splitline 👁️🐈‍⬛

友民党 / CTF with ${cYsTiCk} / @D3VC0R3 / Tâi-gí, zh-TW, en-US, es-PY / 🐈‍⬛

[Leige @LeigeSee]

阿迪的“进城办事”彻底火了！

起因是，阿迪天猫店里一件夹克的介绍里，原本英文的“running errands in the city”，不知道运营用了哪家的AI，给翻译成了“在城里办事”

结果，商品介绍就成了：“穿上这件adidas外套，搭配T恤去健身房，或者搭配牛仔裤，在城里办事”。。。

然后，这个在城里办事就被各种玩梗，成了全网狂欢。

Adidas官方也不甘示弱，直接出了“进城办事”T恤，把adidas几个字母都给换成“进城办事”了😆

[TrendAI Zero Day Initiative @thezdi]

That's a wrap on Pwn2Own Berlin 2026! 🏆 $1,298,250 awarded. 47 unique 0-days. 3 days of absolute chaos. And talk about main character energy - congrats to DEVCORE for claiming Master of Pwn with 50.5 points and $505,000 - they never slowed down. See you next year! #Pwn2Own #P2OBerlin

[TrendAI Zero Day Initiative @thezdi]

Booyah it's been confirmed! 🎉 splitline (@_splitline_) of DEVCORE Research Team chained 2 bugs to exploit Microsoft SharePoint, earning $100,000 and 10 Master of Pwn points. Massive aura farming this year at #P2OBerlin. Full win! #Pwn2Own

[splitline 👁️🐈‍⬛ @_splitline_]

pure logic bug chain to pwn browser
no memory corruption
found without AI assistance

🍊 is built different omg

[TrendAI Zero Day Initiative @thezdi]

Confirmed! Orange Tsai (@orange_8361) of DEVCORE Research Team (@d3vc0r3) chained 4 logic bugs to achieve a sandbox escape on Microsoft Edge, earning $175,000 and 17.5 Master of Pwn points. Full win! #Pwn2Own #P2OBerlin

[HexRabbit @h3xr4bb1t]

Honestly, with a little LLM help, I found variants, built a working PoC, and sent a polished patch to maintainer on the same day CopyFail dropped. So I’m curious why Xint didn’t find those variants before disclosure, assuming AI tools are used heavily in their workflow👀

Disclaimer: I’m an independent reporter and the patch author of the xfrm-ESP vulnerability, unrelated to the Dirty Frag post.

[splitline 👁️🐈‍⬛ @_splitline_]

@_L4ys escape the matrix

[splitline 👁️🐈‍⬛ @_splitline_]

is there any cool non-frontend web ctf challenges this year that aren't llm-solvable 👀

[splitline 👁️🐈‍⬛ @_splitline_]

@yuzhinok Three hundred and three

[splitline 👁️🐈‍⬛ @_splitline_]

@guttapercha80 @MeeRebus11 @danieleskay However the traditional international name for this island is Formosa, while the ethnic name used by Hokkien-speaking ppl on the island is Taiwan.
Yes, even in many Indigenous langs. For example, Amis, which you mentioned we are also called taywan

Historical issue is complicated

[slonser @slonser_]

And this makes sense given how many CTFs are held per year.
However, the ideal CTF challenge, in my opinion, should follow this formula:
"The author conducted a mini-research project and instead of publishing it, turned it into a challenge."

[LiveOverflow 🔴 @LiveOverflow]

What I’ve always found amazing about CTFs is that "flag is flag". Whether you found an unintentional solve or pwned the browser with n-day for a XSS challenge, it didn't matter.

I totally get the frustration of AI, but there is no solution other than accepting the change.

[maple3142 @maple3142]

A POC for CVE-2025-55182
https://t.co/BcyJ1UbivA

[Pumpkin 🎃 @u1f383]

A bit late, but I just published my blog post on bypassing Ubuntu’s sandbox! Hope you enjoy it!

https://t.co/Q9Nra9n6N0

[NiNi @terrynini38514]

The blog post is the full version of my talk at 38c3.

It's about some vulnerabilities we found in libarchive and some interesting behaviors of libarchive that you don't want to miss.

My favorite part is it only took us 56 seconds to trigger a crash by AFL++.

[Renwa @RenwaX23]

@dicegangctf @strellic This is just a rumor to make themselves feel better, CTFers doesn't have life and probably all single

[DEVCORE @d3vc0r3]

🤘Congrats Orange(@orange_8361) and Splitline(@_splitline_) on making it to 2024 Top 10 Web Hacking Techniques!

Check out their groundbreaking research: https://t.co/4zF90JZql9

[splitline 👁️🐈‍⬛ @_splitline_]

I will drop one web challenge there 🐈‍⬛

[ASIS-CTF @ASIS_CTF]

🚨 Brace yourselves, hackers! 🚨 The #ASIS #CTF Finals 2024 are coming on December 28th! 💥 24 hours of non-stop hacking with mind-bending challenges that will push your limits. 🧠 Prepare for a thrilling ride - this is gonna be epic! #ASISCTF #CTF #Hacking

[splitline 👁️🐈‍⬛ @_splitline_]

@TalBeerySec @orange_8361 @BlackHatEvents I read that before, it was quite interesting!
You’re right. Unicode normalization has always been a security concern, but I wouldn’t call it the core issue here. For me the root cause is still “Best-fit”. Unicode normalization is more of a broad bug category, like “injection”

[splitline 👁️🐈‍⬛ @_splitline_]

🍊 pumped my followers to 1k