LemonTea1014

Student / CTF player / Developer / Cybersecurity / Reverse / Web exploitation

[李老师不是你老师 @whyyoutouzhele]

大疆举报黑客大赛，主办方怒斥：“没见过你这么傻逼的人”

10月24日，上海GEEKCON安全极客大赛期间，组委会主席王琦针对大疆举报事件在现场怒斥：“我做了这么多年，我没见过你这么傻逼的人！”

据红客博主“开心鸭”同日发文，一家国内头部无人机厂商以“非法黑客教学、教唆破解”为由报警，参会人员和裁判被带走，活动一度暂停。

网络安全专家谭晓生表示，赛事不会公开漏洞细节，甚至没有点名被破解设备的厂商。他批评：“不解决问题本身，把发现问题的人解决成了不少企业的‘最佳实践’，真是悲哀！”

主办方当晚已发布上海站闭幕消息。

[LemonTea1014 @LteaaR1014]

This is an RCE with ASLR off this is the demo video

[LemonTea1014 @LteaaR1014]

I successfully get the NGINX CVE assist by my AI and I am happy for that : )
CVE id : CVE-2026-93479

[LemonTea1014 @LteaaR1014]

I successfully get the NGINX CVE assist by my AI and I am happy for that : )
CVE id : CVE-2026-93479

[ManQiu @ha1c9on]

感觉这个php的洞没有想象的夸张, 需要display error leak aslr地址, 需要远程偏移,需要mem_size限制, 不知道怎么传成天大的洞了
我复现了半天也没通杀

[Kirill Firsov @k_firsov]

php2shell

Tomorrow is a helluva day.

[Mochii @mochii_237]

#ArknightsEndfield #Si

[maimai でらっくす公式 @maimai_official]

【WEC2026決勝楽曲が登場！】
「WEC2026」maimai でらっくす（舞萌 DX）部門
最終決勝戦の課題曲に、世界最速公開の新曲が登場！！

🪄 魔法仕掛けのファンタジア
Music：igel
Movie：いそにん

こちらの楽曲は、近日『maimai でらっくす MAGiCAL』に収録されます。お楽しみに！

[ハル @haku_kt2]

これキスだと思うじゃないですか。

修復魔法なんですよ。

[TVアニメ「きみが死ぬまで恋をしたい」公式💐 @anime_kimishinu]

TVアニメ「きみが死ぬまで恋をしたい」
　˗ˋˏ💐応援イラスト第12弾公開💐ˎˊ˗

✼••┈┈┈┈

　竹嶋えく 先生（@takeshimaxfj）

　　　　　　　　　　┈┈┈┈••✼

毎週放送翌日に豪華作家様からの
応援イラストを公開！
第12弾は竹嶋えく先生です✨

#きみ死ぬアニメ

[Orange Tsai 🍊 @orange_8361]

It’s gonna overflow!

[Chumy @rm_rf_chumy]

I will talk about something cool that I found at SharePoint in Blue Hat Asia this year.

[LemonTea1014 @LteaaR1014]

HITCON

[堇姬 Naup @naup96721]

I found a linux kernel 0 day and get root shell : ). This is the first time I successfully achieved LPE. I reported it to the Linux Kernel Security Team today. When it has been patched, I’ll publish the full research record on my blog.

[NebuSec @nebusecurity]

Here goes nginx-quicburst (CVE-2026-42530), a new RCE in Nginx discovered by our security agent VEGA and demonstrated by Nebula Security.

This is only the third NGINX vulnerability since 2014 to receive NGINX’s “major” severity rating. If you use Nginx 1.31 with QUIC enabled, we recommend upgrading to the latest version.

This bug has been patched in the latest Nginx release. We will publish the technical writeup, including the ASLR bypass, on July 18 together with the previous nginx-poolslip writeup.

[Abdelhamid Naceri @MSNightmare2000]

@msftsecresponse Guess I'm not invited :(

[sakura @eternalsakura13]

https://t.co/MpGv3tujMe

[Chumy @rm_rf_chumy]

Love that MSRC pays the same bounty as Pwn2Own. ❤️

[堇姬 Naup @naup96721]

Thanks all Orange Fan Club teammates on DEFCON CTF!
And also thanks BBB create so many fun challenges ~

[Orange Tsai 🍊 @orange_8361]

And this one is human insight w/ LLM-assisted research. Took about one week to finish everything. The AI really rescued me from a lot of tedious work

— excluding the part where it changed the Domain Admin password, locked me out, and claimed it got RCE 🤦