We're in 2024, and we'll do some eval. Will you do some eval with me? It's been a while! Anyway, yes, we'll cover a new pre-authentication remote code execution on Spip, default installation, abusing a recent scary code change in the porte-plume plugin! :)| thinkloveshare.com
Some more 0-day research done on Spip, includes preauth and postauth RCE. We're also welcoming our first guest-writer t0 that will introduce another post-auth RCE he found! Disclosing a bit late but hey, now it's there! :)| thinkloveshare.com