Software Entomologist focusing on dangerous species.
République de la Poutine
Joined April 2014
- Tweets703
- Following903
- Followers1.2K
- Likes1.7K
Marc Montpas retweeted
“Simplicity is a great virtue, but it requires hard work to achieve and education to appreciate. And to make matters worse, complexity sells better.” — Edsger Dijkstra
Marc Montpas retweeted
What I’ve always found amazing about CTFs is that "flag is flag". Whether you found an unintentional solve or pwned the browser with n-day for a XSS challenge, it didn't matter.
I totally get the frustration of AI, but there is no solution other than accepting the change.
I started playing CTFs in 2022, and LLMs definitely changed the **competitive** CTF scene a lot, especially since mid-2025. I also started using LLMs in late 2025. Yes, those models did one-shot many challenges, but what's the fun of slopping them? I learned absolutely nothing 🥲
ALT DaveZero's personal opinion towards AI slopping in CTFs. @Srdnlen CTF 2026 Quals Discord server.
Marc Montpas retweeted
Probably not. Prompting an LLM with natural language is inherently lossy and ambiguous. Up to this point, programming has always been deterministic: Your code does what you say it should do otherwise, it’s a bug. Coding agents break that contract. blog.trailofbits.com/2025/12…
Marc Montpas retweeted
This looks nicely written: ifixit.com/News/112008/polis…
Marc Montpas retweeted
It's so cool to see so many people participate in our #WCUS WordPress CTF. @marcS0H from @jetpack is currently leading the competition! 😎 You can see the live scoreboard here: ctf.patchstack.com/scoreboar…
Marc Montpas retweeted
Our researchers found a Pre-Auth Object Injection vulnerability in the SEOPress plugin (300k+ active installs). It was fixed in the recent 7.9 update. Make sure to update now! #wordpress #security
wpscan.com/blog/object-injec…
MOTD: Reinventing the wheel only works if it's circle-shaped.
(Love uncovering relatively uncommon antipatterns like this.)
#wordpress #security
Our researchers found a Pre-Auth Object Injection vulnerability in the SEOPress plugin (300k+ active installs). It was fixed in the recent 7.9 update. Make sure to update now! #wordpress #security
wpscan.com/blog/object-injec…
1
170
Marc Montpas retweeted
The first part of the blog series: #Iconv, set the charset to RCE. We'll use #PHP filters and #CVE-2024-2961 to get a very stable code execution exploit from a file read primitive. #cnext
Iconv, set the charset to RCE: in the first blog post of this series, @cfreal_ will show a new exploitation vector to get RCE in PHP from a file read primitive, using a bug in iconv() (CVE-2024-2961) ambionics.io/blog/iconv-cve-…
Marc Montpas retweeted
🔥Multiple XSS vulnerabilities in popular CMS Joomla! (CVE-2024-21726) 🔥
PHP bug could be used to bypass sanitization - We just disclosed the technical details behind the recent Joomla vulnerability:
sonarsource.com/blog/joomla-…
⚠️ Multiple XSS vulnerabilities in popular CMS Joomla! (CVE-2024-21726) ⚠️
Attackers could trick administrators into clicking on a malicious link and gain RCE:
sonarsource.com/blog/joomla-…
#appsec #security #vulnerability #joomla
Marc Montpas retweeted
Automattic is expanding the Jetpack and WPScan Security Research team, if you like to break PHP code and investigate malware fill out the interest form here: lnkd.in/dhFFArc9
#hiring #wordpress #securityresearch #remotejobs
Marc Montpas retweeted
Balada Injector: analysis of the initial and secondary infections.
Domains: *.specialcraftbox[.]com and *.greenfastline[.]com (more in the post)
Vulnerable plugin: Popup Builder.
Thanks @marcs0h for the help with understanding the vuln
The Balada Injector campaign: 6,200+ sites got hacked within a few days after Popup Builder vulnerability disclosure in December. A month later, thousands still infected. Research by @unmaskparasites. #xss #balada #WP #WordPress
sucur.it/48ROX2R
Marc Montpas retweeted
Our researchers found a Pre-Auth Stored XSS vulnerability in the WP Go Maps plugin (formerly known as WP Google Maps, 400k+ active installs). It was fixed in the recent 9.0.28 update. Make sure to update now!
#wordpress #security
wpscan.com/blog/stored-xss-f…
Marc Montpas retweeted
Our researchers found a Pre-Auth Stored XSS vulnerability in the Popup Builder plugin (200k+ active installs). It was fixed in the recent 4.2.3 update. Make sure to update now!
#wordpress #security
wpscan.com/blog/stored-xss-f…
Marc Montpas retweeted
Learn about the two @Owncloud vulnerabilities CVE-2023-49103 and CVE-2023-49105 in our new blogpost: ambionics.io/blog/owncloud-c…
Marc Montpas retweeted
CVE-2023-49103: this analysis by @GreyNoiseIO is erroneous. The exploit WORKS with default configuration, even on docker installs. Please patch.
Explore the details of the recent ownCloud graphapi vulnerability (CVE-2023-49103) in our latest labs post, as this one starts with some mystery! labs.greynoise.io//grimoire/…
Marc Montpas retweeted
Expecting to struggle finding a gadget chain in WordPress Core during an assessment when devs suddenly decided to make it easy : fenrisk.com/publications/blo…
Marc Montpas retweeted
Our researchers found a serious SQL Injection vulnerability in the WP Fastest Cache plugin. It was fixed in the recent 1.2.2 update. Make sure to update now!
wpscan.com/blog/unauthentica…
#wordpress #security
