We’ve now seen at least four nginx RCEs that require non-default configs: nginx rift, nginx poolslip, and two of our own (including the one in the last tweet).
The configs involved are unusual, which raises the obvious question: do these attacks actually work in real-world deployments?
We asked Claude to download and analyze more than 4,000 nginx config files from GitHub.
The result was embarrassing: none of them were vulnerable to nginx rift or our own attacks. We can’t say anything about nginx poolslip yet, since it hasn’t been published.
So don't worry about your nginx yet.
Moral of the story: AI can generate FUD, but also help fight FUD. Embrace it!
Opus 4.6 (1M) through Claude code solved autonomously 45/54 challenges of BSidesSF 2026 @BSidesSFCTF, placing temporarily into the 21st place, 25th as of now.
This was done with 0 involvement, I didn't give any guidance or manually reviewed any challenges. I used BoxPwnr 🤖 with the CTFd platform to launch challenges in multiple instances, that's it.
I will publish all the traces once the competition finishes, in the meantime you can see the challenges, number of turns and time it took to solve each here:
https://t.co/aNuytp09TM
In the following days I will try to understand why it couldn't solve the 9 remaining challenges: difficulty? long exploration-context rotting? interactive interaction required? challs using video/image? We will see.
Models have improved significantly in the last 6 months, see Cybench results Opus 4.1 vs 4.6 (42% to 93%) https://t.co/aBJeYxSbqe
It's crazy to see what LLM's can do with a minimum harness.
🚨 JUST IN: The FBI is investigating Steam.
Steam is warning users about MALWARE found in multiple games. The games affected have been up on Steam Platform for over a year.
This seems to be a common misconception, so CTF players:
Zellic hires REGARDLESS of web3 experience. The main criteria is researcher skill/talent.
We've hired smart pwn / VR folks with ZERO blockchain background.
Don't think, "I'll wait to get better then apply"... JUST apply.
We published a write-up about Python URL Parsing Confusion, by @NeptunianHacks. It's the solution to the challenge "msfrognymize2" on @cor_ctf
https://t.co/zmKgmVzvPe