Midhun Mohanan 🇮🇳

Farmer

[Nebula Security @nebusecurity]

Nebula Security is now backed by Y Combinator.

We’re celebrating by bringing you the world’s first Android 17 root demo — “IonStack”, a url click can let attacker fully control your phone.

This is not only an Android root demo. We’re bringing you a full chain browser-to-kernel exploit with two 0-day vulnerabilities affecting Firefox before v151.0.2 and all Linux distros in 15 years. "IonStack" demonstrates how bad actors can control your phone by sending a malicious URL, but good news, Nebula Security found it before attackers do.

Both 0-day were found by our code scanning agent, VEGA, overshadowing any vulnerabilities found by Mythos or any scanner you name it.

VEGA has demonstrated its extraordinary capability in finding critical bugs in the world’s most complicated software: operating systems and browsers. It can spot the same vulnerabilities in your codebase too.

VEGA support full scan and incremental scan that can integrated into your CI/CD flow. We launched VEGA within YC companies and received overwhelmingly positive feedback. Now it is open to all enterprise customers in private beta.

Book a demo with us: https://t.co/eXHKhnE8gC

[Midhun Mohanan 🇮🇳 @mrgr4yhat]

Another one added to the bucket !

CVE-2026-45233

https://t.co/sCd2hJ6YZW

#CVE #SecurityResearch #AppSec
#CyberSecurity #InfoSec

[Midhun Mohanan 🇮🇳 @mrgr4yhat]

Happy to share that I’ve been credited with CVE-2026-49141.

An authorization bypass vulnerability discovered during security research and responsibly disclosed.

https://t.co/d50oVCeBwV

#CVE #SecurityResearch #AppSec #CyberSecurity #InfoSec

[Midhun Mohanan 🇮🇳 @mrgr4yhat]

Proud to share that I’ve achieved the Burp Suite Certified Practitioner (BSCP) certification ⚡

Certified. Caffeinated. Intercepting requests ⚡☕

Burp Suite Certified Practitioner achieved 💪

Thank you @PortSwigger 🧡

#BurpSuite #BSCP #AppSec #WebSecurity #CyberSecurity #Bug

[Asjid Kalam @odinshell]

netlink OOB 👀👀

on linux 7.0.0-g27d128c1cff6

[Midhun Mohanan 🇮🇳 @mrgr4yhat]

Proud to share that I've earned the HTB CPTS certification from @hackthebox_eu .
First attempt failed due to reporting. Learned, improved, came back stronger.

Months of grind.
Brutally satisfying to get it done 💪

Thank you @hackthebox_eu 💜

#HackTheBox #HTB #CPTS

[Midhun Mohanan 🇮🇳 @mrgr4yhat]

@claudeai

[JS0N Haddix @Jhaddix]

Introducing MSFTrecon -

MSFTRecon is a reconnaissance tool designed for red teamers and security professionals to map Microsoft 365 and Azure tenant infrastructure. It performs enumeration without requiring authentication, helping identify potential security misconfigurations and attack vectors.

https://t.co/LYXjnOGIoF

[OpenAI @OpenAI]

We’re sharing two papers on red teaming, which is an essential part of testing frontier AI models—a white paper on our approach for engaging external red teamers & a research study introducing a new automated red teaming method. https://t.co/JBS6hmRfw4

[mufeed vh @mufeedvh]

Hey everyone!

We’re going official now. Just launched Asterisk on @ycombinator! 🎉

We’d appreciate your upvotes and feedback!

https://t.co/AxtORKESGc

[Clint Gibler @clintgibler]

😈 Bypassing EDRs With EDR-Preloading

@MalwareTechBlog describes “EDR-Preloading,” which involves running malicious code before the EDR’s DLL is loaded into the process, enabling you to prevent it from running at all

🛠️ PoC: https://t.co/FMessXiRgc

https://t.co/yWKIRPrZeW

[Duncan Ogilvie 🍍 @mrexodia]

Looks like you can debug x86 malware on the Apple M1 Pro using https://t.co/HlKOcGODnx! 🥳

[Clint Gibler @clintgibler]

📦 Simulator: A Kubernetes security training platform

Creates a Kubernetes cluster in your AWS account; runs scenarios that misconfigure it and/or leave it vulnerable, trains you in mitigating them

→ 9 CTF scenarios

By @controlplaneio

https://t.co/w4v70q2AnY

[Gabriel Moncha @gabimoncha]

Me finding that one web developer interested in learning React Native

[Vozec @Vozec1]

I have implemented the latest CVE-2023-7028 to Account Take-Over on GitLab completely automatically. (CVSS10):
➡️https://t.co/LoxGR1IYUm

[mufeed vh @mufeedvh]

Just released pdfrip v2.0.0! 🎉

A fast multi-threaded PDF password cracking utility equipped with commonly encountered password format builders and dictionary attacks.

GitHub: mufeedvh/pdfrip

[Sam Altman @sama]

we have re-enabled chatgpt plus subscriptions! 🎄

thanks for your patience while we found more gpus.

[John Wu @topjohnwu]

Magisk v26.4 is released to the stable channel 🎉

This marks the end of v26 releases, and will start to focus on new and more exciting stuffs for v27!

[Altered Security @AlteredSecurity]

Congratulations to @mrgr4yhat for clearing our Certified Red Team Professional exam!
#ADLab #CRTP #AlteredSecurity cc @nikhil_mitt
https://t.co/Ieu8xslmiS