@Behi_Sec

Bug Hunter & Tool Builder.

 /dev/null
github.com/BehiSecc
Joined July 2025
  • Tweets1.4K
  • Following68
  • Followers6.8K
66Media
Behi retweeted
s1r1us
@S1r1u5_19h
php2shell is one of the most impactful bugs in recent times, yet threat actors aren’t mass exploiting it the bug is so complex that even porting the exploit between targets takes serious skill, human or ai so i benchmarked how well open and frontier models can do it. 🧵
35
50
12
506
40,028
Anyone else find themselves chasing shiny objects more often because of AI? Every time I reflect on my day, I realize how much time I’ve spent on things that weren’t really necessary or a priority.
1
1
21
1,031
Replying to @TheHackersNews
@TheHackersNews
31
339
59
4,962
252,919
Nice watch. youtu.be/1Fql8oQ1Zbs

Frans Rosen on the AI Age of Bug Bounty (Ep. 195)

Episode 195: In this episode of Critical Thinking - Bug Bounty Podc...

youtube.com
6
691
XSS
11
900
We’re seriously underestimating DeepSeek V4.1 Flash’s capabilities in cybersecurity. Give this model the right instructions and direction, and it’ll uncover vulnerabilities you’d never expect it to find in a million years.
35
34
742
30,521
I’m so tired of GPT-6.1 Sol overengineering everything 😭😭 Just fix the goddamn issue.
1
10
1,122
Behi retweeted
Simon
@soecklyOct 12
I got $90,000 for a RCE in Google. simonkoeck.com/writeups/goog…

How I Found a $90,000 Remote Code Execution Vulnerability in Google | Simon Koeck

A Flask cookie on developers.google.com was signed with a secret it carried inside itself. Pulling that secret out turned a forged session into code execution across Google's developer sites.

simonkoeck.com
56
305
15
2,462
186,392
I really like what OpenAI and @thsottiaux are doing. The amount of effort they’re putting into making their models and products better is insane. There will always be issues, but what matters is that they genuinely care about the user experience.
5
791
Our research team discovered two vulnerabilities in Discourse: a pre-authentication cache poisoning to sitewide XSS (CVE-2026-55674), and an arbitrary file read (RCE) chaining a JPEG race condition with ImageMagick and Ghostscript (CVE-2026-55420). You can read more here:
https://www.slcyber.io/research/a-jpeg-a-race-and-a-ghost-breaking-discourses-image-pipeline

ALT https://www.slcyber.io/research/a-jpeg-a-race-and-a-ghost-breaking-discourses-image-pipeline

4
61
3
242
22,958
Nothing is more satisfying than building a hackbot that matches your own bug-hunting skills.
1
2
50
2,503
What are you talking about? I’m already verified for the Cyber program.
5
25
4,726
How to 10x the efficiency of DeepSeek V4.1 Flash for bug hunting: Set up an advisor agent that continuously reviews its work, catches weak reasoning, and directs what it should investigate next.
8
15
1
268
14,687
Does anyone know of a *.google[.]com domain that resolves to a local/internal IP, such as 127.0.0.1?
4
67
15,493
This is so funny 😂 Claudia should have used Claude instead of Gemini.
Google Gemini
@GeminiAppSep 24
Look what Claudia can do.

603
It worked! Just keep trying, it didn't even ask for ID verification this time.
vinaykumar🍁
@Xplo8ESep 30
1. Install 'IDmelon Authenticator' from playstore 2. Signup and create key 3. Use it to register with chatgpt cyber 4. Profit $$
6
3
143
25,747
Z AI team must be so happy now 😄 anthropic.com/research/glm-5…

GLM-5.3 and the spread of advanced cyber capabilities

GLM-5.3 can autonomously build end-to-end cyber exploits, but unlike other frontier models, it was released without meaningful safeguards to limit misuse.

anthropic.com
9
983
Powered by Astra and without drawing down on any of your usage 🤯
Tibo
@thsottiauxSep 29
Announcing dots. Dots work 24/7 for you, learn from your feedback, have their own computer, browser and can be connected to over 4k apps in our ecosystem. They’re powered by Astra our best model yet. Included in your Pro plan, without drawing down on any of your usage. You can even call a dot while it’s working. We’re getting you started with your primary dot today and soon you’ll be able to create entire teams of them.
2
902
Has anyone managed to reverify the OpenAI Cyber program? It keeps rejecting my ID verification.
8
33
4,615
Good read: blog.sentry.security/beyond-…

Beyond Prompt Injection: Hacking Apple's Private Cloud Compute

Drinor was awarded $150,000 for CVE-2026-20685 targeting Apple's Private Cloud Compute, the inference backbone of Apple Intelligence capabilities. This work is my contribution to Sentry's AI Security...

blog.sentry.security
23
1
101
6,581
Load more