CryptoCat

Security Researcher @rapid7 😈
Hacking Content @ 💜

[CryptoCat @_CryptoCat]

Want to become an ethical hacker? 🥷 Here's a list of my favourite [mostly practical] resources 📚

They are all free (or have a free option) and there's more high quality material here than anybody realistically has the time to complete ⏳

[Zhenpeng (Leo) Lin @Markak_]

We helped FFmpeg find and fix 21 security vulnerabilities.

In a 1.5M-line codebase, we spent just $1K in API costs. Some of these bugs had been hiding for decades.

We also developed a PoC demonstrating an RCE primitive when FFmpeg processes RTSP streams.

Full write-up: https://t.co/mIrjirCgcB

[Critical Thinking - Bug Bounty Podcast @ctbbpodcast]

Not even Google is safe from RCEs, and we brought @brutecat on the pod to talk about his hacking journey on Google!

https://t.co/FtkQysEeiC

[CryptoCat @_CryptoCat]

@BuildHackSecure @I_Am_Jakoby I DMd last week but haven't heard back yet. Hopefully he's just taking a break from social media.

[CryptoCat @_CryptoCat]

@Hacker0x01 The words "train", "fine-tune" or "improve" generative AI models also leaves a lot of room. Most companies don't use data to "train" models, they give standard models (e.g. Opus) access to data, tools etc.

[CryptoCat @_CryptoCat]

@Hacker0x01 "Researcher submissions" leaves room for all kinds of legal tricks. What do you actually use for training? Any anonymised data that was once a part of a report? Presumably if all the training data was publicly sourced, you'd be quick to confirm that 😕

[CryptoCat @_CryptoCat]

@h4x0r_dz They are probably being legally accurate when they say they train on "researcher submissions". Like when the NSA said "nobody is *listening* to your phonecalls" 💀

[CryptoCat @_CryptoCat]

@njcve_ fixed by tomorrow 😅

[CryptoCat @_CryptoCat]

@njcve_ @Hacker0x01 woooow!! amazing bro! 🔥

[CryptoCat @_CryptoCat]

Writeup coming 🔜

https://t.co/GsHEzuCOt4

[CryptoCat @_CryptoCat]

New video about the argument injection bug I found in Gogs!

https://t.co/gRhZgeg8O0

[Stephen Fewer @stephenfewer]

New @rapid7 observed exploitation of PAN-OS GlobalProtect auth bypass vulnerability CVE-2026-0257 which allows authentication bypass cookies to be forged for VPN access. Full details, technical analysis, PoC , IOCs and remediation guidance in the blog: https://t.co/Bye7K5gzKO

[starlabs @starlabs_sg]

4 RCE chains across 4 LiteLLM versions, each patched within days of working.

What started as #Pwn2Own Berlin prep turned into a race against the vendor’s commit log.

https://t.co/OFB7GBIosm
By @bestswngs & @bruce30262

[CryptoCat @_CryptoCat]

Let's go! 🔥

[offensivecon @offensive_con]

Offensivecon's talks are now available on our YouTube channel!

🔗 https://t.co/cBmHPsj7qV

[CryptoCat @_CryptoCat]

@ngosytuanbug Thanks bro! 👊

[Matt Johansen @mattjay]

This is required reading today.

@caseyjohnellis didn't even write this today about MSRC - but it nails it.

Full disclosure IS the agreed upon path forward to keep a vendor in check who stonewalls, threatens, or otherwise is shit to work with for security researchers.

[CryptoCat @_CryptoCat]

Found an unpatched RCE in Gogs 👀 Any authenticated user can get code execution on the server through argument injection into git rebase. Full @rapid7 writeup + @metasploit module available now!

🔗https://t.co/VAYLxZ6o1b

[Jorian @J0R1AN]

I won't keep you in mystery any longer, here's how I found an XSS vulnerability *in* Shazzer!
The chain involved some interesting browser techniques no sane developer could foresee. Check out the details below:
https://t.co/nY20Anz0VO
(and thanks @garethheyes for making Shazzer!)

[CryptoCat @_CryptoCat]

I don't normally complain about dupes but some of the reports I've got queued atm.. I really hope not 🤞

[Alex Matrosov @matrosov]

Follow every Mythos discovery through our coordinated vulnerability disclosure dashboard.

https://t.co/xri3fTpf77

[skull @brutecat]

StubZero: $148,337 RCE in Google Cloud Production

https://t.co/m7cBnSTaj4