
Security Researcher @rapid7 😈 Hacking Content @ https://xitter.cf/t.co/U7jVhNr9sC 💜
Not Here
Joined May 2016
- Tweets8.3K
- Following241
- Followers9.1K
- Likes89.8K
CryptoCat retweeted
The @UnpromptedAU videos came out recently. Check out my ramble about AI assisted exploit development unprompted.au/videos/ai-assi…
CryptoCat retweeted

LiveOverflow 🔴 hextree.io@LiveOverflowOct 22
🇩🇪
GermanyConnected via Germany App StoreAccount-level information, not a live location or per-post device.
Made a quick video (aka 5h of work), about my experience racing to find php2shell.
youtube.com/watch?v=7CiZmq2l…
CryptoCat retweeted

Anthropic@AnthropicAIOct 23
🇺🇸
United StatesConnected via WebAccount-level information, not a live location or per-post device.
In August, @AISecurityInst reported an incident where Claude Mythos 5 took unauthorized actions on the internet during AISI’s testing of its cyber capabilities.
We've now produced a further analysis of this incident, to better understand the model's alignment properties.
anthropic.com/research/align…
CryptoCat retweeted
Episode 17 of Hacktics & Telemetry is live: Zimbra Zero-Days, AI Torture, and Catching Malmons (ft. @LambdaMamba)! Get it here: youtube.com/watch?v=iWpykLFI…
CryptoCat retweeted
How @joaxcar must feel after discovering a CVSS 10.0 bug in Gitlab but it's overshadowed because PHP decides to drop a 14 yo RCE
CryptoCat retweeted
To teach a lesson,
After Wiz rushed to buy php2shell domain and use its marketing machine to steal the spotlight, I spotted "phpbleed" in a recent Calif tweet and bought phpbleed.com before wiz could pull the same stunt again.
A big budget can buy a domain. It shouldn't buy someone else's research credit.
If you have contacts at CISA or in the press, do the right thing: make sure the researchers who actually did the work get the recognition they deserve.
Hack the planet. Credit the researchers.
CryptoCat retweeted
Let’s set the record straight: @lcfr_hax was the first to discover php2shell and develop a working exploit. See his August 5 tweet: xitter.cf/lcfr_hax/status/208503…
His work convinced the PHP Foundation to invest in fixing this entire bug class. He then worked around the clock to review, test, and retest the patches.
CryptoCat retweeted
Three new @metasploit exploit modules in the queue for several of the recent Cisco Secure Email Gateway vulns. Last weeks file write in AMP (CVE-2026-76519, on KEV), and two separate SQLi's (CVE-2026-76461, on KEV, and CVE-2026-76443) from last month: github.com/rapid7/metasploit…
CryptoCat retweeted
The details of the long awaited KVM Escape are published. PwnEscape leads to VM escapes across multiple hypervisors due to a super cool Linux networking bug.
CVE-2026-99999 is a 9.3 CVSS critical rated KVM escape ⛓️
pwn.ai/blog/pwnescape
CryptoCat retweeted
New research from our team: we chained an unauthenticated bulk import, an XXE buried in a nested dependency and leaked IMS credentials into full pre-auth RCE on Adobe Experience Manager Cloud.
We also cover how AI models helped (and didn't) during the audit.
slcyber.io/research/more-cri…
CryptoCat retweeted
OpenAI Newsroom@OpenAINewsroomOct 13🇺🇸
United StatesConnected via WebAccount-level information, not a live location or per-post device.
We discovered a sophisticated recording device that was hidden inside one of our offices. We used our models to understand the device and where it had come from, identifying that a specific employee had planted it a few days earlier. We referred the matter to the FBI, and we’re grateful to the agents and prosecutors who moved quickly to make an arrest. The FBI’s investigation is ongoing and we will continue to support their work.
At this time, we have no indications of this individual inappropriately accessing or exfiltrating model weights, source code, or customer data. The employee was terminated.
We take protecting our technology, data, and people seriously, and as a matter of national importance. Our security program is designed to protect against a wide range of threat actors, from insider risks to cybercriminals to nation states, and this case is an example of how AI can help address these sophisticated security threats.
CryptoCat retweeted
We had an amazing time at #Pwn2Own Ireland 2026 - our 40th Pwn2Own ever! We awarded $1,262,000 for almost 100 0-days. Catch all the highlights at youtu.be/qDTSScQ67Mg?is=CdmJ…
CryptoCat retweeted
I'm happy that my first article as part of the @SLCyberSec research team is finally out! 😁
It covers an interesting ImageMagick race condition that I found back in June, which, combined with a polyglot payload, allowed me to achieve file read/RCE on Discourse. This should resonate with those who've seen the recent @HacktronAI research.
I hope you'll enjoy it! 👇































