dmatrix

[Harsh Jaiswal @rootxharsh]

When Your VPN Opens Your Private Network to the Public!

An auth bypass in Palo Alto PAN-OS CAS Auth (CVE-2026-0265) that lets an attacker connect to the company's GlobalProtect VPN.

Blog - https://t.co/xMBbKC60NZ

[bugcrowd @Bugcrowd]

The 2025 Ingenuity Awards are officially in the books, and what a lineup. 🎉

This year’s winners embody the curiosity, skill, and collaboration that make the Bugcrowd community so powerful. From groundbreaking research to inspiring leadership, they’re shaping the future of security every day.

Your 2025 winners:
🎖️ Global Security Impact Award: @TMobile
🎖️ Breakthrough Hacker: @hbenja_m
🎖️ Top P1 Hacker: @priyanshu_xo
🎖️ Top Pentester: @nerdwell
🎖️ Community Leader: @sw33tLie

Congrats to each winner, and thank you to every customer, hacker, and community member who makes the Bugcrowd ecosystem thrive. You’re the reason these awards exist: https://t.co/kHP4kEimSF

[bugcrowd @Bugcrowd]

Let’s hear it for Bugcrowd’s Top P1 Hacker of 2025… priyanshuxo! 👑👏

This title is so much more than a badge. It celebrates the quiet grind behind every critical find. Long nights, dead ends, and countless hours dissecting complex systems… all fueled by curiosity and the drive to make the internet safer. ⚔️

P1s can run, but they can’t hide from priyanshuxo. He turns hidden bugs into major wins. Thank you, priyanshuxo. Your persistence and brilliance push the entire community forward. 💫

Learn how he got started and what makes him unstoppable: https://t.co/f4syQyj2RG

#Bugcrowd #IngenuityUnleashed #IngenuityAwards

[dmatrix @DMatriX503]

Train no. 22425. Delayed for more than 5 hours . I think i am going to miss my flight

[dmatrix @DMatriX503]

If even premium trains like #VandeBharat can't run on time, what hope do passengers have? Chronic delays, zero accountability. @RailMinIndia @IRCTCofficial — is punctuality no longer a priority? #TrainDelay #IndianRailways

[James Kettle @albinowax]

When HTTP/1.1 Must Die lands at DEFCON we’ll publish a @WebSecAcademy lab with a new class of desync attack. One week later, I’ll livestream the solution on air with @offby1security! You’re invited :)
https://t.co/BPt0h0YiN2

[dmatrix @DMatriX503]

@IntelSecurity @IntelSecurity
,
@intigriti
, I'm recommending
@nahoragg

#KnightsOfElektron #ProjectCircuitBreaker #sweeps #1337UP1023 #hackwithintigriti

[Peter Wang 🦋 @pwang]

Um... I just had like a 20 minute conversation with ChatGPT about the history of modern physics. If I had this shit as a tutor during high school and college.... OMG.

I think we can basically re-invent the concept of education at scale. College as we know it will cease to exist.

[dmatrix @DMatriX503]

@haxor31337 You can also try default Zabbix admin credentials on the API, Admin:zabbix & bag another RCE 😁

[dmatrix @DMatriX503]

@DrAzureAD @nahoragg oh Bhai !! Nice 👍

[dmatrix @DMatriX503]

@immunefi @PwningEth @MoonbeamNetwork @immunefi wow!! Big payouts there. Are the rewards all in cash or digital crypto currency ?

[Pomme @pxmme1337]

@MrTuxracer I'm at around 54% 🤪 🇫🇷

[dmatrix @DMatriX503]

@xnwup @Hacker0x01 @martenmickos Punish youself not his guy. Go Donate all the money that you ever collected from Russian linked companies/investors/bounties to UNICEF.

[dmatrix @DMatriX503]

@xnwup @Hacker0x01 @martenmickos was this decision even made in consent with companies that actually payed these bounties. You should fix this.

[dmatrix @DMatriX503]

@xnwup @martenmickos that is un-acceptable. This is not a good idea. You should come with something else.

[Kostas @Kostastsale]

I usually make short-form satirical videos for fun, but never share them with the world. This time tho, I thought I'd make one for the infosec community. Some might even find it educational 😅

If you're in #infosec and you feel a little down this week, this video is for you💙

[Ben Sadeghipour @NahamSec]

A while ago I had the pleasure to sit down with @jackhcable to learn about his background, hacking the @DeptofDefense, working with CISA and more!

Full interview 👇https://t.co/tqGoUPEQ4P

[Clint Gibler @clintgibler]

🔥 Ghostbuster: new tool to eliminate subdomain takeovers

Enumerates all elastic/public IPs for AWS accounts you own, & checks if there are DNS records pointing to elastic IPs you don’t own.

Code: https://t.co/FlvdCBSoFj

By @infosec_au & @assetnote

https://t.co/QYz76vQk16

[BugBountyHQ @BugBountyHQ]

@stokfredrik If you don't have perseverance, forget Bug Bounties. Sometimes days spent on a target - no results, u find a great bug, turns out its a dupe, u find a great bug but takes months to be paid on. All these & more will drag u down. With perseverance you will get over it and succeed.

[Philippe Harewood @phwd_]

Instagram SSL pinning bypass: Frida

okay = Module.getBaseAddress("FBSharedFramework").add(0x0a8b1c); patchsize=4; Memory.patchCode(okay,patchsize, code => {con
st cw = new Arm64Writer(code, { pc: ayy });cw.putBytes([0x60,0x0D,0x00,0x54])})

*find the correct offsets in assembly