ob

Ethical Hacker - Web & Mobile Apps | Electrical & Electronics Engineer

[ob @0xb3d_]

Another day to write exploits for breakfast.

[ob @0xb3d_]

@kwekutech what about the vibe coders ?

[ob @0xb3d_]

@TheDumbTechGuy it's a skill issue 😅

[Modat @modat_magnify]

CVE-2026-44578 
⚠️ Next.js – WebSocket Upgrade SSRF (CVSS 8.6) 

A server-side request forgery vulnerability in Next.js allows unauthenticated attackers to force self-hosted instances to make internal HTTP requests via the WebSocket upgrade handler. 
By sending a crafted absolute-form HTTP request with Upgrade: websocket headers, attackers can access internal services, cloud metadata endpoints, admin panels, and internal APIs reachable from the Next.js server on port 80. Successful exploitation may expose cloud credentials, API keys, secrets, and configuration data. 

Affected: Next.js 13.4.13+, 14.x, 15.x <15.5.16, 16.0.0–16.2.4 

Mitigation: Upgrade immediately to 15.5.16 or 16.2.5.  

Modat Magnify Query: 
technology="Next.js" 

The platform: 
https://t.co/qJfEh7giE9 

#threatintel #vulnerability #CVE202644578 #Nextjs #SSRF #WebSocket #CloudSecurity #infosec #Critical #ModatMagnify

[ob @0xb3d_]

@TheDumbTechGuy majority of developers were not that really good to begin with it

[ob @0xb3d_]

@TheDumbTechGuy majority of developers were not that really good to begin with it

[ob @0xb3d_]

@hackSultan Guys the whole point of building software in public is so it could be scrutinize it, critiqued and shamed if it deserves it. If you can't take it and learn to grow from it then why the hell are you showing it to us. You want a pat on the back for writing terrible code ?

[ob @0xb3d_]

@hackSultan Guys the whole point of building software in public is so it could be scrutinize it, critiqued and shamed if it deserves it. If you can't take it and learn to grow from it then why the hell are you showing it to us. You want a pat on the back for writing terrible code ?

[𝐚𝐢𝐤𝐢𝐧𝐬 @aikins01]

no acl😅

[Ananay @ananayarora]

Marcus Hutchins, the guy famous for stopping the WannaCry Ransomware, probably has the best take on Mythos doing vulnerability research

[ob @0xb3d_]

@TheDumbTechGuy You mean "prefrontal cortex" rather

[ob @0xb3d_]

Building well requires knowing how systems fail.
Exploiting well requires knowing how systems are built.

[Anthropic @AnthropicAI]

Mythos Preview has already found thousands of high-severity vulnerabilities—including some in every major operating system and web browser.

[Anthropic @AnthropicAI]

Introducing Project Glasswing: an urgent initiative to help secure the world’s most critical software.

It’s powered by our newest frontier model, Claude Mythos Preview, which can find software vulnerabilities better than all but the most skilled humans.
https://t.co/NQ7IfEtYk7

[ob @0xb3d_]

use-after-free bug in CSS, but you wouldn't know how that works because let's be honest you stopped learning as a programmer ages ago, and joined SamGPT's cult and offered your soul to LLMs, offering prayers to them to help you write simple lines of code.

[ob @0xb3d_]

@_yogr Need one asap bro

[ob @0xb3d_]

In other words, programming is constructive mathematics that runs on silicon instead of chalkboards

[ob @0xb3d_]

Programming is basically doing math with your hands: every function is a tiny constructive proof, and every algorithm is just you nudging data until a theorem becomes true in memory

[brCTF Ghana @brCTF]

3 days to go!
Are you ready to crack the code and prove your skills in the qualifiers?
Only the best will advance.
Mark your calendars
#brCTF2025
#OsagyefoEdition
#DigitalSovereignty
#CaptureTheFlagGH
#NSCAM2025

[ob @0xb3d_]

Hmm, but there is a paradox i think. The code is supposed to be the expression of the human intent, but also where the ideal intent can get lost or mistranslated since we humans are fallible.

[ob @0xb3d_]

I've spent great deal of months pondering on a particular question "What is a vulnerability in a software?"

This is the definition I could come up with:

"A vulnerability is a condition where the actual control or data state violates the implicit human-level contract."