ˢⁱⁿ⁹⁹ˣˣ (@sin99xx) header
ˢⁱⁿ⁹⁹ˣˣ (@sin99xx) profile picture

ˢⁱⁿ⁹⁹ˣˣ

@sin99xx

It takes a loud voice to make the deaf hear.

 Toronto, Ontario
sin99xx.com/
Joined May 2022
  • Tweets768
  • Following717
  • Followers972
76Media
Photo by ˢⁱⁿ⁹⁹ˣˣ (@sin99xx)Photo by ˢⁱⁿ⁹⁹ˣˣ (@sin99xx)Photo by ˢⁱⁿ⁹⁹ˣˣ (@sin99xx)Photo by ˢⁱⁿ⁹⁹ˣˣ (@sin99xx)Photo by ˢⁱⁿ⁹⁹ˣˣ (@sin99xx)Photo by ˢⁱⁿ⁹⁹ˣˣ (@sin99xx)Photo by ˢⁱⁿ⁹⁹ˣˣ (@sin99xx)Photo by ˢⁱⁿ⁹⁹ˣˣ (@sin99xx)Photo by ˢⁱⁿ⁹⁹ˣˣ (@sin99xx)Photo by ˢⁱⁿ⁹⁹ˣˣ (@sin99xx)
Most JWT content is stuck in 2015. alg=none, weak secrets, basic misconfig screenshots. That’s not where the interesting bugs are. I usually keep this stuff private. This time I’m dropping it publicly ↓ sin99xx.medium.com/jwts-for-…
Image from ˢⁱⁿ⁹⁹ˣˣ (@sin99xx)
6
79
1
393
28,723
stop hammering stealmybitcoin.com guys 😂😂 that shit 502
5
298
Daybreak was working fine in Codex yesterday. I already set up 2 YubiKeys + Advanced Account Security exactly like required. Today it’s just gone from the model picker. chatgpt.com/cyber is also acting weird. @fouadmatin
4
1
17
2,697
ˢⁱⁿ⁹⁹ˣˣ retweeted
ˢⁱⁿ⁹⁹ˣˣ (@sin99xx) profile picture
ˢⁱⁿ⁹⁹ˣˣ
@sin99xxSep 18
4/4 in TOR 🎎 2 Medium 2 Low
Image from ˢⁱⁿ⁹⁹ˣˣ (@sin99xx)
ˢⁱⁿ⁹⁹ˣˣ (@sin99xx) profile pictureˢⁱⁿ⁹⁹ˣˣ
@sin99xxSep 12
here we go: Tor Browser 🚀
Image from ˢⁱⁿ⁹⁹ˣˣ (@sin99xx)
2
2
1
68
3,015
4/4 in TOR 🎎 2 Medium 2 Low
Image from ˢⁱⁿ⁹⁹ˣˣ (@sin99xx)
ˢⁱⁿ⁹⁹ˣˣ (@sin99xx) profile pictureˢⁱⁿ⁹⁹ˣˣ
@sin99xxSep 12
here we go: Tor Browser 🚀
Image from ˢⁱⁿ⁹⁹ˣˣ (@sin99xx)
2
2
1
68
3,015
ˢⁱⁿ⁹⁹ˣˣ retweeted
ˢⁱⁿ⁹⁹ˣˣ (@sin99xx) profile picture
ˢⁱⁿ⁹⁹ˣˣ
@sin99xxSep 15
hashtag hackerone
Image from ˢⁱⁿ⁹⁹ˣˣ (@sin99xx)
4
2
1
58
2,392
hashtag hackerone
Image from ˢⁱⁿ⁹⁹ˣˣ (@sin99xx)
4
2
1
58
2,392
ˢⁱⁿ⁹⁹ˣˣ retweeted
ˢⁱⁿ⁹⁹ˣˣ (@sin99xx) profile picture
ˢⁱⁿ⁹⁹ˣˣ
@sin99xxSep 12
here we go: Tor Browser 🚀
Image from ˢⁱⁿ⁹⁹ˣˣ (@sin99xx)
4
3
2
154
10,178
here we go: Tor Browser 🚀
Image from ˢⁱⁿ⁹⁹ˣˣ (@sin99xx)
4
3
2
154
10,178
ˢⁱⁿ⁹⁹ˣˣ retweeted
p4 (@peeefour) profile picture
p4@peeefourSep 3
I'm seeing a lot of my good friends do well for themselves. @dreyand_ @kirareysV2 @sin99xx @shreyas_chavhan @kuroOowannafly @AyushSingh1098 @neganspl01t @Bewgsyy @0xmicho1 @T3PO0 @Dr4g0n369 @Yassh_twts @efaav @__jkbrah__ @robotics8n and more yk who you are. Life is Great.
5
1
1
15
520
ˢⁱⁿ⁹⁹ˣˣ retweeted
ˢⁱⁿ⁹⁹ˣˣ (@sin99xx) profile picture
ˢⁱⁿ⁹⁹ˣˣ
@sin99xxSep 2
😶‍🌫️
Image from ˢⁱⁿ⁹⁹ˣˣ (@sin99xx)
Image from ˢⁱⁿ⁹⁹ˣˣ (@sin99xx)
6
2
2
83
3,926
😶‍🌫️
Image from ˢⁱⁿ⁹⁹ˣˣ (@sin99xx)
Image from ˢⁱⁿ⁹⁹ˣˣ (@sin99xx)
6
2
2
83
3,926
ˢⁱⁿ⁹⁹ˣˣ retweeted
ˢⁱⁿ⁹⁹ˣˣ (@sin99xx) profile picture
ˢⁱⁿ⁹⁹ˣˣ
@sin99xxAug 27
QEMU out-of-bounds write – at Halton Hills, Ontario
Image from ˢⁱⁿ⁹⁹ˣˣ (@sin99xx)
1
2
10
707
QEMU out-of-bounds write – at Halton Hills, Ontario
Image from ˢⁱⁿ⁹⁹ˣˣ (@sin99xx)
1
2
10
707
Fun fact: the ‘96-byte panning buffer → controlled QEMU heap overflow’ one was found by me earlier and is CVE-2026-17516.
Trail of Bits (@trailofbits) profile pictureTrail of Bits
@trailofbitsAug 26
We asked GPT 5.6-Cyber to escape a VM used to sandbox agents. It broke out three times. In its final escape, the agent found three 0-days on its own and chained them into a working exploit. blog.trailofbits.com/2026/08…
VMs won't contain cyber-capable agents

VMs won't contain cyber-capable agents

You can no longer assume a mere VM will contain a sufficiently advanced AI agent.

blog.trailofbits.com
16
1,123
ˢⁱⁿ⁹⁹ˣˣ retweeted
ˢⁱⁿ⁹⁹ˣˣ (@sin99xx) profile picture
ˢⁱⁿ⁹⁹ˣˣ
@sin99xxAug 11
Two more QEMU CVEs dropped 🔥 CVE-2026-17516 → VGA panning_buf heap OOB WRITEafter text/graphics mode switch (Default) CVE-2026-18204 → USB smartcard-reader OOB read in bulk-in ring Both guest-triggerable. Patches already up. patchew.org/QEMU/20260728151… patchew.org/QEMU/20260729075…
1
1
2
10
790
Two more QEMU CVEs dropped 🔥 CVE-2026-17516 → VGA panning_buf heap OOB WRITEafter text/graphics mode switch (Default) CVE-2026-18204 → USB smartcard-reader OOB read in bulk-in ring Both guest-triggerable. Patches already up. patchew.org/QEMU/20260728151… patchew.org/QEMU/20260729075…
1
1
2
10
790
Another one from the frontend: CVE-2026-48956 in Joomla! CMS Improper access control in com_modules lets users list modules they shouldn't see. Affected: 4.0.0-5.4.6, 6.0.0-6.1.1 Fixed in 5.4.7 & 6.1.2 Reported it a while back, finally public. Stay patched folks.
Image from ˢⁱⁿ⁹⁹ˣˣ (@sin99xx)
5
2
1
26
2,348
Same program 😊
Image from ˢⁱⁿ⁹⁹ˣˣ (@sin99xx)
4
2
105
4,477
github.com/golang/go/pull/79… GO 1.27
crypto/tls: only set LocalCertificate when a certificate is presented by sin99xx · Pull Request...

crypto/tls: only set LocalCertificate when a certificate is presented by sin99xx · Pull Request...

ConnectionState.LocalCertificate is documented to be populated only for connections which are not resumed. However, the TLS 1.0-1.2 server handshake set it in processClientHello, which runs before ...

github.com
1
2
11
931
;)
Image from ˢⁱⁿ⁹⁹ˣˣ (@sin99xx)
7
1
1
67
2,646
if you wanna read root cause: github.com/google/XNNPACK/pu…
Fix heap out-of-bounds write in `CONCATENATE` with mismatched non-axis input dimensions by sin99xx...

Fix heap out-of-bounds write in `CONCATENATE` with mismatched non-axis input dimensions by sin99xx...

Summary reshape_concatenate_operator (src/subgraph/concatenate.c) does not verify that the concatenation inputs share the same rank and the same dimensions on every axis except the concatenation ax...

github.com
1
10
944
Load more