Helios Mier

Cyber security engineer. #blueteam
This account is for kittens, memes, paintins and rants about my country politics.
follow me on hmier bsky & cara.

[Helios Mier @hmier]

todo va a estar bien...
es un nuevo mundo y tienes todo lo que se necesita.

[Helios Mier @hmier]

if i tell you to patch your ubuntus now... would that matter?

so much sh!t going on that is really getting the worst out of me, i feel like a cat hissing at everybody that ads me to a new conversation.

https://t.co/zMnqwSM8a8

[LiveOverflow 🔴 hextree.io @LiveOverflow]

Here is the time the WAF buys you

[Helios Mier @hmier]

😱

[unusual_whales @unusual_whales]

BREAKING: The FAA has shut down airspace over the Department of Energy’s Savannah River Site, with a notice calling it a “US Government Nuclear Incident," per SRS

[Helios Mier @hmier]

@CapibaraGDL Rofl

[Helios Mier @hmier]

@patux @josech @mauropm Suena a que atendieron el update de php de forma correcta y dentro de un tiempo aceptable para un portal principal.
Las preguntas que quedan son las mismas que para todos los demas: ya encontraron y parcharon todo el resto?

[Helios Mier @hmier]

@que_demonios pack your goats and lets go

[mRr3b00t @UK_Daniel_Card]

but also: remember how LOG4J was/is everywhere....

BROTLI..... might be in more places than you think:

https://t.co/AbphibYbWF

[Nicolas Krassas @Dinosn]

From Arbitrary File Read to Shell: Yet Another RCE in Telerik https://t.co/xh029EUoYi

[Trail of Bits @trailofbits]

We achieved RCE via Brotli in Linux labs:

• Node.js 24.22.0 + Express 5.3.0 (x86-64/ARM64) through its standard JSON parser
• Electron 41.10.7 (x86-64) using a custom-built decoding service

Getting it to work requires a carefully matched setup and can take repeated attempts.

[Helios Mier @hmier]

lol wtf??

[JFrog Security @JFrogSecurity]

One skipped byte -> account takeover.

🚨 Vert.x skips validating the letter 'L', treating `Content-Xength` as a valid `Content-Length` (CVE-2026-102479).

JFrog Research weaponized this "byte debt" with a dangling-byte primitive to bypass reverse proxy socket validation, demonstrating end-to-end response poisoning and session fixation behind real reverse proxies.

Full exploit mechanics and affected open-source projects in our writeup 👇

[Helios Mier @hmier]

@SoyVixen mira @quisuri1 esto es un fatality tuitero ejemplar 🤣

[CatsFriends @culKitten]

可爱的小猫咪安静的睡着了，天气变冷了，给它放到口袋里保暖。

[Helios Mier @hmier]

gorgeous!

[Threads of Time - Wishlist Now on Steam! @RiyoGames]

Our love letter to classic JRPGs, Threads of Time, is coming SUMMER 2027!

We're releasing on Nintendo Switch 1 & 2 alongside Steam & Xbox Series X|S!

✨A story-rich journey through time
💖Charming companions from every era
⚔️Cinematic, time-bending combat

[Helios Mier @hmier]

@techspence join my guild Advanced Persistant Trolls!

[Helios Mier @hmier]

Us mexicans love to share our culture: go ahead wear a sombrero, eat tacos, drink tequila, make altar offering to your deceased loved ones.

"cultural appropiation" is not a thing in MX, thats an alien idea that we dont care.

Fun and reasons to celebrate anything is our culture.

[Helios Mier @hmier]

@_Invadergirl 💞💞

[The Hacker News @TheHackersNews]

🚨 UPDATE: Node2Shell (CVE-2026-111497) has moved from PoC to the wild.

Scanning is live and the first exploit attempts are out. The RCE is now confirmed on STOCK x86-64 Node.js, not just arm64.

Patch now → 22.23.4 / 24.22.1 / 26.12.1

Read ↓ https://t.co/OTuQFpL7HC

[Héctor de Mauleón @hdemauleon]

“Ofrezco una disculpa, porque esta vez no habrá disculpa”, mi columna de hoy en @El_Universal_Mx.
👇

https://t.co/EpqVRuf1Ol

[CatsFriends @culKitten]

这是谁在我的小尾巴啊