samael0x𝟜 ☠

0x4 | Bug Hunter
Credited by Oracle
People are the weakest link.

[samael0x𝟜 ☠ @nerdByt]

🚨 Credited by Oracle in CPU April 2026

Reported a security issue on Oracle infrastructure
→ responsibly disclosed
→ fixed by the vendor
→ publicly acknowledged

Proof 👇
https://t.co/vg9d4r43WE

#halloffame #bugbountytips #oracle

[samael0x𝟜 ☠ @nerdByt]

@GodLDeViL07 @intigriti Congratulations 🎊 👏🏽

[samael0x𝟜 ☠ @nerdByt]

🚨 Credited by Oracle in CPU April 2026

Reported a security issue on Oracle infrastructure
→ responsibly disclosed
→ fixed by the vendor
→ publicly acknowledged

Proof 👇
https://t.co/vg9d4r43WE

#halloffame #bugbountytips #oracle

[samael0x𝟜 ☠ @nerdByt]

🚨 URGENCY + VIRAL

New Critical CVE 🚨
CVE-2026-21643 — Unauthenticated SQL Injection (9.1)
Demo + PoC 👇
https://t.co/BovHhEpcWu

[samael0x𝟜 ☠ @nerdByt]

Quick check:

npm list axios
If vulnerable → assume full compromise.

Fix:
• Downgrade immediately
• Rotate ALL credentials
• Rebuild system from clean image

[samael0x𝟜 ☠ @nerdByt]

🚨 Axios supply chain attack (2026) — this should scare every developer.

100M+ weekly downloads.
No exploit.
No click.
Just npm install… and you're owned. 💀

Attacker took over the maintainer’s npm account.
No code vuln.
No zero-day.
Just account compromise → full access.

[samael0x𝟜 ☠ @nerdByt]

The real weapon = postinstall script

Runs automatically when you do:
→ npm install
No user interaction needed.

Payload behavior:
• Downloads cross-platform RAT
• Executes in ~1.1 sec
• Works on Windows / Linux / macOS

[Chaofan Shou @Fried_rice]

Claude code source code has been leaked via a map file in their npm registry!

Code: https://t.co/jBiMoOzt8G

[samael0x𝟜 ☠ @nerdByt]

@3XS0 hey can you tell me more about this ???

[KNOXSS @KN0X55]

🚨 KNOXSS GIVEAWAY March 2026

✅ Follow us
✅ Like and share this

🎁 Prize: KNOXSS Pro for 1 Month

🏆 Results: March 6th (3 winners)

Want to find some vulns? Get one of our plans and test for #XSS consistently.

Sign up now! 😀 https://t.co/IncubanLjv

#BugBounty #PenTesting

[samael0x𝟜 ☠ @nerdByt]

@IranTimes9 “One stand. Many shadows.” 🔥

[samael0x𝟜 ☠ @nerdByt]

🚨 CVE-2026-22200 — Confirmed & Validated
[ osTicket Arbitrary File Read ]

Manual validation ✔
Root cause analysis ✔
"/etc/hosts" manipulation for controlled testing ✔

🔗 https://t.co/iYzlRcnlFN

#CVE #BugBounty #OffensiveSecurity #AppSec #CVE202622200 #nuclei #osTicket

[samael0x𝟜 ☠ @nerdByt]

@KN0X55 Excited

[samael0x𝟜 ☠ @nerdByt]

#الحمدالله
Successfully worked with a major Enterprise vendor on a Responsible Disclosure. 🐞🔥

Issue resolved. Credit coming in next advisory.

Patience is part of the process. 🛡️

[samael0x𝟜 ☠ @nerdByt]

🚨 Unauthenticated RCE in WordPress
One vulnerable plugin.
One request.
Full compromise.
CVE-2025-13486 Explained + EXPLOITED 👇
https://t.co/ypXaG9S3qU

#WordPress #CVE #BugBounty #CyberSecurity #rce

[samael0x𝟜 ☠ @nerdByt]

Reflected XSS identified via unsanitized error parameter — mapped to CVE-2020-19282.
User input is reflected back without proper sanitization, allowing script execution in the browser.
Minimal PoC used. Reported responsibly.
Now waiting for Response 🕶️

#RXSS #BugBounty

[samael0x𝟜 ☠ @nerdByt]

Blind XSS → Stored XSS → Admin panel execution.
User input from a feedback form reached the backend without proper sanitization.
Impact validated, sensitive data redacted.
#BugBounty #BlindXSS #WebSecurity #InfoSec

[Coffin @lostsec_]

We have only one life, if we can't achieve what we desire, then what's the point of living it?

[Nana Sei Anyemedu @RedHatPentester]

WhatsApp End-to-End Encryption vs. Forensic Extraction

Although WhatsApp uses end-to-end encryption to protect messages, calls, and shared media during transmission, this protection only applies while the data is moving between devices. Once the content reaches the device, it is stored unencrypted within WhatsApp’s local databases and media folders.

Out of the volumes of content, such as 733,543 WhatsApp messages, along with videos, audios, images, and documents.
I was able to get a conversation between my kid sister @ama_Anyemedu in November 11, 2020.

The chat preview shows a typical WhatsApp conversation recovered from a mobile forensic extraction. At the top of the chat, WhatsApp displays the standard banner “Messages are now secured with end-to-end encryption.”

This banner simply means that when messages are being transmitted between two devices, WhatsApp’s servers cannot read them because they are protected by encryption keys stored only on the users’ devices.

However, end-to-end encryption does NOT protect data stored on the device itself.

Mobile forensics work by accessing the phone’s internal storage, not by intercepting messages from WhatsApp servers. Once a device is unlocked or decrypted by the lawful extraction process, the tool can read the local WhatsApp databases stored on the device (usually the `msgstore.db` and related SQLite databases).

This is why, despite the presence of the "end-to-end encryption" banner, the forensic tool is still able to extract:

* Full chat history
* Timestamps
* Participants
* Message contents
* Attachments
* Deleted messages (if still recoverable in the database)

End-to-end encryption protects data in transit, not data *at rest* on the device.
Forensic tools exploit lawful access to the device’s decrypted file system, enabling them to parse and display the stored WhatsApp database, which is why you can see the complete message timeline, content, and timestamps on the right side.