Hacktron AI

Hacktron is an autonomous vulnerability hunter for ambitious engineering teams. Built by world-class security researchers. Powered by one principle: PoC || GTFO

[Hacktron AI @HacktronAI]

Introducing Hacktron Review: an AI security reviewer for your pull requests.

It understands your whole codebase, builds a threat model, takes your feedback, and catches exploitable vulnerabilities before they reach production.

Try for free: https://t.co/ZHfG7cvXRe

[Hacktron AI @HacktronAI]

🚨 PHP2Shell: two critical PHP vulnerabilities are now patched.

PHP has fixed CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2). Both can let an unauthenticated attacker run code on the server.

If you run PHP: update every runtime serving web traffic (check the version behind PHP-FPM or Apache, don’t rely on the CLI version alone), restart PHP workers, and review activity from at least 17 October onwards.

Full breakdown:
https://t.co/i1iKRJ0O5S

[Hacktron AI @HacktronAI]

bash2shell?

[s1r1us @S1r1u5_]

i think people are confusing vulnerability disclosures with active exploitation, and thats causing a lot of unnecessary panic. most of these are researchers finding and fixing bugs before someone fucks things up.

oct 21:

php2shell: disclosure, reported in august
node.js: disclosure, patched, reported around august?
gitlab: disclosure, patched, reported a few months back
railway: security breach
litellm: supply-chain compromise
sbi: data exposure
emudhra: disclosure

oct 20:

plex2shell: disclosure + active exploitation
siteguard: actively exploited vulnerability
siemens: actively exploited vulnerability

oct 19:

- ovhcloud cli: supply-chain compromise

oct 17:

- opencode: security breach

[Hacktron AI @HacktronAI]

@TimHaines its a bigger bug

[Hacktron AI @HacktronAI]

👀

[Hacktron AI @HacktronAI]

@ultima_centauri @Lovable @supabase check the date of disclosure, and check what model was it then

[Hacktron AI @HacktronAI]

We tried to hack our way into @Lovable's office to start a sales conversation.

We couldn’t break Lovable directly, so we went one layer down: @supabase.

Race condition → superuser → shell → root → the keys to other databases in the region.

$25K. Patched in a day.

The full write-up: https://t.co/9yT6hnbglD

[Hacktron AI @HacktronAI]

@sudhanshur705 this was a bypass of the fix to v12 bug below, poc is built on top of their work

[V12 @v12sec]

Saturday was national boyfriend day so we forgot to post, but here's a Libreoffice RCE

[Hacktron AI @HacktronAI]

Remote Code Execution in LibreOffice!

Update to the latest version, especially if you're using LibreOffice in web applications. We found few and reported!

[Hacktron AI @HacktronAI]

From one and only @sudhanshur705 and his agent swarms

[Hacktron AI @HacktronAI]

@b0n0b0__ @CodeanIO saw multiple cves from your team on libreoffice. very cool!

[Hacktron AI @HacktronAI]

A stranger writes a GitHub issue.

A developer clicks “Code with agent mode.”

Copilot reads the issue and does what the stranger said.

VS Code had patched this. We found a way around the patch.

Your agent can’t tell your instructions from an attacker’s.

The full breakdown: https://t.co/VPhpqQxQBv

[Hacktron AI @HacktronAI]

An attacker uploads an image. How far can they get?

One library. Slack, OpenAI, Meta, GitHub Enterprise, and more.

Our HEIF Heist research traced attack paths through libheif, a library used to decode HEIC photos.

AI is making exploit development faster. Attackers don’t wait for your next security assessment.

Read the full research:
https://t.co/Rr4eantoJn

[Hacktron AI @HacktronAI]

another one!

[Elissa Shevinsky @ElissaBeth]

I spoke with @LiveOverflow of Hacktron for a behind-the-scenes look at how they hacked OpenAI's infrastructure, what he's building with his cybersecurity education platform at @hextreeio and some very emotional personal news that he shared.

[Hacktron AI @HacktronAI]

Building a Next.js replacement in a week is impressive.

Finding serious security flaws in it is a reminder of something else:

speed and security are two different problems.

Hacktron found 24 validated issues in vinext, including 4 critical ones. @Cloudflare patched them.

AI is making software faster to build.
Security still needs to be deliberately engineered.

Full breakdown → https://t.co/JiNrdsfPy1

[Hacktron AI @HacktronAI]

No more AI. It's SI.

https://t.co/BR9ppQnet3

[Hacktron AI @HacktronAI]

Review volume grew 79% MoM in September.

More volume usually means more noise. Not at Hacktron. 86.5% of evaluated findings were actionable.

Can't get this with an API wrapper and a .md skills file.

[LiveOverflow 🔴 hextree.io @LiveOverflow]

New YouTube video! We are looking at the dependency chain and how long it can take for security fixes to travel upstream.

This is why OpenAI was vulnerable to a 1-year-old vulnerability.

[Hacktron AI @HacktronAI]

We found a flaw in Cluely.

it's built to be invisible. that's the selling point.

but think about it. an app nobody can see is also an app nobody can check.

it had your screen and your mic. one missing guard meant a single click could've handed both to a stranger. no warning, no prompt.

(found and patched back in 2025.)

AI apps are getting deeper access every month, and almost nobody reviews what they're shipping.

that's what we do. we check before it's watching you.

full breakdown here: https://t.co/h0zJhFfQa5