The Stack
The Stack — October 13, 2026
9:46
Daily IT Briefing — October 13, 2026
Security
Google paid $90K for an unauthenticated RCE in its developer documentation platform. A researcher reports a chain of failures on developers.google.com that turned a session cookie into code execution.
The cookie: The `/oauth2authorize` endpoint set a Flask session cookie holding a pickled `OAuth2WebServerFlow` object. That object carried the OAuth…