- MonkeHacks
- Posts
- MonkeHacks #85
MonkeHacks #85
Omarchy, Kinesis, Sabbatical
MonkeHacks #85
Late issue this week - apologies. My cats got neutered and are currently wearing cones and looking very stupid. As such, I can’t make it to the UK H1 Ambassador Meetup in London this week.
It’s been another really busy week, with pentest work and moving more things, the cats settling in, and setting up my new hacking gear. My mom is also visiting this week from Cork, so that’s been quite nice.
Next month I’m going to take a big sabbatical to focus on admin work and resting before 2026. I’ll still post my newsletter with resources.

The two stinkers with their cones of shame.
Weekly Ideas / Notes
My good friend Vitor built Bug Bounty Daily - a writeup aggregation site. He’s just launched a digest newsletter here. Honestly, it makes my resource aggregation a lot easier. Go and subscribe to it if you haven’t already.
In line with the rest of my office upgrades, I’ve bought a Kinesis Advantage360 keyboard. Why? Well, I realised while I was buying all of this stuff that my ergonomics and posture absolutely suck. I may not feel the pain now but it was clear to me that I would be in for a bad time if I kept this up. Working from a laptop in small bursts is convenient but long-term, it’s a recipe for disaster. The new keyboard is a split keyboard, which makes typing SO much slower while I adjust to the difference but will hopefully pay off in the long run. Even typing up this newsletter is taking forever, so I expect it to take a few weeks before I get anywhere close to my old typing speeds again. I’m back to about 40wpm when I could reach 140wpm before.
I got my mini-PC - I have a Beelink SER8 with 64GB RAM, 2TB storage and a Ryzen 7. I installed Omarchy on it, which is really smooth to work with and honestly? I’m not turning back from Linux now. It’s just much, much faster to use Linux’s window management systems over MacOS. It’s not even close. I opted for 2TB because Caido projects tend to use up a lot of storage (storage is cheap, so this isn’t a problem). So far, I’ve installed Caido and set up a shortcut to open it. I also have a shortcut to open Gemini and Notion, as well as HackerOne and Bugcrowd. It’s pretty sick. Between the keyboard and maining Linux now, if I stick with these habits, the gains are going to be massive in terms of workflow friction reduction.
Joseph, a.k.a rez0, posed the interesting question of whether or not prompt injection itself is a vulnerability. I think it usually isn’t, but it can be in certain situations (such as log poisoning).
I’ll be speaking next week at the Irish Government’s cybersecurity conference. More on that next week. The days after that, I’m going to Manchester with my best friend to watch Manchester United vs West Ham in Old Trafford. As a Man Utd fan, I’m really looking forward to it.
Reading List
Currently:
Fiction:
Solenoid by Mircea Cărtărescu (130/600 pages)
Guards! Guards! by Terry Pratchett
Non-Fiction:
A Random Walk Down Wall Street by Burton Malkiel (150/300 pages)
How The World Made The West by Josephine Crawley Quinn (265/400 pages)
Founders At Work by Jessica Livingston (190/472 pages)
Next on the list:
Fiction: Mort by Terry Pratchett
Non-Fiction: Day Zero to Zero Day by Eugene Lim (SpaceRaccoon)
Resources
We’ve been spoiled for good content this week!
Reflection on Ryan Barnett: Ryan is a well-known figure in the bug bounty community, particularly because he works for Akamai and regularly engages with the researcher community to improve security globally. This brief article is about how he got into the field.
Abusing the NinjaShell API for Code Execution in Google Web Designer: Sudi, building on the research of my friend Balint, found an RCE in Google Web Designer.
Who Needs a Blind XSS? Server-Side CSV Injection Across Support Pipelines: This is a very clever new technique abusing the fact that spreadsheets can do operations like importHTML or importXML to leak data. I won’t spoil it - you can read it at the link there - but it’s very innovative.
Exploiting A Pre-Auth RCE in W3 Total Cache For WordPress (CVE-2025-9501): Brief article from MrTuxRacer on a pre-auth RCE POC he made from a CVE reported by wcraft.
Unlocking Reflected XSS in the Astro framework: Technical writeup from - you guessed it - zhero, back with another bug in a Javascript framework.
Breaking Oracle’s Identity Manager: Pre-Auth RCE (CVE-2025-61757): SLCyber, formerly Assetnote, with another highly technical blog post. You’ve got to appreciate the technical depth of these articles. It’s truly an invaluable resource for studying code review in older technologies.
How I Found the Worst ASP.NET Vulnerability — A $10K Bug (CVE-2025-55315): Request smuggling in Kestrel - pretty serious!