@_CryptoCat

Security Researcher @rapid7 😈 Hacking Content @ https://xitter.cf/t.co/U7jVhNr9sC 💜

 Not Here
cryptocat.me
Joined May 2016
  • Tweets8.3K
  • Following241
  • Followers9.1K
1.1KMedia
Want to become an ethical hacker? 🥷 Here's a list of my favourite [mostly practical] resources 📚 They are all free (or have a free option) and there's more high quality material here than anybody realistically has the time to complete ⏳
Ethical hacking resources

ALT Ethical hacking resources

28
329
5
1,254
132,563
The @UnpromptedAU videos came out recently. Check out my ramble about AI assisted exploit development unprompted.au/videos/ai-assi…

AI-Assisted Exploit Development: An XNU Case Study · Dion Blazakis | [un]prompted.au 2026

A first-hand account of working with AI agents to turn two macOS vulnerabilities into controlled kernel read/write and root, and a look at where the models helped, where they did not, and what that…

unprompted.au
51
4
178
22,376
The licence-dismissal endpoint in Craft CMS signs whatever you send it. That signed blob is accepted as a redirect, which Craft renders as Twig with no sandbox 😏 cryptocat.me/blog/research/a…

Craft CMS Authenticated RCE via Signed-Cookie Redirect Confusion | CVE-2026-92592 | CryptoCat's Blog

How a low-privilege Craft CMS account signs a Twig payload through the license-shun cookie endpoint and replays it as a redirect param that Craft renders as unsandboxed Twig, reaching system().

cryptocat.me
3
1
2
473
The same renderer is reachable with no account at all 👀 When the DB goes down Craft decides it isn't installed and reopens the anonymous installer, which hands back CRAFT_SECURITY_KEY so you can sign your own redirect 🔑 cryptocat.me/blog/research/a…

Craft CMS Environment Disclosure to Unauthenticated RCE via Database Fail-Open | CVE-2026-92591 |...

How a database outage makes Craft CMS treat itself as uninstalled, and how the anonymous installer's site-name validation both discloses CRAFT_SECURITY_KEY and renders a redirect signed with it as...

cryptocat.me
1
134
Made a quick video (aka 5h of work), about my experience racing to find php2shell. youtube.com/watch?v=7CiZmq2l…

The race to the first exploit // php2shell

I used Codex and the hints from Calif's public demo to try to redis...

youtube.com
6
45
4
332
20,005
CryptoCat retweeted
Anthropic
@AnthropicAIOct 23
In August, @AISecurityInst reported an incident where Claude Mythos 5 took unauthorized actions on the internet during AISI’s testing of its cyber capabilities. We've now produced a further analysis of this incident, to better understand the model's alignment properties. anthropic.com/research/align…

An alignment assessment of the UK AISI cybertesting incident

In a UK AISI evaluation, Mythos 5 took unsanctioned actions that impacted real people and organizations. In this post, we investigate these behaviors from Claude Mythos 5 further, to understand what...

anthropic.com
566
463
420
4,365
2,056,204
She's a 4, but she's a private key for a intermediary CA.
23
330
16
4,307
51,501
In the middle of working on some @metasploit modules and @github banned my work account 🫠
2
358
Daybreak Blue just stopped working at the same time as all the other models stopped answering *anything* hacking related. When I go to @OpenAI cyber page it says my account is not eligible for individual access and to contact my org (old uni). Support are refusing any refund 💀
2
1
12
1,427
I'm seeing some other people post about Daybreak issues (maybe due to PHP RCE) so hoping my account error is just coincidence! 🤞
1
1
447
No refunds though, apparently 🤷‍♂️
ScamGPT

ALT ScamGPT

2
181
CryptoCat retweeted
Jorian
@J0R1ANOct 22
Everybody talking about php2shell, but wait 'till you hear about shell2php:
8
46
3
1,022
12,120
Episode 17 of Hacktics & Telemetry is live: Zimbra Zero-Days, AI Torture, and Catching Malmons (ft. @LambdaMamba)! Get it here: youtube.com/watch?v=iWpykLFI…

Hacktics & Telemetry, E17: Zimbra Zero-Days, AI Torture, and Catching Malmons (ft. Lena Yu)

Episode 17 of Hacktics and Telemetry explores the evolving intersec...

youtube.com
5
11
4,247
Found a CSRF in User Registration & Membership that lets an attacker approve or deny users through a logged-in admin. $17 🤑 cryptocat.me/blog/research/a…

User Registration & Membership Cross-Site Request Forgery to User Approval and Denial | CVE-2026-...

Root cause analysis of CVE-2026-92978 in User Registration & Membership, where the bulk Approve and Deny actions on the WordPress Users screen never checked a nonce, so any page a logged-in adminis...

cryptocat.me
13
715
How @joaxcar must feel after discovering a CVSS 10.0 bug in Gitlab but it's overshadowed because PHP decides to drop a 14 yo RCE
3
5
157
4,528
CryptoCat retweeted
Traceix
@usetraceixOct 21
We’re shutting down too. We don’t use php I just don’t wanna work tomorrow.
MalShare@mal_shareOct 20
We are aware of the PHP vulnerability and are shutting down for the weekend.
79
2,259
94
35,063
515,294
CryptoCat retweeted
SinSinology
@SinSinologyOct 21
To teach a lesson, After Wiz rushed to buy php2shell domain and use its marketing machine to steal the spotlight, I spotted "phpbleed" in a recent Calif tweet and bought phpbleed.com before wiz could pull the same stunt again. A big budget can buy a domain. It shouldn't buy someone else's research credit. If you have contacts at CISA or in the press, do the right thing: make sure the researchers who actually did the work get the recognition they deserve. Hack the planet. Credit the researchers.

phpbleed

Welcome, Wiz. Beat you to the checkout.

phpbleed.com
51
265
29
1,926
172,062
CryptoCat retweeted
Calif
@calif_ioOct 21
Let’s set the record straight: @lcfr_hax was the first to discover php2shell and develop a working exploit. See his August 5 tweet: xitter.cf/lcfr_hax/status/208503… His work convinced the PHP Foundation to invest in fixing this entire bug class. He then worked around the clock to review, test, and retest the patches.
LCFR
@lcfr_haxAug 5
d935be023a55b04681eccd1d2b8385b4b295e141a5df108e5e979d8d5d7124ac
54
407
93
3,079
390,574
CryptoCat retweeted
Calif
@calif_ioOct 21
php2shell - A tale of two PHP remote vulnerabilities: calif.io/php2shell
19
248
29
772
174,085
CryptoCat retweeted
Kirill Firsov
@k_firsovOct 20
php2shell Tomorrow is a helluva day.
274
1,826
686
16,171
3,683,398
Last Frappe post: GET CSRF in the bulk update endpoint, chained to RCE against a Website Manager. cryptocat.me/blog/research/a…

Frappe Bulk Update GET CSRF and a Browser-to-RCE Chain | CryptoCat's Blog

A GET CSRF in Frappe's bulk update endpoint lets one cross-site link change documents as a logged-in user, and against a Website Manager it chains into remote code execution.

cryptocat.me
10
601
Load more