Can XSS read HttpOnly cookies? No.
But it can still exploit your authenticated session without stealing the cookie.
Here's how 👇
@hackersbrain.bsky.social
@hackersbrain.bsky.socialCan XSS read HttpOnly cookies? No.
But it can still exploit your authenticated session without stealing the cookie.
Here's how 👇
@hackersbrain.bsky.socialCan XSS steal cookies?
JavaScript can read cookies using `document.cookie`. But does that mean an XSS payload can steal them?
And if it does, what can an attacker actually do with a stolen session cookie?
Let's explore how it works.
@securityonline.bsky.socialAn active WordPress XSS campaign exploits Ninja Forms flaw CVE-2026-94504 and CVE-2026-93836 to plant hidden admin accounts. Patch now.
#WordPress #NinjaForms #WooCommerce #CVE202694504 #CVE202693836 #XSS #ExploitedInTheWild #Malware
@thedailytechfeed.comWordPress 7.1.3 fixes critical XSS, SQLi & data-exposure flaws—update now. #WordPress #Security #XSS #SQLInjection #DataDisclosure #UpdateNow https://thedailytechfeed.com/wordpress-7-1-3-fixes-multiple-critical-vulnerabilities/
@thedailytechfeed.comMassive Veeam patch fixes RCE, XSS & file-read holes—update to build 12.3.2.4934 now. #Cybersecurity #Veeam #RCE #XSS #PatchNow #DataProtection https://thedailytechfeed.com/critical-veeam-rce-xss-flaws-discovered-patch-immediately/
@securityonline.bsky.socialThe WordPress 7.1.3 security update is a WordPress security release that fixes stored XSS, SQL injection and more. Update your site now.
#WordPress #WordPress713 #XSS #SQLInjection #WebSecurity #CMS #PatchNow #Vulnerability
@thedailytechfeed.comPageBreak AI found 500+ real XSS holes in Google products—cache poisoning, exploit chains, and far fewer false positives. #AI #WebSecurity #XSS #Google #Cybersecurity #ExploitChains https://thedailytechfeed.com/googles-ai-pagebreak-finds-500-xss-flaws-builds-exploit-chains/
@simsus.social.tchncs.de.ap.brid.gyGroupware #Zimbra: Update schließt zahlreiche Sicherheitslücken | Security https://www.heise.de/news/Groupware-Zimbra-Update-schliesst-zahlreiche-Sicherheitsluecken-11468996.html #Patchday #XSS #CrossSiteScripting
@donwebmedia.bsky.socialCVE-2026-93875: XSS almacenado en JetAppointment WordPress
Descubrí todo sobre CVE-2026-93875 WordPress: qué riesgos implica, cómo afecta tu sitio y qué medidas tomar. Entrá y enterate antes de que sea tarde.
#cve202693875 #wordpress #jetappointment #xss #wordfence
@anwangxia.bsky.social肃杀的国际环境下，2026年仍然活跃的全球5大暗网论坛
#暗网论坛 #Altenen #DarkForums #Dread #Exploit.in #XSS.is
www.anwangxia.com/5111.html
@kristijankop.bsky.socialCan a single email silently install malware on your computer? #email #xss #howitworks #techexplained
@hendryadrian.bsky.socialMicrosoft will add stronger Content Security Policy protections for Entra ID sign-ins in mid-October 2026, blocking unauthorized scripts and reducing XSS risk during browser-based authentication. #EntraID #Microsoft #XSS
@potato.software[New Post] 📌MS Entra ID Introduce CSP Protections to Block Unauthorized external Script Injection and Help Prevent XSS Attacks -
www.anoopcnair.com/entra-id-csp...
#MSEntra #MicrosoftEntraID #EntraID #CSP #XSS #PotatoSecurity #HTMDCommunity
@htmdc.bsky.social[New Post] 📌MS Entra ID Introduce CSP Protections to Block Unauthorized external Script Injection and Help Prevent XSS Attacks -
www.anoopcnair.com/entra-id-csp...
#MSEntra #MicrosoftEntraID #EntraID #CSP #XSS #CyberSecurity #HTMDCommunity
@securityonline.bsky.socialA JupyterLab Desktop vulnerability, CVE-2026-102530 (CVSS 9.4), turns a malicious server URL into remote code execution. Update to 4.6.2-1 now.
#JupyterLab #JupyterLabDesktop #CVE2026102530 #XSS #RCE #Electron #DataScience #PatchNow
@simsus.social.tchncs.de.ap.brid.gySicherheitslücken: #GitLab-Server sind für Schadcode-Attacken anfällig | Security https://www.heise.de/news/Sicherheitsluecken-GitLab-Server-mit-Schadcode-attackierbar-11465889.html #Patchday #XSS #CrossSiteScripting #RegularExpressions #CICD #git :git:
@hackersbrain.bsky.socialAn XSS payload gets access to sensitive data.
But how does that data actually reach the attacker?
We break down the full exfiltration flow — JavaScript, HTTP requests, attacker-controlled server — with code, diagrams, and an interactive lab.
@securityonline.bsky.socialA critical Rancher XSS vulnerability tracked as CVE-2026-88804 exposes admin sessions. Update your clusters immediately to prevent system compromise.
#Rancher #Kubernetes #CVE202688804 #XSS #Cybersecurity #Infosec
@securestep9.bsky.social#WordPress “Comment2Shell” turns anonymous stored #XSS vulnerability into server code execution when an admin views the comment.
It abuses the admin session to upload a malicious plugin. Patch now!
👇
@hugovalters.bsky.socialGL.iNet Slate 7 Pro Review: Wi-Fi 7 Travel Router That Fixed My Homelab Bottleneck youtu.be/syFWgIPLxf8 @GLiNetWiFi #Linux #infosec #XSS #valtersit #OpenWrt #SysAdmin #cybersecurity #cybersecurityawareness #cybersecuritynews #cybersecuritytips #python #kali #ubuntu #debian #docker #networking #IoT