watchTowr Labs is a security research team publishing detailed technical write-ups of vulnerabilities in enterprise software like Fortinet, Ivanti, and cPanel.
HN links it for vulnerability breakdowns and proofs of concept. One commenter finds its older posts funnier and less LLM-sounding than a recent one.
This is like seeing a food poisoning outbreak at a fast food restaurant and concluding that it must be CIA/FSB/Mossad bogeymen trying a bioweapon. These breaches are things like not validating authentication tokens (at all, not just correctly) and that would be a big drop in professionalism from what we’ve seen from nation-state level attacks:
https://labs.watchtowr.com/get-fortirekt-i-am-the-super_admin-now-fortios-authentication-bypass-cve-2024-55591/
The original article, with the PoC, was both funnier and didn't feel like it was written by an LLM (though the sign-off almost seem to be parodying some chatgpt-ism):
https://labs.watchtowr.com/more-evidence-that-words-dont-mean-what-we-thought-they-meant-ivanti-sentry-pre-auth-os-command-injection-cve-2026-10520/
Original article: https://labs.watchtowr.com/8-million-requests-later-we-made-the-solarwinds-supply-chain-attack-look-amateur/
I suppose the lesson is to not publicize your bucket names, if possible? Or if not, leave them present but empty in AWS and don't actually delete the buckets?
Related: Someone Knows Bash Far Too Well, And We Love It (Ivanti EPMM Pre-Auth RCEs CVE-2026-1281 & CVE-2026-1340) https://labs.watchtowr.com/someone-knows-bash-far-too-well-and-we-love-it-ivanti-epmm-pre-auth-rces-cve-2026-1281-cve-2026-1340/
It seems you forgot to note this comment is a quote from [1].
1. https://labs.watchtowr.com/someone-knows-bash-far-too-well-and-we-love-it-ivanti-epmm-pre-auth-rces-cve-2026-1281-cve-2026-1340/
The details of the "hole" are a bit horrifying (but, sadly, unsurprising): https://labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474/