Vuln. Researcher since 00s. cto & co-founder @PRODAFT. Muay Thai addict.
London
Joined October 2010
- Tweets11.3K
- Following1.8K
- Followers35.4K
- Likes6.7K
Pinned Tweet
I looked at the extensions meant to keep managed-PostgreSQL users away from superuser.
They turned out to be my way in.
3 case studies from different vendors on breaking the code that was supposed to stop me.
Part 2/6 Breaking the Superuser Guardrails
mehmetince.net/part-2-6-brea…
phpnuke
A list of products affected by PHP2Shell.
securityonline.info/php2shel…
Mehmet INCE retweeted
The gallery is LIVE!
All the moments from the first LatentShift AI Conference are now in one place, from the stage and conversations to the team, the audience, and everything happening behind the scenes.
Find yourself, relive the day. ✨
🔗 latentshift.ai/2026/gallery/
2026 was just the beginning. 🚀
The most crowded booth was Omarchy’s the whole day!!
We wouldn't have this without you @BarisGirismen!
You should start organize a monthly omarchy Istanbul events and I promise will support in anyway I can!
Last week, on October 17, we brought @Omarchy to @LatentShiftAI!
@GoktugVatandas and I gave an Omarchy 101 talk and spent the day at our booth with @Rana__Selim. We chatted with people, introduced them to the OS and answered their questions. I also brought my home setup so people could try Omarchy firsthand and we could show them whatever they were curious about.
The booth was busy all day! A lot of people told us they were excited to try Omarchy at home. We met people who’d never heard of it and others who’d been using it since the early days. Someone told me he built an app that activates an AI agent when he says “Hey Omarchy” (like “Hey Siri”) so he can control his whole computer by voice while holding and playing with his baby!
It was my first time speaking at an event and running a booth, so the whole day was special to me. I also saw some friends and met @thetundeo, who runs the Omarchy London meetup and flew all the way from the UK for this event! It was also nice to see the Omarchy t-shirts, roll-up banners and website I designed all come together.
Huge thanks to @mdisec, @abilgegunduz, @aayseaktag, the @LatentShiftAI team and everyone else involved for organizing such a great event and making it so affordable at just €5 a ticket.
Someone was asking me other day, Mehmet are you done with your vulnerability research project on PostgreSQL ecosystem ?
I thought I would have leave this topic and get back to my own world after presenting the research here at PostgreSQL Conference Europe
But every single chat I have had with community members over the last 4 days, specially few talks that are completely no-security related, had me thinking about even crazier different attack vectors.
Cant stop thinking all about this.
Finally I presented my 5 month of a research in hacking PostgreSQL vendors at PGCONF.eu !
feedbacks are craaaazy positive from community members as well as postgres core security team 🔥
Mehmet INCE retweeted
I’ll be there 🙌🏻💫
The schedule is out! 🐍🍕
Join us at Python Pizza Istanbul on November 14 for a day of Python talks and community.
Explore the lineup and pick your must-see talks 👇
istanbul.python.pizza/#sched…
💯
I'm cautious about making fun of/talking shit about critical security issues as the industry is one big glass house built on open source paper straw stilts where we are all generally somewhere running 20+ yr old code *somewhere*. And the person who wrote it was human and made mistakes.
As key as always:
* Defense in depth
* Least privs environments
* Strong layered observability
* Rapid response playbooks
None of this is new. It will never be old.
Mehmet INCE retweeted
retweet this if you can find yourself 😍
fav it if you will be in the frame next year. 🫡
it's not official yet but I'm gonna bring my hacking postgresql vendors research to the Berlin.
Wednesday 4 November 2026
details are soon to be announced. But yeah, you wanna see this before scheduled postgresql release at nov :)
blend in the chaos and do whatever the silent fix you have done over the last few months. It wont be judged. come on. come clear you all.
Mehmet INCE retweeted
Today I flew during my talk at PGConf.EU
Because I believed I could fly.🦹♀️
ALT Bilge presenting on stage at PGConf.EU, striking a playful superhero pose with her legs spread wide and one arm stretched dramatically upward, pointing toward the screen. She holds a presentation clicker in her other hand and wears a white graphic T-shirt, a black-and-white star-patterned skirt, sneakers, and a conference badge. Behind her, a colorful slide displays a hexagonal visualization of AI research topics, including Agents & Memory, Multimodal Understanding, and Diffusion & Generation.
this php case is reminder of how important to have transparency on open-source vulnerabilities.
Fuck the silent fixers.
Mehmet INCE retweeted
To teach a lesson,
After Wiz rushed to buy php2shell domain and use its marketing machine to steal the spotlight, I spotted "phpbleed" in a recent Calif tweet and bought phpbleed.com before wiz could pull the same stunt again.
A big budget can buy a domain. It shouldn't buy someone else's research credit.
If you have contacts at CISA or in the press, do the right thing: make sure the researchers who actually did the work get the recognition they deserve.
Hack the planet. Credit the researchers.
