Q5Ca (@_q5ca) header
Q5Ca (@_q5ca) profile picture

Q5Ca

@_q5ca

Đoàn Phan Tùng Dương @ https://teapawt.net/t.co/DxGrO0nE57

 Vietnam
duongq5ca.substack.com/
Joined November 2017
  • Tweets255
  • Following426
  • Followers969
18Media
Photo by Q5Ca (@_q5ca)Photo by Q5Ca (@_q5ca)Photo by Q5Ca (@_q5ca)Photo by Q5Ca (@_q5ca)Photo by Q5Ca (@_q5ca)Photo by Q5Ca (@_q5ca)Photo by Q5Ca (@_q5ca)Photo by Q5Ca (@_q5ca)Photo by Q5Ca (@_q5ca)
Happy to share that my colleague @vudq16 and I will be speaking at PHDays in Moscow 🇷🇺 next week, May 24th. I’ll share a story from one of our red team projects, with techniques to maximize stealth during the operation. Hope to make new connections there:D phdays.com/en/forum/program/…
Program PHDays Fest

Program PHDays Fest

Talks and discussions. Cybersecurity and IT expertise from around the world

phdays.com
5
4
49
3,812
Q5Ca retweeted
Khoa Dinh (@_l0gg) profile picture
Khoa Dinh@_l0ggAug 17
@msftsecresponse please check this case, this is not Spoofing!!!
1
6
679
guys you do know you can just disable thinking, and instead give it a "deep_think" tool, and it will call it with internal CoT reasoning format right? gl fixing that
Image from Can Bölük (@can1357)
Alexander Panfilov (@kotekjedi_ml) profile pictureAlexander Panfilov
@kotekjedi_mlAug 11
We can finally talk about it: We found a way to extract hidden reasoning of frontier models using a vulnerability in the APIs of every frontier AI company. We verified that our reasoning token count matches billed API thinking tokens 1:1 for most of the prompts we queried.
Image from Alexander Panfilov (@kotekjedi_ml)
154
449
139
6,382
957,458
We can finally talk about it: We found a way to extract hidden reasoning of frontier models using a vulnerability in the APIs of every frontier AI company. We verified that our reasoning token count matches billed API thinking tokens 1:1 for most of the prompts we queried.
Image from Alexander Panfilov (@kotekjedi_ml)
380
1,960
620
13,517
3,543,495
Q5Ca retweeted
Khoa Dinh (@_l0gg) profile picture
Khoa Dinh@_l0ggAug 12
Blog for CVE-2026-55040, SharePoint Server Subscription Edition improper JWT validation lead to Arbitrary Account Login: blog.viettelcybersecurity.co… !POC is in blog! no need to find SID
Image from Khoa Dinh (@_l0gg)
1
33
1
159
12,600
Seems that wp2shell PoCs are now floating around the internet, so we've published our blog post including our research methodology for finding the bug as well as a deep dive into the chain itself - slcyber.io/research-center/e…

Exploit brokers pay $500,000 for a WordPress RCE. I found one with GPT5.6 Sol Ultra and $25

Adam Kues used a $200 GPT5.6 Sol Ultra subscription to discover a pre-authentication SQL injection and full RCE exploit chain in WordPress Core – a chain that chains a batch API desync, cache...

slcyber.io
16
201
24
716
80,234
Image from splitline 👁️🐈‍⬛ (@_splitline_)
TrendAI Zero Day Initiative (@thezdi) profile pictureTrendAI Zero Day Initiative
@thezdiMay 16
Booyah it's been confirmed! 🎉 splitline (@_splitline_) of DEVCORE Research Team chained 2 bugs to exploit Microsoft SharePoint, earning $100,000 and 10 Master of Pwn points. Massive aura farming this year at #P2OBerlin. Full win! #Pwn2Own
Image from TrendAI Zero Day Initiative (@thezdi)
Image from TrendAI Zero Day Initiative (@thezdi)
Image from TrendAI Zero Day Initiative (@thezdi)
4
13
173
17,259
And this one is human insight w/ LLM-assisted research. Took about one week to finish everything. The AI really rescued me from a lot of tedious work — excluding the part where it changed the Domain Admin password, locked me out, and claimed it got RCE 🤦
TrendAI Zero Day Initiative (@thezdi) profile pictureTrendAI Zero Day Initiative
@thezdiMay 15
Aaaand it's official! Orange Tsai (@orange_8361) of DEVCORE Research Team chained 3 bugs to achieve Remote Code Execution as SYSTEM on Microsoft Exchange, earning a whooping $200,000 and 20 Master of Pwn points. Full win! #Pwn2Own #P2OBerlin
Image from TrendAI Zero Day Initiative (@thezdi)
46
152
22
1,675
132,206
Locked in! Le Duc Anh Vu (@vulda17) of Viettel Cyber Security (@vcslab) exploited Cursor, earning $30,000 and 3 Master of Pwn points. Full win! #Pwn2Own #P2OBerlin
Image from TrendAI Zero Day Initiative (@thezdi)
1
12
119
7,642
Aaaand it's official! Orange Tsai (@orange_8361) of DEVCORE Research Team chained 3 bugs to achieve Remote Code Execution as SYSTEM on Microsoft Exchange, earning a whooping $200,000 and 20 Master of Pwn points. Full win! #Pwn2Own #P2OBerlin
Image from TrendAI Zero Day Initiative (@thezdi)
25
174
60
1,536
286,525
There it is! Orange Tsai (@orange_8361) of DEVCORE Research Team was able to exploit Microsoft Exchange! If confirmed, they win a whooping $200,000 and 20 Master of Pwn points. Off to the disclosure room to explain how they did it and seal the deal. #Pwn2Own #P2OBerlin
15
63
18
520
68,825
Boom! @rewhiles of Viettel Cyber Security was able to exploit Anthropic Claude Code! If confirmed, they win $40,000 and 4 Master of Pwn points. They're off to the disclosure room to explain how they did it. #Pwn2Own #P2OBerlin
1
6
1
55
6,505
That's my chain — a full chain w/ logic bugs only! No memory corruption, no AI, and of course no collisions at all 😉
TrendAI Zero Day Initiative (@thezdi) profile pictureTrendAI Zero Day Initiative
@thezdiMay 14
Confirmed! Orange Tsai (@orange_8361) of DEVCORE Research Team (@d3vc0r3) chained 4 logic bugs to achieve a sandbox escape on Microsoft Edge, earning $175,000 and 17.5 Master of Pwn points. Full win! #Pwn2Own #P2OBerlin
Image from TrendAI Zero Day Initiative (@thezdi)
108
362
41
2,575
224,519
Ước 🥹
Khoa Dinh (@_l0gg) profile pictureKhoa Dinh@_l0gg24 Jul 2025
Blog for ToolShell Disclaimer: The content of this blog is provided for educational and informational purposes only. blog.viettelcybersecurity.co… #SharePoint #ToolShell
Image from Khoa Dinh (@_l0gg)
9
709
Replying to @_q5ca @vudq16
Slide: 1drv.ms/p/c/362121a38b7470ea… Recording: youtube.com/watch?v=xBnMrNCu…
1
12
1,047
Just a quick reminder: Copilot on microsoft365.com (m365.cloud.microsoft/chat) is not on scope for bounty 🥲 duongq5ca.substack.com/p/ano…
Image from Q5Ca (@_q5ca)
1
1
13
2,633
Congrats @_l0gg! You did the thing I thought was impossible. Hard work pays off 💪
TrendAI Zero Day Initiative (@thezdi) profile pictureTrendAI Zero Day Initiative
@thezdi16 May 2025
Confirmed!! Dinh Ho Anh Khoa (@_l0gg) of Viettel Cyber Security combined an auth bypass and an insecure deserialization bug to exploit #Microsoft SharePoint. He earns $100,000 and 10 Master of Pwn points. #Pwn2Own #P2OBerlin
Image from TrendAI Zero Day Initiative (@thezdi)
Image from TrendAI Zero Day Initiative (@thezdi)
7
951
That's a wrap on #Pwn2Own Toronto 2023! We awarded $1,038,250 for 58 unique 0-days during the event. Congratulations to Team Viettel (@vcslab) for winning Master of Pwn with $180K and 30 points. We'll see you at Pwn2Own Automotive in Tokyo next January.
Image from TrendAI Zero Day Initiative (@thezdi)
8
39
12
191
73,500
Nice play. #Pwn2Own #Xiaomi13Pro
Image from Công Thành Nguyễn (@ExLuck99)
2
10
3,085
* People ask LLMs to write code * LLMs recommend imports that don't actually exist * Attackers work out what these imports' names are, and create & upload them with malicious payloads * People using LLM-written code then auto-add malware themselves vulcan.io/blog/ai-hallucinat…
76
1,990
499
7,260
1,794,813
Load more