Cybersecurity Expert specializing in Web Security, Blockchain/Web3 vulnerabilities, CTF, and Red/Blue Team operations.

Singapore
Joined December 2020
某无人机厂商向公安机关举报GEEKCON称教唆破解无人机(原创: @ZianTT_Official )
13
6
151
33,723
ckcsec retweeted
Replying to @CoinDCX
CoinDCX deposit address TQKJQ was in use by a LP for 10 months after your July 2025 incident and swept user deposits + received gas as recent as April & May 2026 to your current public hot wallet. Meaning $15.8M in user deposits was unaccounted for by your team. Why are Indian CEXs so untrustworthy? WazirX BitBNS Now CoinDCX
85
87
42
964
85,404
《致胡锡进老师》 胡锡进老师: 您第二篇文章的最后一句是,做人还是要老实、厚道一些。我想老实地向您请教一件事。 我是一九九零年生人,今年三十六岁,到了婚育的年纪。您是长辈,比我大整三十岁,我读北大的时候就读您的文章,所以这件事我想问您,不想问别人。 全中国二十岁到四十岁的男性有两亿,女性也有两亿。她们那一边的代价,不该由我来说,我只说我这一边。 怎么和女性相处,怎么组成家庭,怎么生儿育女,这条路我们没有走过,没有人教过我们,我们不懂。旁人看这些是吃瓜,对这两亿人,这是每天早上醒来就要面对的事。 我不知道,一个中国男人是否应当支付高额的彩礼;如果应当,是按定额,还是按他财产的比例。 我不知道,生育这件事,男方应当为它付出多少代价。 我不知道,婚前婚后女方提出的要求,男方是否都应当满足;如果没有满足、女方离开,男方是否有权取回彩礼;女方拒绝,男方是否可以走法律途径。 我也不知道,一个男人礼数尽了,父母见了,分手很久,钱要不回来,人也找不到之后,是否有权向公众说出自己的看法。我选了说。这对不对? 这些问题,我没有答案。有些问题,国家有它的答案,一号文件写了,最高法也出了解释,我读过,也信;但文件写在纸上,彩礼谈在饭桌上,中间隔着现实的规矩。您是长辈,您的答案,我也尊重,就像我对法院最终的彩礼判决无条件尊重一样。 彩礼总归是要付的。天南地北,白丁鸿儒,无非是三万、三十万、三百万、三千万的分别。这是两亿青年男性都要承受的代价,我们认。 一个人算不清一笔账的时候,最稳妥的做法是不算。我出生的一九九零年,全国出生了两千三百多万人;去年,七百九十二万,建国以来最少。 我不认为这全是一笔账的缘故,但少的那三分之二里,很多人不是不想,是不知道这条路上要付什么、付多少、付了之后算不算数。人不会因为代价高而退出,退出,是因为看不见代价的边在哪里。 这个代价的规则究竟是什么,我们不知道。 两亿人在等这个答案,因为这是他们成家的第一步,也将决定未来三十年这个国家由谁组成。 我今天没有答案。我希望三十年后,有年轻人来问我这个问题的时候,我能给他一个。 孙宇晨
6,454
947
814
15,902
5,057,988
ckcsec retweeted
Grok Bot now has improved support for X! When you connect your X profile, a developer account will be automatically created with some included credits.
528
391
292
4,596
1,584,506
ckcsec retweeted
Cursor is now part of @SpaceX. Today, we have officially closed our acquisition. We will join the @spacexai team to help make Grok the world's most useful AI and improve Grok Build, Grok Bot, Grok API, Cursor, and more. SpaceX has built some of the most inspiring and impressive technology in the world, and we’re grateful for the opportunity to become part of such a special company. Onwards.
2,456
4,566
1,821
54,979
9,840,180
ckcsec retweeted
Interesting. Grok 4.6 releases around August 7. This will be the 1.5T model with significantly improved SFT & RL. Grok 4.7 will be the 2.1T model released a few weeks later. This will be better than 4.6 in every way, except slightly slower to serve, albeit with even better token efficiency.
In our latest deepsec.sh benchmarks, Grok 4.5 has emerged as the best cybersecurity AI model on price-performance. It's 10x cheaper than Sol, 5.7x cheaper than Opus 5, and 2.2x cheaper than Kimi K3, yet at Kimi-like perf. Sol remains the frontier, ahead of Opus 5.
2,263
2,198
611
21,118
6,649,052
StegoX 深层隐写术 ddosi.org/stegox/
4
11
2,181
For my first post, I’m sharing a letter @NVIDIA signed on why open models matter. AI will transform every industry, power every company, and be built by every country. Open models strengthen safety and cybersecurity, accelerate innovation and diffusion, and enable sovereignty. The world needs both frontier closed models and frontier open models. images.nvidia.com/pdf/Open-W…
15,974
29,254
10,950
171,410
66,509,340
Original write-up on the fastjson 1.2.83 gadget-free RCE. Have fun reading, I hope you missed writeups without AI slop. Comment here your opinion. fearsoff.org/research/fastjs…
7
65
4
223
67,589
We found a gadget-free RCE in Fastjson 1.2.83 - the final release of the 1.x line, and still one of the most widely-deployed Java JSON libraries in production today, even with 2.x around. No classpath gadget. One payload-> RCE.
43
86
11
482
109,227
ckcsec retweeted
Once we have completed our review for security vulnerabilities, we will make the entire codebase of 𝕏 open source, with no exceptions. Moreover, we will invite third party reviewers to examine the system that is running to confirm that the open source code is what is running. Trust through total transparency is the only thing that should be believed.
5,771
11,751
2,347
108,370
7,355,782
ckcsec retweeted
Introducing ChatGPT Work, a new agent in ChatGPT powered by Codex and GPT-5.6. It can take action across your apps and files, stay with a project for hours if needed, and turn a goal into finished work. It’s a whole new way to get work done.
1,316
2,214
1,009
21,692
16,114,591
ckcsec retweeted
Our team's open-source project HaE (Highlighter And Extractor), meticulously crafted and refined over eight years of continuous iteration, has been honored with the Most Nominated Award at the Burp Extensibility Awards 2026(portswigger.net/blog/burp-ex…).Thanks to the @Burp_Suite @BApp_Store team for all their efforts! "Highlighter And Extractor acts like a smart filter, immediately drawing my eyes to the requests that matter most. It feels like having an extra pair of eyes watching the traffic for me. The rule-based automation - the ability to write custom regex rules and have Burp automatically highlight and extract data - is a game-changer." github.com/gh0stkey/HaE
1
5
1
26
4,469
由于不可抗力因素,币安钱包SPCXx IPO Campaign 将无法继续进行。 🔸 所有参与用户的 USDC 已完成全额退款至您的币安钱包地址 🔸 所有参与用户将均分价值 $1,000,000 的 bStocks SpaceX 代币(SPCXB)空投,并自动发放至您的币安现货账户 🔸 无需等待——现可在币安提交 SpaceX(SPCX)股票的整股正常交易时段限价订单 感谢您的耐心与支持,详情请查看公告👇 binance.com/zh-CN/support/an…
125
27
33
198
111,725
ckcsec retweeted
1、币圈大大小小各个赛道,轮动很快,对能力的侧重点要求不同,很难做到专精。例如我比较擅长玩链上的NFT和土狗币,但是铭文就基本没有参与。要么适应,要么潜心埋伏自己擅长的赛道等风来,无他法。 2、每个赛道都有生命周期,盛极而衰,同样的人用同样的玩法在不同的环境下会拿到截然不同的结果,而人又往往容易根据自己的成功经验形成思维定式。像我最近在SOL链上也是亏钱居多,因为我还是用之前的玩法,看好就买入,并且不达到目标点位就不卖,但是现在SOL上的流动性和之前已经天差地别了。 3、每个赛道能容纳的资金量不一样,取得一定的结果后,体量上来了,想更进一步,就需要探索不同的领域。对我来说,再去PVP链上中小市值的币,对资产提升没有任何意义,更多地是为了保持对市场的敏感性。这大半年取得较大收益的做空山寨、ETH对冲和Pumpfun公售等等,都更接近二级交易,因为流动性更充足,有更多容纳1M+资金的机会。 4、取得大结果后,有人会自满,有人会怠惰,有人会将重心投入到其他方方面面。证明过自己后,就不会再有太多执念,身边几个“版本之子”要么在享受生活,要么心态变得平和,不会过分在意他人的评价。炒币、赚钱的究极意义是什么呢?对我而言是让自己和家人过得开心,有高标准的生活质量,并且能支持自己做想做的事,足矣,倘若纯粹将其视作追逐数字的游戏,反而舍本逐末了。 5、为什么我上条推文说Aster让我焦虑了呢,对于资金体量不太大的玩家来说,从CZ喊单到现在10倍,也不算非常高的倍数,但是现阶段我更看重的是能容纳的资金量级,能兼具大资金、高倍数、涨得快三者的机会很少。而据我了解,很多从APX开始跟进了一两年的高手,都在0.1以下就卖了,反而是刚了解到这个项目,纯粹把它当做“CZ喊单的Hyperliquid竞品”的玩家敢买敢追,拿到了大结果。即使认知高,也无法保证能在单个项目上起到决定性作用,市场存在各种偶然性。 以上给我们的启示是,在币圈最重要的事,其实是活着,把平时大大小小的项目当作历练,积累经验和财富,才能有足够的底气和容错率,在认为大机会来临的时候出击,下个版本之子可能就是你。
129
192
28
1,156
293,188
【如何捡到带血的筹码】 推荐一个iOS上的APP——Bark,支持iOS重要通知接口,即使你的设备是静音状态,也可以强制响铃提醒,最主要的是走的原生消息推送通道,可以实现无后台推送。 配合价格监控(bark.shand.ing/)使用,你用过就知道,不比什么短信、电话强? 最主要我是免费!免费!免费!给大家使用,记得给我点个关注,并且把这条推文转发给有需要的人,后续持续更新。
2
1
3
674