Jon Gaines

Head of Offensive Security @ Anduril; Adjunct Instructor at HCC by day. Hacker & Founder by night. 50 CVEs. Husband. Father. Skateboarder. Posts are my own.

[Jon Gaines @GainSec]

On September 16, 2026, @WIRED and @404mediaco reported on leaked Flock Safety LPR firmware, later distributed through DDoSecrets. I reviewed the supplied Falcon/Sparrow image to verify remediation of my previously disclosed vulnerabilities. The results may or may not shock you.

Paper: https://t.co/cc2e9hTNPO

[noclipepe @noclipepe]

I made a loading bar you can't stop watching

[Meng To @MengTo]

I turned my apartment into a three.js scene with Opus 5.5 so I can record videos for my tutorials.

It's fully interactive and you can walk through it in the browser. You can change the lighting and set different render styles. All objects are code using the scoring system.

[FinkTheArtist @crtvTeknologist]

Password strength indicator. Made with Fable 5.2

[Swissky @pentest_swissky]

Automating AI Hacking with Tree of Attack - John Stigerwalt @WKL_cyber
https://t.co/2f3ySftb34

[Luke Stephens (hakluke) @hakluke]

https://t.co/pCRw5zT7ct can be super useful for bypassing filters to exploit SSRF vulnerabilities.

<anything>.<IP>.nip.io will redirect to the <IP> you specify.

For example:

https://t.co/A3wDmxpYJ2 will resolve to 1.1.1.1

Make sure your hackbot (and you!) knows this!

[Gergely Kalman @gergely_kalman]

New macOS LPE

[Jon Gaines @GainSec]

@Mdannemi43 Nice approach! Excited to see it. Will have a new version of the autoprober released sooner or later! Check it if you haven’t heard of it

[QuestionMark @Mdannemi43]

My goal is to make an Agentic PCB Test platform for less than $1000

[あぶち🍣 @abricheese]

Codex × Rokid朝活
XREALみたいにスマホやPCの画面を映すようにしてみた！

単色&解像度低いRokidだけど、意外とちゃんと見えるので、飛行機とかで漫画読むには十分かも？

[Wilson @mtoolstec]

My first 'FlipperOne' on CardpuerZero by @M5Stack. It's a monitor on the 8899 port via Ethernet or Wi-Fi.
And made a ADS-B App on FlipperZero with RTL-SDR V4.

[Jon Gaines @GainSec]

Couldn’t read any of my notes and completely bombed my Def con main stage talk but if you want to watch it anyway it’s finally on YT https://t.co/m6DMuwcGlE

[Jon Gaines @GainSec]

@_colonel_panic Lots of spots open at Anduril on my team and across the org

[19th Century in Color @19thCenturyPh]

Washington D.C. during the Civil War, United States (1862) 🇺🇸

[Owen Carey @owenthcarey]

Me explaining how my app works after vibe coding the entire thing.

[Jon Gaines @GainSec]

@NVIDIAGeForce @MiaAI_lab #RTXON

[NVIDIA GeForce @NVIDIAGeForce]

We're giving away a Hogwarts Legacy custom wrapped NVIDIA GeForce RTX 5090 to celebrate its official release with DLSS 5 🪄

To enter:
🟢 Share this post
🟢 Comment #RTXON

Terms and Conditions: https://t.co/45T3R732hf

[Florian Roth ⚡️ @cyb3rops]

I initially thought “RCE in Paint” meant tricking someone into opening a crafted image, and my confusion was just about terminology.

But Microsoft lists AV:N / UI:N. The FAQ describes sending a crafted packet to an “affected service”, with no user interaction.

Which service? How does that packet reach Paint and trigger code execution without anyone doing anything?

I really hope this is just an error in the advisory…

https://t.co/rTBO5WL23g

[lagz @lagz152507]

In the the electronics district of Tokyo, components as far as the eye can see!

[colonel panic @_colonel_panic]

A wild oui-spy-recon appears. Coming soon. https://t.co/CKa9DzamDU

[奶昔🥤 @realNyarime]

红米k20pro已成功实现iOS+Android+Windows 三系统永久共存并互相切换，差个鸿蒙就可以四系统了