S1uM4i

F4k3 S1uM4i

[S1uM4i @S1uM4i]

@nebusecurity PSA-2026-00043-1

[S1uM4i @S1uM4i]

@spendergrsec What about this novel Black Hat USA talk: https://t.co/36zHgB4kDQ

[S1uM4i @S1uM4i]

@nebusecurity @gork
Is this real?

[S1uM4i @S1uM4i]

@uglybyte @TheHackersNews Hi sorry I edited the post so I posted a new one
Thanks for your attention still!

[S1uM4i @S1uM4i]

Normally LFI itself === RCE

Clearly both @TheHackersNews and the author of this "exploit" are COMPETELY IGNORANT of both binary and web security to publish such an absurd post

Now any script kiddy can come up with a ridiculous assumption using AI and put on a show. how pathetic

[Yanir Tsarimi @Yanir_]

ASLR bypasses for those are pointless. There are no real Nginx instances vulnerable because that configuration pattern never exists.

Let alone “chaining LFI”; if you can read files on the host you’ve already won. Cut the FUD for no reason.

[S1uM4i @S1uM4i]

From PoC to REAL end-to-end exploit with ASLR enabled in normal userspace/V8/Kernel, say hi to the first real Automatic Exploit Generation?

[AISecHub @AISecHub]

Can AI Agents Turn Security Vulnerabilities into Real Attacks? https://t.co/I5R4vMJ7FT

[S1uM4i @S1uM4i]

@calif_io This CVE allows for controlled overflow lengths, since Nginx is forked, one can precisely determine the ASLR offset by sending a maximum of 4.5 * 256 requests.
The fact that you were UNABLE to discover a vulnerability capable of bypassing ASLR does not mean that others cannot.

[S1uM4i @S1uM4i]

ISCC/蓝桥一直是黑名单，自己保研/评奖需要自己浪费时间玩玩讨业外的评委开心就好，真把 ISCC 参赛写 CV 里在 S1uM4i 眼里是绝对的黑历史。

[galaxy @galaxy1025850]

网安这一块最垃圾的大学生比赛：A类竞赛ISCC。
1、数据安全赛的数据没去标签，导致规则过滤直接100%准确率，赛方根本不知道怎么办直接装死
2、CTF赛有分级评分 但服务器爆炸只有北理工校内可以打，一大堆人交了198围观京爷打比赛预定一等奖
3、校赛flag直接卷飞了，二道贩子两块卖全套
4、...

[S1uM4i @S1uM4i]

Besides, if an attacker can already reach eBPF, the real target is usually the verifier (to help):
Break an assumption (with a seprate bug or CFH) then use maps to easily get kernel arbitrary R/W and PC control.
JIT spray is the long way around for eBPF. PLZ play it in cBPF.

[S1uM4i @S1uM4i]

Baffling BH US 26 talk:
The threat model looks absolutely absurd as bpf_jit_harden=2 already has an decent bypass https://t.co/rCnIQMj23I
Also BPF_PROBE_MEM32 is on the eBPF path so normally it needs root privilege (CAP_BPF)
How did this considered as a "breakthrough"?

[S1uM4i @S1uM4i]

非常抽象的BH 26：
把早被kctf打烂的东西说成有效保护，然后用root特权(CAP_BPF)搞个绕过出来说是breakthrough...也是没谁了

而且真能打到控制流和eBPF的话走map拿任意读写会比shellcode稳定好用的多，更别说liona24早用cBPF都造出one_gadget了（虽然为了99%稳定多些依赖，但是并非不能去掉）。

[S1uM4i @S1uM4i]

Baffling BH US 26 talk:
The threat model looks absolutely absurd as bpf_jit_harden=2 already has an decent bypass https://t.co/rCnIQMj23I
Also BPF_PROBE_MEM32 is on the eBPF path so normally it needs root privilege (CAP_BPF)
How did this considered as a "breakthrough"?

[S1uM4i @S1uM4i]

@hyprdude https://t.co/kSo3S9R100

[S1uM4i @S1uM4i]

@hyprdude plz do NOT call the name of a stolen tech: https://t.co/wJ1CZ0Gv6u

[S1uM4i @S1uM4i]

@xvonfers Is vpu trully accessable though a normal APP (even with some media-parsing helper)?

[S1uM4i @S1uM4i]

@iAmThePr0blem Rejected. Is this position only available to candidates with certain citizenships?

[S1uM4i @S1uM4i]

@iAmThePr0blem Applied, thanks for sharing the role!

[S1uM4i @S1uM4i]

@arttnba3 TelnetJack! TelnetJack!

[S1uM4i @S1uM4i]

CCS 2026 PDF 恶意下载 exp：
看了眼hotcrp源码，利用很简单只需要在参数后面加
?docid=序列号
就可以下载所有人的论文了
问题是查询没加其他约束，直接全局查docid，然后docid又是递增的序列号，就可以用任意一个合法的paperid的权限查所有人提交的论文
patch就是限制查询范围必须是自己当前的paper

[S1uM4i @S1uM4i]

hotcrp arb file read exploit:
① Register a submission
② Upload any file, view it
③ Add `?docid=2` (change 2 to any number, it's a sequence number start from 2)
And you will be able to read *every* submisson pdf, including others and history version
The bug was patched at v3.2

[S1uM4i @S1uM4i]

hotcrp arb file read exploit:
① Register a submission
② Upload any file, view it
③ Add `?docid=2` (change 2 to any number, it's a sequence number start from 2)
And you will be able to read *every* submisson pdf, including others and history version
The bug was patched at v3.2

[S1uM4i @S1uM4i]

@gf_256 Seems vibe don't mind using strcpy from argv to stack at all: https://t.co/ZbYU2ieqrS