adibou

hacking things

[Yassine Aboukir 🐐 @Yassineaboukir]

“Bug bounty is dying” is noise.

Lock in. Make money. Use AI to 10x your output. If it eventually dries up, you’ll have enough capital to start that biz or enough experience to land a job.

Simple as that.

[shubs @infosec_au]

https://t.co/rLl6ZzmuvY

[shubs @infosec_au]

Earlier this year @SLCyberSec’s research team disclosed a vulnerability that allowed us to leak PII and emails stored inside Salesforce Marketing Cloud instances, for any customer, without authentication. You can read more about our research here: https://t.co/Og4HoMPAFM

[s1r1us (mohan) @S1r1u5_]

when react2shell hit last year, i think vercel handled it brilliantly.

to protect their users, they paid $50,000 for every bypass researchers could find. we decided to participate, and ended up earning $170,000.

read how we did it here: https://t.co/2dM6Mf9PHU

[Wiz @wiz_io]

🚨 BREAKING: Wiz Research discovered Remote Code Execution on https://t.co/SvN2lGsnbO with a single git push

The flaw in @github allowed unauthorized access to millions of repositories belonging to other users and organizations 🤯

[Nick Mykhailyshyn 🇺🇦 @whoareme33]

Chained CSPT into full account takeover using a 2FA bypass technique I hadn't seen used in bug bounty before.

https://t.co/4SHUJbPV68

[Kévin GERVOT (Mizu) @kevin_mizu]

The #FCSC2026 ended today, and my write-ups are now available here:

https://t.co/6e2WWjxKpD 🚩

I'm really happy with the challenges I managed to create this year! It would be too long to list everything, so here's a little teaser 👇

1/2

[Worty @_Worty]

The #FCSC2026 ended today, my write-ups are now available on my website https://t.co/PbzPBa4dpX, don't hesitate to check them !

[Max Yaremchuk @0xw2w]

We have a rare opportunity to observe a bold move by Xiaomi's bug bounty program. After several internal discussions and a meeting with the board of directors, a Chinese conglomerate finalized the increase in the low-severity bounty range from $1 to $1-$2.

[GMO Flatt Security Inc. @flatt_sec_en]

We've published a new blog post by RyotaK @ryotkak !

He exploited a directory deletion race condition in Google Cloud's Looker, leading to full RCE and K8s privilege escalation.

Read the technical details here:
https://t.co/3eFBt0tKbk

[Anthropic @AnthropicAI]

We partnered with Mozilla to test Claude's ability to find security vulnerabilities in Firefox.

Opus 4.6 found 22 vulnerabilities in just two weeks. Of these, 14 were high-severity, representing a fifth of all high-severity bugs Mozilla remediated in 2025.

[Patrik Grobshäuser @ITSecurityguard]

I finally let Claude do my pentest this week. Full 5-day engagement, zero human input. Here's what the client got: 😏

https://t.co/1PPuxhs4V9

#bugbounty #pentesting #AI #cybersecurity #infosec #claudeai

[Angel Montes @_N0xi0us_]

Today I discovered that scammers are poisoning Google AI Overviews to display malicious data.
While searching for an airline support phone number, the AI-generated result surfaced a scam number operated by fraudsters.

Don't be lazy and double check the results 🫡

[Critical Thinking - Bug Bounty Podcast @ctbbpodcast]

New research just dropped by @alien2exe on hijacking OAuth popups via predictable window. open() targets.

The chain uses iframe name collision forcing the auth flow into a controlled context, eventually linking an attacker-controlled addon to leak workspace PII and config data

https://t.co/GbimNCyqxx

[Starstrike AI @StarstrikeAI]

Data Exfiltration in Google Gemini via... phone call?

Link in comments:

[Kirill Firsov @k_firsov]

@FearsOff @Cloudflare This write‑up tells the story of how traffic aimed at that certificate path could reach origins behind Cloudflare even when the rest of the application was blocked by customer rules.
Enjoy the reading here https://t.co/Ti4Eceweh7

[Yuval Avrahami @yuvalavra]

We hacked the AWS JavaScript SDK, a core library powering the entire @AWScloud ecosystem - including the AWS Console itself 🤯

How did we do it? Just two missing characters was all it took.

This is the story of #CodeBreach 🧵👇

[RyotaK @ryotkak]

I wrote an article about 8 vulnerabilities in Claude Code that allowed me to bypass the permission model and execute arbitrary commands!

[adibou @adibousec]

onelifeitsworthanattempt.png

[Worty @_Worty]

Quite a long work to get the exploit working and the article ready, but here it is !

Our pre-auth RCE in Livewire v3 (CVE-2025-54068) with @_remsio_ is live ! Enjoy the read :)