Mohamed Sayed - مُحَمَّد 🇵🇸

check @FahemSec

[Mohamed Sayed - مُحَمَّد 🇵🇸 @FlEx0Geek]

اصلح نفسك شوية تجميعات لبودكاست وسلاسل لتتعلم منها دينك.

https://t.co/L4GlTvbKXe

[Mohamed sadek @happyjester80]

1/ My first MSRC experience, documented. I reported a 1-click account takeover in Microsoft Bing for Android
steal a signed-in user's OAuth tokens and leak all private files. They closed it "Not a Vulnerability" twice, and silently shipped
the fix twice.

[حامد العلي @Hamedalalinew]

بريطانيا : تم تبرئة محمد فاهر أماز من تهمة الاعتداء المزعوم على ضباط شرطة في مطار مانشستر
فشلت هيئتا محلفين في الوصول إلى حكم، ولن تجرى محاكمة إضافية
وكان أماز قد دافع عن والدته التي تعرضت لإساءة من الشرطة في المطار ، وقد نشرنا قصته سابقا

[Mohamed Sayed - مُحَمَّد 🇵🇸 @FlEx0Geek]

@micro0x00 كلام رايق

[Mohamed Mater🇵🇸 @micro0x00]

New research disclosed
فريق Dexpose و Darkatlas
قدرنا نعمل identity reveal ل Quellostanco
عضو في Int3x
اللي كان بيتارجت الجامعات والحكومات المصرية

We successfully conducted a full identity reveal on Quellostanco, an active member of the Int3x group, who was systematically targeting Egyptian universities and government entities.
https://t.co/FR45Q1jIOC

[AbuMuslim (أبومُسْلِم) @m19o__]

رحمه الله وغفر له وجعل عمله في ميزان حسناته.

الأخ أمين حارس مسجد في سان دييجو، اسْتَشْهَدَ في إطلاق نار بينه وبين مسلحين عشان يمنعهم يأذوا حد في المسجد أو يوصلوا للأطفال في جريمة من جرائم الكره والتطرف، أخونا أمين رحمه الله بطل. قبل الاستشهاد بكام يوم نزل البوست دا، لعله كان صادقاً فيما تمنى، سبحان الله.

إِنَّ اللَّهَ اشْتَرَىٰ مِنَ الْمُؤْمِنِينَ أَنفُسَهُمْ وَأَمْوَالَهُم بِأَنَّ لَهُمُ الْجَنَّةَ ۚ يُقَاتِلُونَ فِي سَبِيلِ اللَّهِ فَيَقْتُلُونَ وَيُقْتَلُونَ ۖ

[Be5Lmt @Be5Lmt]

No quotes
No spaces
No Parentheses
No Semicolons

Still SQLi....

Collab with @or4nge16hehe

https://t.co/3sImxZUAzs

#bugbounty

[Tao Yan @ga1ois]

[2]After our failed competition, we headed to Apple Store and bought the mbp m5 and spent less than half an hour to set it up and found a fixed offset is changed 1 bit on it, so we just change 1 bit on our exp and it worked with a 100% success rate. Yes just 1 bit change, 1 to 2.

[Mohamed Sayed - مُحَمَّد 🇵🇸 @FlEx0Geek]

@moyix Is this bugs with a full exploit or it could be accepted without it.

[Orange Tsai 🍊 @orange_8361]

And this one is human insight w/ LLM-assisted research. Took about one week to finish everything. The AI really rescued me from a lot of tedious work

— excluding the part where it changed the Domain Admin password, locked me out, and claimed it got RCE 🤦

[Mohamed Sayed - مُحَمَّد 🇵🇸 @FlEx0Geek]

مش طبيعي

[TrendAI Zero Day Initiative @thezdi]

Aaaand it's official! Orange Tsai (@orange_8361) of DEVCORE Research Team chained 3 bugs to achieve Remote Code Execution as SYSTEM on Microsoft Exchange, earning a whooping $200,000 and 20 Master of Pwn points. Full win! #Pwn2Own #P2OBerlin

[Mohamed Sayed - مُحَمَّد 🇵🇸 @FlEx0Geek]

@orange_8361 very nice

[د. إياد قنيبي @Dr_EyadQun]

"ممنوع تدخل الجنة"!
ردا على المشككين في إسلام #بتول_علوش والمهتدين عموماً.
لاحظنا ان الكلمة الماضية "دعم وتأييد لبتول علوش" أثارت غير وقهر الشبيحة، فالحمد لله على ذلك. موتوا بغيظكم.

[Thai S.D @_sondt_]

😓 Pwn2Own 2026

[Mohamed Sayed - مُحَمَّد 🇵🇸 @FlEx0Geek]

الفكرة دي (لها مراحل اصعب سيكا) لكن خدت مني تقريبا ٧ ��هور بدور فيها بالتجربة (علي فترات طبعا مش كل يوم يعني):

https://t.co/eHIPDlD47G

[H4x0r.DZ 🇰🇵 @h4x0r_dz]

War criminals

[Mohamed Sayed - مُحَمَّد 🇵🇸 @FlEx0Geek]

@the_st0rm @Dinosn Thanks 🙏

[Mohamed Sayed - مُحَمَّد 🇵🇸 @FlEx0Geek]

My pwn2own first try: https://t.co/uEpEXwoX0w

[Mohamed Sayed - مُحَمَّد 🇵🇸 @FlEx0Geek]

@S1r1u5_ pwn2own lite

[Mohamed Sayed - مُحَمَّد 🇵🇸 @FlEx0Geek]

@_mccaulay nnnnice, I just reported it today to Litellm xD Nice catch. u win.

[Mohamed Sayed - مُحَمَّد 🇵🇸 @FlEx0Geek]

We are here: https://t.co/uEpEXwoX0w

[International Cyber Digest @IntCyberDigest]

‼️🚨 Pwn2Own Berlin 2026 just hit a wall. For the first time in 19-years, ZDI rejected dozens of working zero-day RCE submissions because organizers ran out of contest slots.

Rejected hackers are now going public with PoC demos and direct vendor disclosures, breaking Pwn2Own's usual secrecy.

▪️ AI surfaces a massive wave of 0-day RCEs.
▪️ Submissions overwhelm ZDI past max capacity.
▪️ Slots run out. Researchers with working chains get rejected.
▪️ "Revenge disclosures" begin. ← we are here.

Confirmed casualties so far:
▪️ @xchglabs : 86 vulnerabilities prepared (PyTorch, NVIDIA, Linux KVM, Oracle, Docker, Ollama, Chroma, LiteLLM, llama.cpp). All rejected. Now reporting directly to vendors with writeups dropping as patches land.
▪️ @ggwhyp : full-chain Firefox RCE on Windows. Rejected. Publicly demoed (HTML page → cmd.exe → calc.exe). Responsibly disclosed to Mozilla.
▪️ @yunsu_dev : working RCE chain, rejected. Submitting elsewhere.
▪️ @ryotkak : tried to register for 3+ weeks. ZDI confirmed "at maximum capacity, can't add extra contest days." Considered canceling flight and hotel.
▪️ @anzuukino2802 : Claude Code RCE PoC. Rejected.
▪️ @desckimh : 0-day RCEs in Ollama and LM Studio. Rejected.

Reported impact: a community-estimated 150+ researchers tried to register. Accepted contestants are now being warned about collisions. Rejected vulnerabilities going to bug bounty programs may trigger pre-event patches that invalidate the work of those who got in.

ZDI has not publicly addressed the capacity issue. The event still runs May 14-16 in Berlin.