Finding a $90,000 Remote Code Execution Vulnerability in Google

What happened

A Flask cookie on developers.google.com was signed with a secret it was also carrying inside itself. Pulling that secret out turned a forged session into code execution across seven Google domains.

Summary assembled by rule from the sources below

Timeline

1. 07:28
   First appeared on Hacker NewsHHacker News
2. 14:40
   Discussion started on LobstersLLobsters

Sources