Hacktron AI

Hacktron is an autonomous vulnerability hunter for ambitious engineering teams. Built by world-class security researchers. Powered by one principle: PoC || GTFO

[Hacktron AI @HacktronAI]

OpenAI has announced a partnership with Hacktron to investigate vulnerabilities in its systems. Our researchers will work with @OpenAI's engineers to prioritize testing of connections with third-party services, with broader frontier-model access through Daybreak Red.

We're excited to deepen our partnership with OpenAI, combining our offensive security expertise with their frontier models to help secure OpenAI and the broader software ecosystem.

https://t.co/PqWAT5g3W3

[Hacktron AI @HacktronAI]

heard you guys are having fun with telegram, so we joined too.

[Hacktron AI @HacktronAI]

Have a burning security question? Just @ Hacktron AI, now in Slack.

Check whether a new CVE affects your repos, ask how your code handles something, or save a decision straight to your threat model, all from the thread. It also triages findings, opens fix PRs, reviews pull requests and sets up pentests.

Get answers from your own code and threat model within minutes.

Try it yourself: https://t.co/5D3nTUEPt4

[s1r1us @S1r1u5_]

hacktron website just got a fresh upgrade!

all thanks to the one and only @enscribe (https://t.co/p4xdCKhLao). insanely talented goat. never seen an artist cook up things from scratch and turn them into absolute madness (he designed our old site too)

https://t.co/HwGYRP1eFv

[Hacktron AI @HacktronAI]

new website who dis

https://t.co/bkpD9usTxx

[Drew Hintz @DrewHintz]

Hacktron has reported high-impact vulns to us through our bug bounty program. Now we’re teaming up with @zeyu1337 and the Hacktron crew to hunt for more. https://t.co/XZYPTUzJvV

[LiveOverflow 🔴 hextree.io @LiveOverflow]

👀🔴🤖

https://t.co/1ER6YfP7zB

[Hacktron AI @HacktronAI]

“I already patched, so why should I care?”

Patching doesn’t remove an attacker who got in before the fix. And you can’t patch what you don’t know is vulnerable. So verify what’s actually running across your environment and check that the fixes reached those systems.

Patched everything you know about? 𝗧𝗲𝘀𝘁 𝘄𝗵𝗮𝘁 𝗮𝗻 𝗮𝘁𝘁𝗮𝗰𝗸𝗲𝗿 𝗰𝗼𝘂𝗹𝗱 𝘀𝘁𝗶𝗹𝗹 𝗲𝘅𝗽𝗹𝗼𝗶𝘁: https://t.co/S2YVgdpxK6

[Hacktron AI @HacktronAI]

Two weeks on: what happened with the “Black October” vulnerabilities 🧵

𝗙𝘂𝗹𝗹 𝘄𝗿𝗶𝘁𝗲-𝘂𝗽: https://t.co/DJ3NdqpxHV

[Hacktron AI @HacktronAI]

𝗣𝗹𝗲𝘅𝟮𝗦𝗵𝗲𝗹𝗹: Exploited within a day of the 16 Oct write-up, with crypto miners and proxy malware installed. The fix had been out since early August.

[Hacktron AI @HacktronAI]

A critical vulnerability went undetected through multiple security audits. Hacktron found it in 10 minutes.

The vulnerability was in Dassault Systèmes' DELMIA Apriso, manufacturing software used by Boeing, Airbus, Lockheed Martin, and previously Apple.

It became CVE-2025-5086. Three months after disclosure, CISA confirmed it was being actively exploited.

Security assessments capture a point in time. Attackers don't work on your schedule.

Full research: https://t.co/YLSHHLA83H

[Underdog AI @UnderdogAI]

Underdog is the only personal AI that is capable and SAFE

It runs local, not in a Linux VPS, not at the mercy of any cloud attacks. Your data stays on your own device

We hire the world's best hackers to keep Underdog safe: the team who hacked OpenAI, 3-time world #1 competitive hacking team, auditors that secured $36B+ & patched $1B+ in vulnerabilities

read more: https://t.co/nysp6zx8AZ

[Hacktron AI @HacktronAI]

Read the full research: https://t.co/d6rNEteL2e

[Hacktron AI @HacktronAI]

This is how another xz could have started.

GNU Savannah hosts the upstream repositories for Bash, Coreutils, and hundreds of other GNU projects.

We audited Savane, the software behind it, and found a path from a newly registered account to code execution.

[s1r1us @S1r1u5_]

regarding cve-2026-98432: it is a uaf in tcp, mptcp is needed to make the race win and to get the leak and write.

the impact of the bug is bad, its essentially go2shell, caddy2shell etc. go 1.24+ servers are all vulnerable, because mptcp is enabled by default.

BUT:

1. It is extremely hard to win the race reliably, anthropic said it took 40 mins for them to get leak and defeat kaslr
2. It is probably hard to exploit in practice. most routers, lbs and isps drop ip options, without that header you can't race at all, so realistically only a same network attacker can try, which is pretty common in sandbox infra

my mythos worked on this for last 3 days burned ~$2k and couldn't build a reliable poc that can be sprayable. gpt-5.6 sol als exhausted my subscription and couldn't even get a leak.

either anthropic has a unreleased model which is better than their public one or they have a pro exploit dev internally.

[Hacktron AI @HacktronAI]

bash2shell

[s1r1us @S1r1u5_]

What if you could backdoor Bash, ls, cp, rm, and other GNU software used by millions of systems?

Our research led us to hack GNU Savannah, the infrastructure hosting their source code.

The xz backdoor that never happened 🧵