0x10F2C

Security stuff and shitposting; ex security consultant turned security engineer; come for the tech stay for the memes; mostly lurking 🌚

[0x10F2C @0x10F2C_]

@mncoppola Have you considered it's a skill issue TAG caught them?

Maybe, gitgud?

[0x10F2C @0x10F2C_]

@H1O Honestly this is fair, we had no idea the demand would be this big and we had to scramble to deal with the queue size.

Promise you the next one will be a much larger room where you can get as blasted as you want without needing to rotate

[rekdt @rekdt]

Pro tip: You can actually fire your entire Cybersecurity team if you just decide all your company data is public data

[goosewin @Goosewin]

when you ask a vibecoder what they've actually built and they hit you with that trillion token stare

[Swizec Teller @Swizec]

Leadership: "AI is so good it writes almost all our code"

Status dashboard:

[cinesthetic. @TheCinesthetic]

A canned coffee ad set in the world of David Lynch’s Twin Peaks—aired only in Japan.

[Graham Helton (too much for zblock) @GrahamHelton3]

Excited to disclose my research allowing RCE in Kubernetes

It allows running arbitrary commands in EVERY pod in a cluster using a commonly granted "read only" RBAC permission. This is not logged and and allows for trivial Pod breakout.

Unfortunately, this will NOT be patched.

[0x10F2C @0x10F2C_]

@I_Am_Jakoby Lawyers love this one defense

[0x10F2C @0x10F2C_]

@Syren_AD @I_Am_Jakoby Wowzers @FBI keep an eye on this badass

[Tas Gunner @GunnerTas]

You could move to Queenstown, Tasmania and get a job at the copper mine making $25 an hour to start, meet a nice girl at the Empire Hotel and take her on a date to The Gravel Oval, and get married and raise up seven children in this house but you will not do it.

[Jeremy. @TheJeremy__]

DON'T DRINK THE HOPIUM!! They put something in it to make you forget

[Blight Yoakam @BlightYoakam]

sunn O))) just confirmed Half Life 3

[alexander the pretty good @vaudevillehook]

Women today: men used to go to war

Men at war: this is hell, I hope no one ever has to go to war again

Men at work: I come from a land down unda

[Peter Girnus 🦅 @gothburz]

Someone found an RCE on my website yesterday.

CVE-2025-55182.

React2Shell.

I don't have a bug bounty program.

I never asked for a security assessment.

I woke up to a DM: "Hey I found a critical vulnerability in your site. I only ran the exploit to verify it worked. Here's my PayPal for the bounty."

Bounty?

I checked my logs.

Forty-seven requests to my RSC endpoint.

Something, something ... Prototype pollution payloads.

They used the GitHub script.

The one with 2,000 stars.

The one that runs id automatically "for verification purposes."

They spawned a shell on my production server.

uid=1001(nextjs) gid=65533(nogroup)

They took a screenshot.

They posted it on Twitter.

"Popped a Shell on a Live Website 🚀💀 #BugBounty #CVE-2025-55182 #YOLO"

They got 84781 likes.

My customers' data was on that server.

I asked them to delete the screenshots.

They said "I removed the domain name, you should be thanking me."

Thanking them.

For unauthorized access to my production infrastructure.

For running arbitrary commands on systems I own.

For posting proof of exploitation for clout.

They called it "responsible disclosure."

I called my lawyer.

They called me "ungrateful."

I called the FBI.

Now they're in my DMs explaining that "this is how the industry works" and I "don't understand pen testing."

A pen what?

I understand it perfectly.

I understand that running https://t.co/C6kmBequB5 against random websites isn't research.

I understand that "I removed the identifying info" doesn't undo the unauthorized access.

I understand that #BugBounty doesn't apply when there's no bounty program.

I understand that finding my site on Shodan doesn't constitute authorization.

Their followers are defending them now.

"Presumption of innocence."

"You don't know if it was authorized."

"The screenshots were redacted."

Three hundred people are calling me a bootlicker for reporting a crime.

Someone said I should be grateful they didn't deploy a cryptominer.

The bar is underground.

I just wanted to run a small Next.js app.

I didn't ask to be someone's proof-of-concept.

I didn't consent to being their "first"

I didn't sign up for an unscheduled penetration test from a stranger with a GitHub account.

There is no safe harbor for spraying public exploits at random websites.

There is no legal protection for "I was just verifying the vulnerability."

There is no ethical framework where unauthorized prototype pollution is a favor.

But sure.

Thank you for your service.

You found a CVE that was already public.

Using a tool someone else wrote.

Against a target that never authorized you.

And you posted about it on main.

For likes.

Hero.

[0x10F2C @0x10F2C_]

@gothburz Supreme pasta

[René @schizohustler]

saw a girl post her spotify wrapped with the caption "so accurate" like yeah it's literally data you stupid bitch

[Pamphlets @PamphletsY]

🚨🇰🇵 — The DPRK Executed 67 Youths for playing League of Legends.