LeftenantZero

Engineer. Security Enthusiast. Human Being.

[LeftenantZero @LeftenantZero]

A high severity vulnerability in AutoGPT I discovered was just made public. (CVE-2026-30950)

It allows attackers to hijack conversations that don't belong to them, potentially exposing sensitive details or access to privileged LLM tool calls.

https://t.co/jImwTXArZR

[ohjin @pwn_expoit]

As an offensive researcher, what scares me isn’t that LLMs can find bugs today.

It’s the post-LLM era:
well-engineered, security-hardened code written with AI assistance, and the industry’s massive shift toward memory-safe languages with help of LLMs

[LeftenantZero @LeftenantZero]

Mythos found only 1 low severity vuln in curl... In part because ZeroPath helped identify and fix ~170 issues six months ago.

Effective AI SAST is already here. There's no need to wait for Mythos.

https://t.co/A2UmgjPI5j

[LeftenantZero @LeftenantZero]

CVE-2026-39816: Missing permission annotation leads to post -auth RCE in Apache NiFi.

Our blog has the details and a working POC.

https://t.co/IkHRWMBK2k

[LeftenantZero @LeftenantZero]

This is the blog post that goes with the github repo -- it adds a bit of color to the results:

https://t.co/Pv2cK6HwWb

The FP problem is very real. There's also a consistency problem run over run that's in my opinion as serious as the FP issue.

The harness is everything right now when it comes to actually using LLMs for vuln detection.

[ZeroPath @ZeroPathAI]

ZeroPath Research discovered CVE-2026-39816, a high severity vulnerability in Apache NiFi. Prior to version 2.9.0, an oversight in the permission model allowed users without the EXECUTE_CODE permissions to run arbitrary code.

For more details and a POC:

https://t.co/lEy58ThkSC

[LeftenantZero @LeftenantZero]

Long term , I think the current AI-powered vulnerability glut eventually turns into an AI-powered vulnerability drought. Historical stuff gets mined out and better code analysis tools reduce new easily-detectable bugs, even as code volume continues to increase.

If you can use AI to find it after it's shipped, you can use AI to find it before it's shipped.

[LeftenantZero @LeftenantZero]

Critical security findings are only really stories because of how high friction disclosure and remediation is. In a world where finding leads to a lightning fast patch and low effort, safe upgrade, vulns become non-stories, unless they're particularly technically interesting or something.

[LeftenantZero @LeftenantZero]

Yeah, I think we'll look back at the last few months as the time when everyone simultaneously figured out how to apply ai to vuln research at scale. We need a solution for remediation that can keep up... without getting everyone owned with malicious packages. Disclosure process needs to be accelerated as well IMO.

[LeftenantZero @LeftenantZero]

CVE-2026-42167, a high severity vuln in ProFTPD I discovered, was just published today! Attackers can use it to bypass auth and even execute arbitrary code in some cases.

Check out my write up for full technical details, including a working POC!

https://t.co/XeAf9r7h3E

[LeftenantZero @LeftenantZero]

This has been my experience ai vuln finding as well. The quality of the harness makes all the difference.

I even benchmarked vanilla Opus 4.6 -- results were not impressive. (https://t.co/1Dvkfj6Taa)

They need us human researchers for a little longer at least :-/.

[Matt Johansen @mattjay]

Reading @NielsProvos research of how he's finding zero days with pre-Mythos models (even Sonnet 4.6)

This absolute legendary line buried in here about him replicating the Mythos OpenBSD bug.

Meant a lot to him because ...he wrote the bug in 1998

[LeftenantZero @LeftenantZero]

Where the goblins in the GPT system prompt came from...

"Starting with GPT‑5.1, our models began developing a strange habit: they increasingly mentioned goblins, gremlins, and other creatures in their metaphors." 😂

https://t.co/zYNHNeNC0n

[Brian Pak @brian_pak]

Time to talk about this one.

CopyFail (CVE-2026-31431) — a 732-byte Python script that roots every Linux distro shipped since 2017. 🧵

[ProjectDiscovery @pdiscoveryio]

Here's a cool trick for y'all looking to create new Nuclei templates for exploitable CVEs!

Using CVEmap you can get a list of CVEs with public proofs of concept, that have been marked as exploitable by CISA, are remotely exploitable AND don't have a Nuclei template (yet)!

Flags:
-k / -kev: Marked as exploitable vulnerabilities by CISA
-t=false / -template=false: Has no public Nuclei templates
-poc: Has public published POC
-re / -remote: is remotely exploitable

Good luck! 🤞

#nuclei #hacking #pentesting #bugbounty #CVEmap

[LeftenantZero @LeftenantZero]

https://t.co/UZuPqdUHTy

Hands on video walkthrough: Exploiting the new critical Spinnaker vulns for RCE and credential theft. (CVE-2026-32604 and CVE-2026-32613)

Includes POCs and script to stand up your own lab environment

[Hunter @HunterMapping]

🚨Alert🚨 CVE-2026-32604(CVSS 10.0) &CVE-2026-32613(CVSS 10.0): The RCE Flaws Threatening Spinnaker Pipelines.
🧐Detail :https://t.co/hrTmgcY4pf
📊 2.2K Services are found on the https://t.co/g3tSyh13yE yearly.
🔗Hunter
Link:https://t.co/mfU9A6tPJv
👇Query
HUNTER : https://t.co/yFFcJwdIUc="Spinnaker"
📰Refer:https://t.co/GnZ3242iQn
https://t.co/HgEMnOd2EK
https://t.co/sHM5n3q4Vy
#hunterhow #infosec #infosecurity #OSINT #Vulnerability

[ZeroPath @ZeroPathAI]

Walkthrough: exploiting ZeroPath's new critical severity Spinnaker vulns for code execution and production environment access. (CVE-2026-32604 and CVE-2026-32613)

https://t.co/Gh0GBal6O1

[LeftenantZero @LeftenantZero]

@UpwindMDR Here's the blog post where we announced CVE-2026-32604 and CVE-2026-32613. Includes full technical details + working POCs!

https://t.co/CxRh3ySU1Y

[LeftenantZero @LeftenantZero]

@yousukezan Here's the blog post where we announced them. It includes full technical details + working POCs!

https://t.co/CxRh3yTrRw