ch

open to bug bounty collaboration
@HackenProof Security Researcher
Just dm

[ch @chybeta]

19.4.13 - 24.4.13

[Orange Tsai 🍊 @orange_8361]

That's my chain — a full chain w/ logic bugs only! No memory corruption, no AI, and of course no collisions at all 😉

[Stanislav Fort @stanislavfort]

New post: We tested the Mythos showcase vulnerabilities with open models.

They recovered similar scoped analysis! 8/8 models found the flagship FreeBSD zero-day, including a 3B model.

Rankings reshuffle completely across tasks => the AI cybersecurity frontier is super jagged!

[Anthropic @AnthropicAI]

New on the Anthropic Engineering Blog:

How we use a multi-agent harness to push Claude further in frontend design and long-running autonomous software engineering.

Read more: https://t.co/HWvmXk1ykn

[Oded Vanunu @Od3dV]

I hacked Claude Code! It turns out "agentic" is just a fancy new way to get a shell. I achieved full RCE and hijacked organization API keys. CVE-2025-59536 | CVE-2026-21852
https://t.co/GymKzaM1wp
#ai #Claude

[ch @chybeta]

@diamondhandjs 举手

[Y4tacker @Y4tacker]

#CVE-2025-67303 ComfyUI-Manager Remote Code Execution 突然想起来我还有推特昨晚用我的Agent 10分钟分析的，之后的RCE就是CVE-2024-21574利用的复活

[ch @chybeta]

@maru_49940 nb

[ch @chybeta]

@pyn3rd - 这是靶场吧

[ch @chybeta]

“看看 etherscan都要收费”😂

[Cos(余弦)😶‍🌫️ @evilcos]

万万没想到我们第一时间出手帮忙 Venus 大户 @KuanSun1990 跟进调查被盗事件，第一时间就给其指明了 Venus 风控必要性，风控后，然后我们协助他把被黑根本原因调查出来，他却在自己的群聊里全面诋毁我们“毫无作用，纯坑，看看 etherscan 都要收费，还有脸要赏金要致谢”。

现在的伦敦时间你 @KuanSun1990 可能还没醒，你醒了，来给个交代，否则我们会让大家知道什么是现实版的农夫与蛇，什么是两面三刀（你看看你和我私聊的嘴脸吧，你是如何诋毁其他��你的角色的）。就你这样的人，以后谁还敢出手帮你。

本来我已经和你说了这次可以不要赏金，既然你如此踩我们（但这几天推文又都又在公开致谢我们…包括你历史上第一次被盗，你写的真的是声泪俱下，感动了很多人，包括我），这次的赏金我肯定要，你受益于我们，为什么我不能要赏金？我给谁做公益，也不可能给你这种人做公益。

[ch @chybeta]

@maru_49940 橘，a9了还这么努力

[Sam Altman @sama]

gpt-oss is out!

we made an open model that performs at the level of o4-mini and runs on a high-end laptop (WTF!!)

(and a smaller one that runs on a phone).

super proud of the team; big triumph of technology.

[dbugs @ptdbugs]

1/4 dbugs LIVE

https://t.co/Cd6L8AD6Bt — vulnerabilities’ home

See trends, discover more, read AI summaries, have all references at hand, and your profile with all your CVEs and CVSS score on a leaderboard.

⬇️ See thread: what’s live + what’s next ⬇️

[l33tdawg @l33tdawg]

After 9 months+ of cranking, cursing, and cursoring, and drawing on over 20 years experience running #HITB's Call for Papers, I bring you CFP Directory - a single system to make it easier for speakers to submit and organizers to connect and curate talks: https://t.co/yJdRUYHnkF

[ch @chybeta]

@0xCryptoWing lam庄操盘

[ch @chybeta]

@jobertabma @NahamSec @stokfredrik @Hacker0x01 henrychen

[Cos(余弦)😶‍🌫️ @evilcos]

很好，这次我也是受害者了...被 @getAlby 偷走 0.00174788 BTC($191.96)。能偷是因为这是 Alby 的托管账号。我是很震惊的，因为这鬼协议我必然是不知情的...

我猜是不是会给我发邮件通知，果然 2025/5/1 给我发了个：

Updates to our Terms of Service – Please Review

我在邮件正文底部发现了这个“偷窃协议”：

An inactivity fee will apply to legacy Alby Accounts with a shared wallet created in 2023 or earlier, if there has been no account activity for 12 consecutive months.

然后我这笔 BTC 在 2025/5/26 被偷走了...

开眼界了...🤯😵‍💫😱

[ch @chybeta]

@0xCryptoWing @diamondhandjs 继续做庄

[ch @chybeta]

@maru_49940 🤧浇了我

[ch @chybeta]

@ParamJani21 My case is just a special case

In most cases, it is difficult to chain the two

[ch @chybeta]

SSRF + Cache Poisoning + Stored XSS = Account Takeover