ɪʀoɴ ѕɪɢнт

my favorite app is the calculator..

[pwn.ai @pwn_ai]

So... we decided to hack WordPress Core, AGAIN! 🔥 ⛓️ Click2Shell is a one-click unauthenticated remote command execution chain (Preauth RCE) affecting every WordPress website. Wordpress rolled out a fix yesterday! The story about how one preview link made WordPress click Install, load an inactive theme's PHP, and hand us RCE is below. Happy Friday!

https://t.co/91D2F2lSdb

[pwn.ai @pwn_ai]

Introducing XSS2Shell ⛓️: WordPress Core preauth XSS→RCE vulnerability affecting 43% of the internet, discovered autonomously by pwn (using open-source models), affecting all WordPress versions.

https://t.co/Fql6aLPrtT

Please patch CVE-2026-64638 as soon as possible!

[Paulos Yibelo @PaulosYibelo]

If you are a bug bounty hunter/hacker etc, I don't think there has ever been a more exciting time.

[pwn.ai @pwn_ai]

@albinowax @BlackHatEvents This is absolutely fantastic. We are thinking along the same lines!

Check our novel researcher announcement here:

https://t.co/M6rOYvRmqn

Very curious to see your finds! And the future is going to be VERY VERY exciting!

[pwn.ai @pwn_ai]

🚨 ZERODAY: ImageMagick 🚨

Our autonomous pentester https://t.co/zHUcIkHqvr just dropped multiple zeroday chains in ImageMagick that achieve RCE and File Leak from a single .jpg or .pdf file, bypassing EVERY security policy (Default, Limited, AND Secure). 🤯

💥 Affects Ubuntu, Debian, WordPress & millions of servers globally. Happy Monday and Happy Hunting! 🥰

https://t.co/nNAvFAvPOx

[pwn.ai @pwn_ai]

🎄🎁 Here is a 0day unauthenticated root RCE affecting over 70,000 devices on the internet.
https://t.co/yvgRXuR4nX

For our first post, we show how pwnai autonomously found a root rce affecting XSpeeder, over 8 months ago. To our knowledge, this is the first agent-found, remotely exploitable 0day RCE published.

Merry Christmas & Happy New Year 🎅💥

[Project Mano | ማኖ 🇪🇹 @projectmano]

We have been saying this (among many things) for years. Despite being offered large sums of $$ by various miners to shut up, we stood our ground and screamed on top of our lung that this is an unsustainable and corrupt hijack of public resources for benefit of few foreign Bitcoin mining companies. The only scenario it makes sense to allow Bitcoin mining with tax payer funded revenue is if the State or State owned enterprise became the sole operator of Bitcoin mining, with the strategy of storing the acquired Bitcoin for longer term. This way, the low cost of acquisation on a future world reserve asset that is finite in amount can be used to protect the ETB from slumping down even further. As there should have been a Strategic Bitcoin Reserve a long time ago and mining provides a significantly cheaper avenue to building that compared to directly buying Bitcoin.

The idea was hijacked from our initial proposal 5 years ago on https://t.co/vIyuju98Hg for the State to mine Bitcoin itself using stranded power and not sell the power to foreign bitcoin miners. However, the "experts", who are people like @KalKassa, a sell-out traitor who'd sell his grandparents for a simple pat from foreign hands. He is pathetic absolute lowlife. an insidious plague, a wolf in sheeps clothing, more harmful than any foreigner because he uses his "Ethiopian" face and card to drag the world to benefit from public tax funded resource, while at the same time spreading propoganda Government mining is risky - the incentives are for his own pocket, and truthfuly, he should be investigated. He is a venomous insect that would gnaw on his own mother’s corpse for a crumb of validation from foreigners. The other expert who claims to be a Bitcoiner but resists on State mining because he think its threatning to his business is Nemo Semret. Both of these people have deep incentive that conflicts with their own personal interests to spread anything but the truth, sometimes with scentific seeming claims that could easily be debunked.

Ethiopia's power is cheap at 1c/kWh is not because the cost of production is that much. The cost of production is significantly higher. The only reason is to make power accessible to people who live under 1$/day, which is a significant portion of the population. Not to drag the world into benefiting and basically extracting Ethiopians tax payments by paying less than what it costs to produce the power. The only benefit is short sighted, quick foreign currency. By comparasion, if the State had started mining when we made the recommendation 5 years ago, there would have been over 20bn$ earned from Bitcoin mining. and if that is stored in a Bitcoin Strategic Reserve, there would def not be any foreign currency crisis.

Since Day 1, Project Mano's goals have been the same. Increase the buying power of ETB against any currency by building a Strategic Bitcoin Reserve through State owned mining Enterprise. The opportunity cost of listening to people who only spread information that benefits them has been in tens of billions of $ and in few years in hundruds of billions of $ when Bitcoin price crosses at 250K. Sooner or later, the public will realize this fact, and how they are funding a closely operated colonization project that extracts all the resources they could have used to change their lives.

Today @TirusewAsefa and @alemayehuGeda have noticed and started questioning the incentive structure behind it, as we have for years. Soon more people will. Ultiamtely, not losing sight of the opportunity is what matters: which is that the Ethiopian Gov should be mining Bitcoin itself. A resource that had over 250% yearly increase on average since the year it has been created.

References: https://t.co/1ylAL6mz4g

[pwn.ai @pwn_ai]

What we are building is insane. If vendors patched quicker, we would've showed you already. The sort of vulnerabilities https://t.co/6oiPiGELL0 is finding is on par with the top security researchers. preauth RCE after preauth RCE fully autonomously. Will drop a blog post soon.

[pwn.ai @pwn_ai]

We hacked @cluely's “Cheat on Everything” tool… and took full control of the cheaters computer.

When a cheater uses Cluely, not only are we able to detect they are using Cluely but execute full commands on their computer. ‼️

Watch the full video 👇

[pwn.ai @pwn_ai]

This is insane! @Pwndotai has autonomously discovered an unauthenticated remote command execution vulnerability affecting over 70,000 servers. It found the entry point, developed the entire chain, created a proof of concept, iterated through the right issues and entirely on its own got a complex root RCE shell. Reporting to the affected vendors right now

[pwn.ai @pwn_ai]

With little help with @pwndotai , which is an agentic hacking ecosystem we are building, we are able to get 1-click RCE in Cluely (@cluely). The exploit takes time to setup but it's straight forward and can be reached via many techniques, and an indirect prompt injection. The full technical report is sent to Cluely team and we expect them to address it in a timely manner. In the meantime go follow @Pwndotai for upcoming announcements and advisories using our agentic tools

[Paulos Yibelo @PaulosYibelo]

Looks like two of my new attack vectors from last year have been nominated for the Top Ten Web Hacking Techniques of 2024! If you like them, please vote for DoubleClickjacking and Cross Window Forgery here:

https://t.co/L0I08lFpjb

[Project Mano | ማኖ 🇪🇹 @projectmano]

Here is why foreign BTC miners in Ethiopia are a NET negative for BTC & the effects BTC would've had in the country without their presence.

1. All of them are not real bitcoiners. As glassnode clearly notes with onchain evidence, 90% of sellers that amplify the BTC bear market are BTC miners. If not for miners, BTC would never experiance bear markets. But when the cost of acquiring a single BTC is so low, not more than 20k$ - most of the BTC is profit for them. The particular miners in Ethiopia have managed to open the floodgates of low level & high level corruption in Gov offices, allowing them to acquire power at 0.02kWh. You are profitable in mining BTC if cost of power is <0.13kWh. They are spending ~20,000$ to acquire a single BTC - abt 80% of the ROI is often dumped in market.

2. While companies like RIOT & MARA are following the MSTR strategy by selling convertible bonds to acquire more BTC, BTC miners who are not real bitcoiners won't do that. Instead they acquire BTC to dump it on the market constantly. 2.5% of hashpower is a lot - & all of that dumped onto the market is even more fuel for amplifying a bear market.

3. Foreign BTC miners in Ethiopia are extremely corrupt. they were chased away from countries like Oman, China & Iran for overusing the grids & corruptly buying power from the grid that affected the population. Despite this, they didn't stop utilizing same strategy, & their constant mention of "stranded power" is a lie, a bunch of them have setup offices near big cities where the supposed power is taken from the population that suffers from power shortages daily.

4. When we started projectmano, 1USD was 25 ETB. Today? Its 139. We saw it coming a mile away. Our recommendation since 2019 (BTC was 15k) was: AS A GOV, monopolize & mine #BTC using stranded energy, Store as reserve, link to currency = easy. Strong ETB. Using this methodlogy Ethiopian gov could make 8-10bn$ in current BTC - more than enough money to close the trade deficent & reverse inflation on ETB. Our proposal is public on https://t.co/Rr20QHcPWO - it is by patriot Ethiopians who are tired of seeing the rise of ethnic fingerpointing & civil violence as resources are depleted out of the country.

5. Instead - by selling power to corrupt BTC miners, Ethoipia has only made 55m$ for over 600MW of power. That is more power than what it took to train GPT4 - the most advanced languge model to date. Its market value is more than 250m$ - if used to mine BTC, would've yileded enough to stop the agony of the Ethiopian people by generating billions of $. we are talking billions of $ OR 55m$ for 2.5% of the BTC network.

6. & Worst of all, beyond telling & convicing the GOV mining & holding BTC in reserve as a bad idea, they went as far as lobbying the GOV to not allow locals to mine BTC. to ONLY ALLOW FOREIGNERS to mine BTC. There is no basis to this rule other than extreme greed. Even greedy people have limits, where they take what they need & still allow others to prospher for peaceful cohabitation. we dont think its just greed - its EVIL. to work extra hours, lobbying gov officals to say "Ethiopians & Ethiopian gov should not mine BTC but allow us to... with less than optimal pricing - so we could dump it on the market". Stealing opportunity that could have been used by all Ethiopians to change their lives.

So as you can see, as @duczko said " nobody makes any money from exploiting the Ethiopian energy other than foreign BTC miners & corrupt Ethiopian politicians" - & its time the public knows this. its time the BTC community understands this before prasing mine videos they see out of Ethiopia. Its time we kick these miners out & use BTC for who its meant for: poor countries with energy grids to bypass the industrial phase. Our #1 enemy is not just corruption but corrupt foreign BTC miners. & we want them out. Please share to amplify pressure & save a generation from war & poverty & use BTC to actually change a country with a population of 100+M.

[Project Mano | ማኖ 🇪🇹 @projectmano]

even Jaran, who is here in Ethiopia trying to exploit the country by corruptly buying power under 2¢ is asking his nation to mine nationalized Bitcoin yet telling our gov it's risky to mine. We see you and your cronies. Soon you'll be out &amp; the corruption in EEP will be exposed.

[Project Mano | ማኖ 🇪🇹 @projectmano]

Are you paying attention? @Myriam_A_Said @YodaheZemichael @btaye @DrAhmedin - we don't need foreign miners. We need to move to mine &amp; put it in reserve. Project Mano proposal can completely reverse inflation &amp; actually double the buying power of ETB. Not a lot of time. Tick tock

[Project Mano | ማኖ 🇪🇹 @projectmano]

When we started projectmano, 1USD was 25 ETB. Today? Its 139. We saw it coming a mile away. Our recommendation was: AS A GOV, monopolize &amp; mine #BTC using stranded energy, Store as reserve, link to currency = easy. Strong ETB. Wrote public policy proposal: https://t.co/ZIaIYbElEt

[ɪʀoɴ ѕɪɢнт @Iron_Sight24]

@mateusrstyle @hummusfan100 @afgewacht I'd genuinely go for the xm5 here. I've owned both and used them both for like 300hrs+ over 2 years. but my xm5 broke (rotator) and I went back to the xm4 now but idk they're both similar but if you ask me, but I really prefer the xm5 bc it's subjectively better for me

[Public Hakita Is a Good Idea @HakitaDev]

As creator of said game: You should support indies if you can, but culture shouldn't exist only for those who can afford it. ULTRAKILL wouldn't exist if I hadn't had easy access to movies, music and games growing up.

If you don't have money, you can support via word of mouth.

[Fluppy @Fluppyyyy]

BIG @Animal_Well update. Might have to delete a game or 2 to get this installed.

[pwn.ai @pwn_ai]

You can now bypass CSP on any website that allows https://*.facebook.com in a default or script-src 🔥🌊?

PoC: &lt;script src=https://t.co/ZUX2wh3xTJ&gt;&lt;/script&gt;

Exploitation is only possible using a novel technique we published:

https://t.co/D8SCZ1IXVI #bugbountytip #BugBounty