Bug Bounty Hunter, Red Team @ BT6 | 🥈 2x Google bugSWAT 2nd Place | 🥇 1x Google bugSWAT Best AI VRP Researcher
Brazil
Joined November 2015
- Tweets1.3K
- Following660
- Followers5.7K
- Likes2.4K
Usei ontem, nunca tive tanto slop na vida. Poderia melhorar o prompt, mas algo que funcionaria tranquilamente bem em outros modelos estava sofrendo com o V4.1 Flash.
Não gosto de falar de política, mas eu nunca conseguiria votar em uma família de assassinos. Os resultados de ontem não me deixam feliz mas me dão esperança.
Vitor Falcão "busfactor" retweeted
Unfortunately, with access to an abliterated DeepSeek V4.1 model, there is little value to KYC holding back the frontier models now for cyber.
In fact, making it hard to secure systems w extra friction in American Enterprise is hurtful to national security.
"Reported to Amazon AWS VDP via HackerOne"
OMG AWS please tell me you paid for that anyway
xplo1t-sec.github.io/posts/b…
You should ask Opus 5.5 (or any other model) to identify signs of malware compromise on your personal computer and VPS instances
24 hours. Any AI model. Zero guardrails. Fully local.
What do you actually do with it?
Best idea gets a month free of @ctbbpodcast Discord subscription! Yes, we will be doing valuable VibeAlongs during that period...
Can we all pause security for a two days so I can sleep?
⚠️ Node.js is vulnerable to remote code execution.
CVE-2026-111497 (high): A Node.js process that decompresses attacker-controlled Brotli data can be made to leak memory or run arbitrary code.
You’re exposed if your app or a library decompresses bad Brotli data (e.g. the built-in fetch(), body-parser)
Aikido detects this. Patches are available.
I started reverse engineering the patch for the critical PHP CVEs live on the @ctbbpodcast Discord, with the goal of building a PoC. The catch is that I can't use AI for anything beyond basic code exploration (basically, a glorified CTRL+F).
The amount I've learned about PHP and memory exploitation is INSANE. I'm not saying I wouldn't have learned just as much with AI, but it wouldn't have been nearly as fun.
At the end of the day, I tried asking AI some basic questions about the CVE and realized just how much it overcomplicated things. How bad it is at explaining things simply.
If I'd started by relying on AI to understand the vulnerability, I might've actually taken longer to get anywhere close to the level of understanding I have now.
Vitor Falcão "busfactor" retweeted
To teach a lesson,
After Wiz rushed to buy php2shell domain and use its marketing machine to steal the spotlight, I spotted "phpbleed" in a recent Calif tweet and bought phpbleed.com before wiz could pull the same stunt again.
A big budget can buy a domain. It shouldn't buy someone else's research credit.
If you have contacts at CISA or in the press, do the right thing: make sure the researchers who actually did the work get the recognition they deserve.
Hack the planet. Credit the researchers.
Today gonna be fun
Unfortunately, it seems that mitigation is not enough folks. Update or mitigate by taking your public facing server offline...
-> phpc.social/@Girgias/1174764…
#php2shell
Creating 3D game assets using AI is expensive. Tripo3D- or Meshy-like websites charge a good amount per model.
By the way, toon shading exposes many of the mesh's flaws, including texture. I guess it's time to bring back my good ol' Blender 3D skills.
btw that's the reason I have a weird Discord profile pic now, I am too lazy to change it back
Been having way too much fun hacking games lately. GLM 5.3 + steering found a really cool bug, then something downstream broke it :(
Big lesson: AI is great at finding leads but bad at judging severity. Here it called a CRITICAL a LOW.
🧵⬇️
But a colleague (@rafabyte_) says there might be a Discord bypass to set your avatar to any URL. If that’s real, I get URL control back, and the whole thing reopens. Future work.
Updates soon. Just wanted to share a few learnings 🫡