INSIDE POSTHOG: HOW SSRF, A CLICKHOUSE SQL ESCAPING 0DAY, AND DEFAULT POSTGRESQL CREDENTIALS FORMED AN RCE CHAIN (ZDI-25-099, ZDI-25-097, ZDI-25-096)

Summary from the TLDR Dev newsletter

A security researcher uncovered a critical Remote Code Execution (RCE) chain in PostHog by chaining several vulnerabilities. The initial vector was a Server-Side Request Forgery (SSRF) vulnerability that bypassed webhook URL validation, allowing an attacker to save and trigger requests to internal URLs via a Rust worker.