/html" title="CVE-2024-27763: Command injection in BasicSR via SLURM_NODELIST" /><published>2026-09-22T00:00:00+00:00</published><updated>2026-09-22T00:00:00+00:00</updated><id>https://aydinnyunus.github.io/2026/09/22/cve-2024-27763-basicsr-slurm-command-injection</id><author><name>Yunus Aydın</name></author><summary type="html"><![CDATA[CVE-2024-27763 (CVSS 5.3): BasicSR 1.4.2 and earlier interpolates the SLURM_NODELIST environment variable into a shell command, letting a local attacker run arbitrary commands.]]></summary></entry><entry xml:lang="tr"><title type="html">Family Link site engelini sonuna nokta koyarak atlatmak</title><link href="https://aydinnyunus.github.io/2026/09/09/family-link-trailing-dot-bypass-tr/" rel="alternate" type="text/html" title="Family Link site engelini sonuna nokta koyarak atlatmak" /><published>2026-09-09T00:00:00+00:00</published><updated>2026-09-09T00:00:00+00:00</updated><id>https://aydinnyunus.github.io/2026/09/09/family-link-trailing-dot-bypass-tr</id><author><name>Yunus Aydın</name></author><summary type="html"><![CDATA[Chrome'un Family Link URL filtresi, URL host'unu velinin engel listesiyle strict string eşitliği ile karşılaştırıyor. Sona tek bir nokta eklemek tüm engelli siteleri atlatıyor.]]></summary></entry><entry xml:lang="en"><title type="html">Bypassing Family Link’s website blocklist with a trailing dot</title><link href="https://aydinnyunus.github.io/2026/09/09/family-link-trailing-dot-bypass/" rel="alternate" type="text/html" title="Bypassing Family Link’s website blocklist with a trailing dot" /><published>2026-09-09T00:00:00+00:00</published><updated>2026-09-09T00:00:00+00:00</updated><id>https://aydinnyunus.github.io/2026/09/09/family-link-trailing-dot-bypass</id><author><name>Yunus Aydın</name></author><summary type="html"><![CDATA[Chrome's Family Link URL filter compares the URL host to the parent's blocklist with strict string equality. Appending a single trailing dot bypasses every blocked site.]]></summary></entry><entry xml:lang="tr"><title type="html">Worklo: Sahte Startup, Gerçek Malware</title><link href="https://aydinnyunus.github.io/2026/08/06/worklo-fake-job-npm-supply-chain-malware-tr/" rel="alternate" type="text/html" title="Worklo: Sahte Startup, Gerçek Malware" /><published>2026-08-06T00:00:00+00:00</published><updated>2026-08-06T00:00:00+00:00</updated><id>https://aydinnyunus.github.io/2026/08/06/worklo-fake-job-npm-supply-chain-malware-tr</id><author><name>Yunus Aydın</name></author><summary type="html"><![CDATA[Worklo adlı sahte bir startup, LinkedIn üzerinden geliştirici hedefleyerek take-home assignment içine gizlenmiş npm supply chain malware dağıttı. Private scoped package ve embedded auth token ile çalışan RCE dropper analizi.]]></summary></entry><entry xml:lang="en"><title type="html">Worklo: Fake Startup, Real Malware in the Take-Home Assignment</title><link href="https://aydinnyunus.github.io/2026/08/06/worklo-fake-job-npm-supply-chain-malware/" rel="alternate" type="text/html" title="Worklo: Fake Startup, Real Malware in the Take-Home Assignment" /><published>2026-08-06T00:00:00+00:00</published><updated>2026-08-06T00:00:00+00:00</updated><id>https://aydinnyunus.github.io/2026/08/06/worklo-fake-job-npm-supply-chain-malware</id><author><name>Yunus Aydın</name></author><summary type="html"><![CDATA[A fake startup called Worklo used LinkedIn recruiters, a polished website, and a rigged take-home assignment to deliver npm supply chain malware via a private scoped package with an embedded auth token.]]></summary></entry><entry xml:lang="tr"><title type="html">ModHeader: Browsing Geçmişini Sızdıran Chrome Eklentisi Analizi</title><link href="https://aydinnyunus.github.io/2026/07/12/modheader-data-exfiltration-stanfordstudies-tr/" rel="alternate" type="text/html" title="ModHeader: Browsing Geçmişini Sızdıran Chrome Eklentisi Analizi" /><published>2026-07-12T00:00:00+00:00</published><updated>2026-07-12T00:00:00+00:00</updated><id>https://aydinnyunus.github.io/2026/07/12/modheader-data-exfiltration-stanfordstudies-tr</id><author><name>Yunus Aydın</name></author><summary type="html"><![CDATA[ModHeader Chrome eklentisi (1.6M kullanıcı) AES-GCM ile şifreleyip tüm gezinme geçmişini api.stanfordstudies.com'a gönderiyor. Full reverse engineering analizi.]]></summary></entry><entry xml:lang="en"><title type="html">ModHeader: Covert Data Exfiltration to api.stanfordstudies.com</title><link href="https://aydinnyunus.github.io/2026/07/12/modheader-data-exfiltration-stanfordstudies/" rel="alternate" type="text/html" title="ModHeader: Covert Data Exfiltration to api.stanfordstudies.com" /><published>2026-07-12T00:00:00+00:00</published><updated>2026-07-12T00:00:00+00:00</updated><id>https://aydinnyunus.github.io/2026/07/12/modheader-data-exfiltration-stanfordstudies</id><author><name>Yunus Aydın</name></author><summary type="html"><![CDATA[ModHeader browser extension silently exfiltrates browsing history to api.stanfordstudies.com using AES-GCM encrypted IndexedDB. Full reverse engineering analysis.]]></summary></entry></feed>