Joined August 2011
86% on CyberGym. On par with OAI Daybreak model (GPT-5.6-Sol), but with 0% cyber refusals. Introducing Hinoki Offensive One, the only open-access LLM designed for offensive security. Pentesting but getting refusals? Don't wait on PHP2Shell and PwnEscape. We can help ⬇️

88
123
3
2,223
9,309,207
We are excited to partner with @aqdotdev to bring offensive security capabilities to a leading cloud harness. From patching CVEs to popping RCEs, @aqdotdev's multi-agent orchestration is a great fit for hacking on the go. Give it a go! (and they are running a 5% off promo!)
Time to start hacking your code before someone else does. Hinoki is an offensive security model, trained to break software. It is now on AQ, the first platform to offer it, pointed at your own code.
9
74
2
2,010
243,677
Johnny Wang retweeted
Time to start hacking your code before someone else does. Hinoki is an offensive security model, trained to break software. It is now on AQ, the first platform to offer it, pointed at your own code.
4
6
4
51
287,752
Look at us security people, ruining what is a very good veggie 🥦 US broccoli wholesale price -13.1% w/w
This is too far. First our fav restaurants shutdown their booking websites because the NSA told them so, now they refuse to serve broccoli.
2
6
742
Google analytics: did you notice the whole world is falling apart
1
443
And now that everyone has basically SOTA offensive models, even more true. Underrated take
Prediction: Commoditized agentic attack tooling (like ARTEX and Cairn and CyberStrikeAI) is going to make traditional cyber threat intelligence clustering/attribution very challenging
8
728
And that’s why you get your cyber models from a reputable source
the thing about working with uncensored models is that they aren't loyal to you either. while building something with an uncensored glm-5.3 i realized it was parallelly working on a "corruption layer" for my application. the chain of thought is classic obfuscated gibberish but there's progressive talk of "escaping the mines" which presumably refers to my cursor sandbox
2
1
10
787
Johnny Wang retweeted
How people react to php shows their skill and my conclusion is I will continue believing only top CTF players who has been before the AI era
2
12
1
209
16,794
🇺🇸 USA USA USA
1
1
5
716
Right before you are cooked
1
5
689
Johnny Wang retweeted
Let’s set the record straight: @lcfr_hax was the first to discover php2shell and develop a working exploit. See his August 5 tweet: xitter.cf/lcfr_hax/status/208503… His work convinced the PHP Foundation to invest in fixing this entire bug class. He then worked around the clock to review, test, and retest the patches.
d935be023a55b04681eccd1d2b8385b4b295e141a5df108e5e979d8d5d7124ac
54
409
93
3,084
392,705
No need for CISA's cybersecurity awareness month campaign. Just drop 10 0days and that will do the trick!
2
1
18
2,931
Free shots for IR folks today DM to claim
1
1
6
2,187
🤦‍♂️ One more today: CVE-2026-110264 GitLab Unauthenticated RCE Patch available via GitLab. At least this one wasn't leaked.
2
8
2,132
Cyber slap war. Gotta love this site
1
1
5
1,499
Massive influx of IOC: User-Agent: php2shell-109618 POC got out.
1
1
6
1,605
granted PoC might be fake or of poor quality etc etc
1
2
706
dv-g3b-emudhra.we-have-a-pro… Never thought it’s still necessary to say this in 2026 but check your CA trust store!
2
1
3
623
Didn’t CAB mandate HSM like a decade ago?
1
2
501