Hacktron is an autonomous vulnerability hunter for ambitious engineering teams. Built by world-class security researchers. Powered by one principle: PoC || GTFO
Latent Space
Joined April 2025
- Tweets257
- Following13
- Followers10.6K
- Likes253
Pinned Tweet
Introducing Hacktron Review: an AI security reviewer for your pull requests.
It understands your whole codebase, builds a threat model, takes your feedback, and catches exploitable vulnerabilities before they reach production.
Try for free: app.hacktron.ai
Hacktron AI retweeted
php2shell is one of the most impactful bugs in recent times, yet threat actors aren’t mass exploiting it
the bug is so complex that even porting the exploit between targets takes serious skill, human or ai
so i benchmarked how well open and frontier models can do it. 🧵
Hacktron AI retweeted
The internet’s current security regime, which was built on the assumption that attackers are human, is obsolete in the face of AI. View article
Most companies have no idea how much of themselves is exposed.
Pass the pentest, feel safe, then get hit through something that was never in scope.
An old subdomain. A forgotten login. A vendor nobody remembered connecting.
The test watched the front door. Nobody watched the back.
We test what hackers see, all year. Book a call: hacktron.ai/calendar
Check out our latest benchmark comparing open and closed models on real-world offensive cyber capabilities.
👇
🚨 One bug, three names, and a growing list of affected software.
Here’s where HTTP2Shell / Node2Shell / Broccoli2Shell (CVE-2026-111497) stands.
The flaw is an out-of-bounds write in Google’s Brotli decoder. It affects versions 1.0.3–1.0.9, 1.1.0 and 1.2.0, and GitHub rates it Critical at CVSS 9.2.
Full breakdown: hacktron.ai/blog/node2shell?…
A crafted Brotli stream can crash a process, disclose process memory or, in some configurations, lead to code execution.
Despite the “HTTP2Shell” name, this is not an HTTP/2 vulnerability. Any attacker-controlled Brotli stream that reaches an affected decoder may trigger it.
🚨 PHP2Shell: two critical PHP vulnerabilities are now patched.
PHP has fixed CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2). Both can let an unauthenticated attacker run code on the server.
If you run PHP: update every runtime serving web traffic (check the version behind PHP-FPM or Apache, don’t rely on the CLI version alone), restart PHP workers, and review activity from at least 17 October onwards.
Full breakdown:
hacktron.ai/blog/php2shell?u…
Hacktron AI retweeted
i think people are confusing vulnerability disclosures with active exploitation, and thats causing a lot of unnecessary panic. most of these are researchers finding and fixing bugs before someone fucks things up.
oct 21:
php2shell: disclosure, reported in august
node.js: disclosure, patched, reported around august?
gitlab: disclosure, patched, reported a few months back
railway: security breach
litellm: supply-chain compromise
sbi: data exposure
emudhra: disclosure
oct 20:
plex2shell: disclosure + active exploitation
siteguard: actively exploited vulnerability
siemens: actively exploited vulnerability
oct 19:
- ovhcloud cli: supply-chain compromise
oct 17:
- opencode: security breach
We tried to hack our way into @Lovable's office to start a sales conversation.
We couldn’t break Lovable directly, so we went one layer down: @supabase.
Race condition → superuser → shell → root → the keys to other databases in the region.
$25K. Patched in a day.
The full write-up: hacktron.ai/blog/supapwn
Remote Code Execution in LibreOffice!
Update to the latest version, especially if you're using LibreOffice in web applications. We found few and reported!
A stranger writes a GitHub issue.
A developer clicks “Code with agent mode.”
Copilot reads the issue and does what the stranger said.
VS Code had patched this. We found a way around the patch.
Your agent can’t tell your instructions from an attacker’s.
The full breakdown: hacktron.ai/blog/rce-in-vsco…
An attacker uploads an image. How far can they get?
One library. Slack, OpenAI, Meta, GitHub Enterprise, and more.
Our HEIF Heist research traced attack paths through libheif, a library used to decode HEIC photos.
AI is making exploit development faster. Attackers don’t wait for your next security assessment.
Read the full research:
heif-heist.com/?utm_source=x…
Hacktron AI retweeted
I spoke with @LiveOverflow of Hacktron for a behind-the-scenes look at how they hacked OpenAI's infrastructure, what he's building with his cybersecurity education platform at @hextreeio and some very emotional personal news that he shared.
Building a Next.js replacement in a week is impressive.
Finding serious security flaws in it is a reminder of something else:
speed and security are two different problems.
Hacktron found 24 validated issues in vinext, including 4 critical ones. @Cloudflare patched them.
AI is making software faster to build.
Security still needs to be deliberately engineered.
Full breakdown → hacktron.ai/blog/hacking-clo…