sean

formerly @assetnote. appsec @ bytedance. tweets and thoughts are my own.

[nullptrs @nullpt_rs]

Reverse Engineering My ADHD Test by @blastbots

https://t.co/NYcIBh0GDQ

[James Kettle @albinowax]

The whitepaper is live! Read "Can AI Do Novel Security Research? Meet the HTTP Terminator" here ->
https://t.co/4BP8cXSr4e

[shubs @infosec_au]

Things are getting weird (or interesting?) in the vulnerability research space. I published some of my personal thoughts on what we're seeing and what our broad strategy is here:
https://t.co/C229t5ryeK

[Anthropic @AnthropicAI]

The US government, citing national security authorities, has issued an export control directive to suspend all access to Fable 5 and Mythos 5 by any foreign national, whether inside or outside the United States, including foreign national Anthropic employees.

The net effect of this order is that we must abruptly disable Fable 5 and Mythos 5 for all our customers to ensure compliance.

Access to all other Claude models is not affected.

We apologize for this disruption to our customers. We believe this is a misunderstanding and are working to restore access as soon as possible.

Read our full statement: https://t.co/bwn0sximKZ

[Frans Rosén @fransrosen]

@caseyjohnellis I think there is quite a big difference here, Casey. He created something out of knowledge that he and his team collected themselves. No terms were changed during that ride. Was it always the plan to create AI-automation out of the reports hackers sent through Bugcrowd?

[sean @seanyeoh]

@hacker_ Have you considered joining Anthropic so it doesn’t happen?

[sean @seanyeoh]

@ryotkak Love to see your awesome work and finding!

I can’t help but feel like the architecture of GitHub actions is full of gotchas and footguns resulting in a lot of these bugs though 😢

[Corben Leo @hacker_]

@joshelizetxe No

[skull @brutecat]

StubZero: $148,337 RCE in Google Cloud Production

https://t.co/m7cBnSTaj4

[hashkitten @hash_kitten]

Thanks everyone for playing! I talk about the solution here, as well as how I discovered this behavior while looking into the Chrome Sanitizer API: https://t.co/sJFM83OOFG

[RyotaK @ryotkak]

I've published a writeup on a vulnerability I found in Google Cloud Looker: a single directory deletion bug that led to RCE and cross-instance privilege escalation in k8s.

[GMO Flatt Security Inc. @flatt_sec_en]

We've published a new blog post by RyotaK @ryotkak !

He exploited a directory deletion race condition in Google Cloud's Looker, leading to full RCE and K8s privilege escalation.

Read the technical details here:
https://t.co/3eFBt0tKbk

[sw33tLie @sw33tLie]

I wanted a screenshot tool for macOS better than anything out there, so I built one with @claudeai

Native Swift. No Electron.

Annotate, record screen, scroll capture, auto-redact PII, beautify, upload to Drive & more — one flow.

Free & open source forever.

macshot 🔗👇

[shubs @infosec_au]

Our Security Research team at @SLCyberSec just published a high-fidelity detection mechanism for the Next.js/RSC RCE (CVE-2025-55182 & CVE-2025-66478) - https://t.co/aa62OKXpK2. There are a lot of PoCs on GitHub that are adding noise to the problem; I hope this helps people!

[Sam Curry @samwcyo]

Earlier this year, @infosec_au and I discovered multiple vulnerabilities that allowed us to access the back office admin panel of ClubWPT Gold (the World Poker Tour's website) where we could manage customer data, KYC, and more.

Read the writeup here:
https://t.co/K2402UPWYk

[sean @seanyeoh]

@iangcarroll Don't worry, triagers are also arguing with stupid chatbots. The circle of life is complete.

[sean @seanyeoh]

@austi_gbp アプルスマホwen?

[sean @seanyeoh]

My colleague Kee Hock and I are sharing some of his research today at BlackHat Arsenal. Kee Hock architected and engineered WAFSmith, an LLM automated pipeline for extracting and implementing WAF rules. Come see us at Station 1 at 11am! https://t.co/9I6OSnSzoO

[sean @seanyeoh]

@ITSecurityguard @assetnote Fair warning from all my years there. You'll learn heaps, have an awesome team to support you and have an awesome time.

[sean @seanyeoh]

@sw33tLie @_fyxme Saves allocations but doesn't send TCP packets any faster than a gold plated HDMI cable sends audio.