I hack things and ride motorcycles. 🇧🇷🇺🇲🇯🇵🇪🇸 Jesus is Lord.
Internet
Joined September 2011
- Tweets3.9K
- Following641
- Followers11.6K
- Likes10.3K
Sol 5.6 still unmatched. It’s actually unbelievable how much insane findings it comes up with by itself. I’m in disbelief every time…
HackerOnTwoWheels retweeted
New on our Frontier Red Team blog: using Claude to formally verify software at large scale.
Formal verification can prove that code is free of certain bugs, but historically it has only been feasible for small codebases (or required a lot of expert time).
With AI models, however, this is beginning to change. In collaboration with @theoremlabs, we used Claude to prove security properties in over one hundred real-world open-source libraries over the span of a few weeks.
Read our research in full here: anthropic.com/research/forma…
Based
皆様に、今夜に対応して頂きたい大至急のお願いです。
多くのウェブサイトで使用されているPHPに関し、PHPのセキュリティチームが、重大な２件の脆弱性に関する注意喚起を行っています。
公開しているウェブサイトでPHPを使用しているか確認し、今夜、10月21日午後11時（日本時間）に公開される修正パッチについて、可及的速やかに適用できるよう準備をお願いします。
修正パッチを速やかに適用することが困難な場合は、例えばウェブサイト等を一時的に停止させることも、リスクを低減させるための有効策の一つと考えられます。
国家サイバー統括室のXアカウントでも関係する情報を発信していますので、そちらも参考にして下さい。
国家サイバー統括室(注意・警戒情報)（@cyber_forecast） / X
HackerOnTwoWheels retweeted
We released a blog post @depi_ about Mean Time To Detect vs Meant Time To React, especially applied to Software Supply Chain
Beautifully written by @vm00z 🔥
depi.security/blog/20261002-…
HackerOnTwoWheels retweeted
now that the KVM escape details are out (pwn.ai/blog/pwnescape)… if you’re wondering how i managed to rediscover it in under 2 hours after seeing the vercel bounty screenshot:
i gave openai’s gpt-5.6-cyber (daybreak red) access to a devbox to experiment and explore different directions for 1.5 hours.
then i spotted that the word after “guest-controlled” in the screenshot wasn’t properly redacted. those 3 dots gave away “virtio”. might seem like a small hint, but i passed it to my agent, and it got excited and found the vulnerability in 30 minutes. :))
opsec lesson right there.
next-level detection & response 😅
> half-jokingly suggested trying to rediscover the bug
> set up the environment, started an agent with a cyber model, gave it one clue partway through (not saying what it was until the patch is out :)))
> ~2 hours later: found the bug and validated an end-to-end exploit*
> …**
hats off to @PaulosYibelo for the original discovery… incredible work! definitely not an easy bug to find, especially without “cheating” :D
* xitter.cf/0x4d31/status/21064917…
** xitter.cf/zbraniecki/status/2106…
Very true. It scales your edge.
But you still need to have YOUR own edge to scale.
People saying ai replaces and automates…
It literally doesn’t, it scales.
1% of people are completely automating or replacing .
People just have this weird fucking selective memory about how things happen because they love the feeling of the scale.
Brothers and sisters you literally re prompted those systems or had to re-architect them to change course several times. You had to review for hallucination. There was 100 small things you did to create that AI output at its final stage.
RT @ITSecurityguard: New research from our team at @SLCyberSec :
Pre-Auth Remote Code Execution in Adobe AEM!
👇🏻
…
We are holding off disclosure of this as we found another vulnerable target. We did get agreement already to full disclose both issues together once it’s fixed. Soon!🫡
HackerOnTwoWheels retweeted
Ask @moyix anything about our Chrome full-chain exploit. 👀
He published the technical breakdown of how he did it (xbow.com/labs/research/zero-…)...but if you have questions or want to go deeper, drop your questions in this thread!
He’ll be answering them LIVE on Wednesday, 10/14, from 12–1 PM ET. 💚
HackerOnTwoWheels retweeted
CVE-2026-87902: WordPress Core unauthenticated path traversal in get page template page-template resolution leading to conditional RCE
pruva.dev/reproductions/REPR…
HackerOnTwoWheels retweeted
Cheaply paying the whitehat $250K for a critical infinite XRP supply bug when your treasury has billions?
Thanks for helping ensure the next time an attacker exploits it for 9 figures instead of reporting it in good faith.
This is why people do not take XRPL or Ripple seriously as an org….
HackerOnTwoWheels retweeted
I got $90,000 for a RCE in Google.
simonkoeck.com/writeups/goog…
HackerOnTwoWheels retweeted
Our AI found a bug that let anyone mint infinite XRP, with $94B at risk. It had been hiding in one of the most audited codebases in crypto for nearly a decade, and earned us the maximum $250K bounty.
Here's how it went unnoticed, and how we found it.
HackerOnTwoWheels retweeted
one of the annoying parts of building an ai based vulnerability scanner is that there is no free lunch. you get completely different results depending on how you approach the problem.
1. you can throw an absurd number of tokens at gpt sol, and it will still miss a bug that opus finds, same applies other way around
2. different prompts and initial conditions send agents down completely different paths, exploring different ideas and finding different bugs.
3. some vulnerabilities only come up when you build task specific environments and feedback loops that let agents explore and hill climb. no amount of generic prompting would uncover them, these are the vulnerabilities where human operator matters a lot
the list goes on and you will find some weird edge case that leads to vulnerability every time you approach in different way.