Web App Hacking (Preferably) | RED TEAMER 🟥 | Cybersecurity YouTuber | r007 https://teapawt.net/t.co/7EOgqWKXXv
0.0.0.0
Joined June 2013
- Tweets6.5K
- Following888
- Followers1.4K
- Likes3.6K
Pinned Tweet
Built a vulnerable e-commerce app for pentesters and AppSec engineers to hack legally. 40+ vulns. OWASP Top 10 (2025) + LLM Top 10.
Hack it live or spin it locally with Docker. pwnshop.ctfsecurity.com github.com/r007sec/pwnshop
#AppSec #BugBounty #OWASP
If you saved your OpenAI or Anthropic key in OpenCode Console, deleting it from there doesn’t kill it.
61
Olajeedae Jr 🇳🇬 retweeted
🚨 PHP2Shell detection is now available in Burp Suite Professional & Burp Suite DAST.
Most of the web is powered by PHP, which means most of the web is vulnerable to these critical unauthenticated remote code execution flaws (CVE-2026-109618 / 109619). You can already detect it in Burp Suite using:
🟧 ActiveScan++ v2.0.13 (portswigger.net/bappstore/31…)
🟧 Bambda scan checks (github.com/PortSwigger/bambd…)
🟧 BChecks (github.com/PortSwigger/bchec…)
Start scanning for the vulnerability now → portswigger.net/bappstore/31…
Olajeedae Jr 🇳🇬 retweeted
PHP 8.4.27 released - 89 fixes in 30 components, including security fixes (CVE-2026-109618, CVE-2026-109619).
Changelog + downloads: php-net.pro/news/php-8-4-27-…
Olajeedae Jr 🇳🇬 retweeted
@ubuntu are you ramping up your download/mirror servers to handle everyone and their mother downloading updates at 14:00UTC?
Olajeedae Jr 🇳🇬 retweeted
The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2.
PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.
Two critical PHP RCEs leaked before the embargo. watchTowr and Previdian both reproduced them.
Patches are live now. CVE-2026-109618 and CVE-2026-109619. CVSS 9.2 officially.
If you run PHP in production, you might want to start looking at this
1
10
366
Olajeedae Jr 🇳🇬 retweeted
If your company is hiring for the role of AppSec engineering or security researcher/tester let me know. Fully remote please.
Thank you
Olajeedae Jr 🇳🇬 retweeted
For days now, I picked a free Ai-agent and started the harness training, I kept improving it and adding more skills to it, then I picked @r007User CTF website for a testing ground, you won’t believe how powerful it has become and how it was able to chain from SSTI to an RCE.
Olajeedae Jr 🇳🇬 retweeted
First you register as a seller
curl -s -c cookies.txt -X POST pwnshop.ctfsecurity.com/regi… \
-d "username=rceuser&phone=+2348000000000&[email protected]&password=password123&role=seller&referral_code="
@r007User then you login with the credentials
Olajeedae Jr 🇳🇬 retweeted
@BensonDynasty_ can you see that the agent did so, @r007User see your RCE
Olajeedae Jr 🇳🇬 retweeted
Cloudflare open-sourced the security audit skill that seeded its own vulnerability hunting harness. Your coding agent can now run it on your code.
How it works, in 6 phases:
→ maps your codebase
→ hunts for bugs area by area so nothing gets skipped
→ sends every finding to a fresh agent that didn't find it, to confirm it's real
→ writes structured results
→ verifies each record again, independently
→ writes the final report
You get a findings file split into confirmed, needs validation and rejected, so you fix the real problems first.
Install:
npx skills add github.com/cloudflare/securi… --skill security-audit
Then open your agent in your project and type: "security audit this codebase"
MIT licensed, 31.3K stars.
I wouldn't say all but this is handful
Dude WTF??... You can find all the subdomains of a website with one simple URL. 🤯
This "CRT" hack lets you list subdomains associated with a primary domain using public certificate data.
Just type: https://crt . name/v1/search?apex=[domain-name-here]
Replace [domain-name-here] with the domain you want to check, and it'll show the matching subdomains.
No installation... No complicated setup... Just one URL.
Watch the video for a quick demo :)
Follow me for more amazing AI, Coding & Web Dev insights. 💎
1
1
137
Olajeedae Jr 🇳🇬 retweeted
Anthropic engineer:
"You're not supposed to prompt Opus 5.5
You're supposed to build a system that prompts itself. At Anthropic, 90% of our engineers have already built such systems"
In 30 minutes she shows exactly how Anthropic builds agents that remember, fix their own mistakes and get smarter with every run.
This beats any $1000-$2000 course on agents I've seen.
Watch it, then read the full guide for Opus 5.5 loop + jev engineering.
Your Claude loops can burn money while nothing changes
Use Jev to filter tasks and cut decision costs
Fix the trigger before another overnight run
The full Loop engineering + Jev engineering setup below ↓
Readers added context they thought people might want to know
The quote has nothing to do with the attached talk. It is not said by the speaker at any point.
x.com/hayatomaruu/st…
REA gained over 100k GitHub stars in a single week and just crossed 200k. The same week, a dev’s AI-built Photoshop clone in Rust went viral.
Different projects, but the message is the same. Rebuilding software just got cheap. Big software companies should be paying attention.
6
332