Daniel Kalinowski

Founder of @tlbcpl - Security researcher, spare time bounty hounter

[striga @striga_ai]

CVE-2026-23918 - a pre-auth RCE in Apache httpd's mod_http2, found by Striga during our open-source research.

The bug triggers on a single HTTP/2 connection sending HEADERS followed by RST_STREAM with a non-zero error code. Two nghttp2 callbacks both push the same stream pointer onto the cleanup array, and the second pool_destroy hits already-freed memory.

We built a working RCE on x86_64 using mmap reuse and Apache's scoreboard memory as a stable container for fake cleanup structures.

Affects Apache httpd 2.4.66 with mod_http2 and a multi-threaded MPM.

Full technical writeup coming soon.

https://t.co/SI7p0zQToj
https://t.co/DcQSMnwhPx

[Lukasz Jachowicz @ljachowicz]

Obiecywano aplikację w 100% polską, bez obcych komponentów. Rzeczywistość? Lekko zmodyfikowany Element X. To dobry komunikator, więc dlaczego @CYFRA_GOV_PL wprowadza w błąd co do kodu #mSzyfr?

Na co, swoją drogą, większość redakcji się nabrała.

Moje spojrzenie na mSzyfr dla @portalzeropl.

https://t.co/5a8ZexcMLl

[striga @striga_ai]

Unauthenticated RCE in Apache Tomcat (CVE-2026-34486)

The EncryptInterceptor was supposed to protect cluster communication. A fix for a padding oracle vulnerability moved one line outside a try block, and the encryption layer silently started forwarding every failed decryption straight into unfiltered Java deserialization.

We found it with Striga, built the exploit, and reported it to The Apache Software Foundation.

https://t.co/cygPWfXCnB

[Ejaaz @cryptopunk7213]

this is so fucking wholesome

guy used AI to save his cancer-ridden dog by sequencing its DNA and creating a CUSTOM cure.

the tech behind this is fucking awesome (well done @demishassabis and the google team):

- used CHATGPT to sequence dogs DNA discovers mutations

- ran the mutations through Google’s Alphafold (AI protein sequencer) which CREATED A CUSTOM VACCINE TO TREAT THEM.

- treated dog and reduced tumour by 50% in WEEKS. dog is alive and well.

- this is the 1st time AI has been used to create a custom vaccine for a dog (and it worked)

- dude is now working on similar vaccines for humans using AI!

2026 is definitely the year we see AI change personalised medicine in a HUGE way

so sick

[Disconnect3d @disconnect3d_pl]

Pwndbg 2026.02.18 is out!

We visualize branches in nearpc, sync ur decompiler (IDA/Binja/Ghidra) via decomp2dbg, annotate stack vars from dbgsyms/decomp, added new cmds for tracing kernel allocs/frees, dump task info: https://t.co/Gz2rdZlzxp

Sponsor us: https://t.co/YdAmbhJHyF

[TaraBull @TaraBull]

AI Made the Best Anti-AI Meme So Far

[Mayfly @M4yFly]

🚀 Introducing MoxPack: A template builder for Proxmox using Packer.
Generate Windows & Linux VM templates with cloud-init support and sysprep.
Ideal for lab automation and infra-as-code.

https://t.co/ewTGY6NqIU

[Daniel Kalinowski @llamaonsecurity]

@mvalsmith The bots in the comments…

[Kuba Gretzky @mrgretzky]

MS updated their MS365 sign-in page in April 2025, breaking the current Evilginx phishlet.

Fawaz has done a terrific job reverse engineering the changes.

The new phishlet is being worked on in the BREAKDEV RED community.

Join here: https://t.co/60Hx7AfaB0

[Gynvael Coldwind @gynvael]

Doing a free webinar today at 8PM CEST (i.e. livestream with slides) about "files", as entities on the filesystem, seen through the eyes of a security researcher.
https://t.co/441BOwfkRg ← sign up here if interested

[vx-underground @vxunderground]

Try not to cringe level: IMPOSSIBLE

[Daniel Kalinowski @llamaonsecurity]

CZYTAĆ!

[foxtrot_charlie @foxtrot_0x4fult]

Do sprzedaży trafił kolejny numer Programisty.
Serdecznie polecam artykuł @KrzaQ2 - skoro mnie przekonał do programowania w C++, to znaczy, że opisywane ficzery są super ;)
Dołożyłem mała cegiełkę do naszej wspólnej z @oshogbovx serii o CVE ;) trochę o VPNach i takich tam ;)

[Daniel Kalinowski @llamaonsecurity]

@galnagli Heapdump is my favorite endpoint.

[Daniel Kalinowski @llamaonsecurity]

@cyb3rops Because if you use snapd on Ubuntu CUPS get installed and enabled by default. Yeah this was a surprise to me as well

[Daniel Kalinowski @llamaonsecurity]

@Sh0ckFR But can you count to 3?

[Daniel Kalinowski @llamaonsecurity]

Pierogi team 🥟🇵🇱 secured 8th place. Thanks @gregxsunday for this opportunity!

[HackerOne @Hacker0x01]

The results are in!🥇

Congratulations to these 32 teams who will move on to the Group Round of the 2024 #AmbassadorWorldCup! 🙌

The next round kicks off at the end of August! Stay tuned for the latest info, and read more about the AWC here. https://t.co/ZKBzjgwKWv

[Daniel Kalinowski @llamaonsecurity]

@wiz_io BillingMan, prevent unwanted resource consumption with correct set of rules.

[Daniel Kalinowski @llamaonsecurity]

@Dinosn

[Daniel Kalinowski @llamaonsecurity]

@SwiftOnSecurity

[Daniel Kalinowski @llamaonsecurity]

@_JohnHammond This day will be celebrated as "CrowdStroke" day, I can smell the discounts in 2025 ;)