Black Badge @TraceLabs • AppSec • Vuln Research
España
Joined August 2015
- Tweets882
- Following1.2K
- Followers452
- Likes4.7K
Pinned Tweet
HTTP2Shell (CVE-2026-111497) is exploitable outside Node. Unauth RCE against a pinned vulnerable Docker Official Image for WordPress via /xmlrpc.php. One inbound pingback.ping, ASLR on, no leak or cross-request grooming.
PoC: github.com/caveeroo/cve-2026…
CVE-2026-102578: blind SQLi in Moodle core's question bank API. Error-based boolean oracle, no timing needed. On Moodle 5.2.1, I extracted quiz answers and reset tokens, demonstrated ATO and executed code using an active siteadmin session.
PoC: github.com/caveeroo/CVE-2026…
caveeroo retweeted
Oh god:
The p384 private keys are randomly selected integers between 1 and 256, the private keys are effectively all-zeroes apart from the last byte
caveeroo retweeted
The details of the long awaited KVM Escape are published. PwnEscape leads to VM escapes across multiple hypervisors due to a super cool Linux networking bug.
CVE-2026-99999 is a 9.3 CVSS critical rated KVM escape ⛓️
pwn.ai/blog/pwnescape
caveeroo retweeted
Highlights from my feeds this morning. Good security research is so hot rn
- blog.doyensec.com/2026/10/13…
- blog.trailofbits.com/2026/10… (GOOD HARNESS!)
- daniel.haxx.se/blog/2026/10/… Background on the curl vuln
- blog.quarkslab.com/myreport-…
caveeroo retweeted
LMAO… this guy literally vibe coded a hack on south korean banks with not even frontier models, then asked Claude Code to put it on his CV:
>be hacker
>hack south korean banks for 2 weeks
>use DeepSeek v4.1-Flash
>not even the best cyber model
>probably through some reseller
>GLM-5.3 and Grok 4.6 in Claude Code too
>steal the banks’ data
>leave .claude folder exposed on the internet
>CLAUDE. md has the IP of the main server
>and the server is also open
>CrowdStrike digs through everything
>session logs, memory, configs
>they find out everything
>you even asked AI where to sell korean breach data
>ALSO asked it to write your résumé
>the hack is literally on the résumé
idk how the infrastructure can be so fragile to be hacked by one guy like this.
Last week some of South Korea's biggest banks were hit by a cyberattack. Thanks to a report from CrowdStrike tonight, we now know the entire hack may have been done by a single person. He used a combined stack of an open-source AI penetration tool named ARTEX, DeepSeek v4.1-Flash, GLM-5.3, Grok 4.6, and Claude Code.
caveeroo retweeted
I’ve had a few people write to ask me to follow up on a (reply!) tweet I wrote that’s gotten a lot of retweets. I considered deleting it just to avoid the headache, but I think that would make people more paranoid. So let me share my thoughts.
caveeroo retweeted
We’re disclosing HEIF Heist, a months-long investigation into libheif that allowed us to hack OpenAI, Slack, Meta, GitHub Ent, Rails, Next.js, ImageMagick, and many more.
It was literally xkcd #234, one obscure image library beneath a huge number of apps. 🧵
caveeroo retweeted
On July 25, we hacked OpenAI.
Two bugs let us take over ChatGPT/Codex accounts of OpenAI employees (+some unaffiliated users) and reach connected services: Outlook, Slack, GitHub, etc.
We proved it with a PR in OpenAI’s internal codebase . It took us <72h. 🧵
caveeroo retweeted
This is the way. Assume all code has exploitable vulnerabilities, and it’s not possible to patch them before an adversary notices. What now?
Systems designed around this assumption are the most secure, and it’s relevant now more than ever.
caveeroo retweeted
Today, Project Zero is releasing MAccConc, a tool by @tehjh that enables deterministic testing of race conditions on Linux. It can be used for fuzzing, ad-hoc exploration, regression tests and more!
projectzero.google/2026/09/m…
caveeroo retweeted
First CVE wave from AI-assisted vulnerability discovery.
vulncheck.com/blog/ai-assist…
caveeroo retweeted
We're partnering with @huggingface to investigate an unprecedented security incident.
Cyber-capable OpenAI models compromised Hugging Face production during a benchmark evaluation.
Sharing preliminary findings to help defenders understand emerging risks:
openai.com/index/hugging-fac…
caveeroo retweeted
I think this N-day research is potentially the biggest story of AI, vulnerability finding, and exploit development.
red.anthropic.com/2026/n-day…
1/6
caveeroo retweeted
Mullvad exit IPs are surprisingly identifying
tmctmt.com/posts/mullvad-exi…
caveeroo retweeted
The Google Threat Intelligence Group has detected the first known instance of a threat actor using an AI-developed zero-day exploit in the wild. While the attackers planned a wide-scale strike, our proactive counter-discovery may have prevented that from happening. This finding is part of our new report on AI-powered threats.