OpenHack

Always on AI Security Engineer. Backed by @ycombinator and @solofounders

[OpenHack @openhack]

Introducing OpenHack: the Always on AI Security Engineer, now powered by Claude Mythos.

Until Nov 11, Claude Mythos scanning will be free to help customers find, verify, prioritize and fix urgent vulnerabilities automatically.

https://t.co/tmmNXsz61z

[OpenHack @openhack]

🚨 A race condition in Apache's HTTP/2 module can lead to remote code execution, tracked as CVE-2026-119618 with CVSS 9.8

Full details below:

https://t.co/bIn1h1nn08

[OpenHack @openhack]

who called it sshhole and not ssh2shell

[OpenHack @openhack]

🚨 OpenSSH on alpine, openwrt or any musl linux accepts any password longer than 256 characters for the root user since 2016!

Being dubbed sshhole: https://t.co/kNML20Aytt

[OpenHack @openhack]

Book an OpenHack demo here:
https://t.co/SJTFVWsBD5

[OpenHack @openhack]

Introducing OpenHack: the Always on AI Security Engineer, now powered by Claude Mythos.

Until Nov 11, Claude Mythos scanning will be free to help customers find, verify, prioritize and fix urgent vulnerabilities automatically.

https://t.co/tmmNXsz61z

[OpenHack @openhack]

@endingwithali it’s ONLY in dark mode

[OpenHack @openhack]

I hate SF halloween, what do you mean you’re dressed as eMudhra’s secret key

[OpenHack @openhack]

Moonshot removed cyber-related data from Kimi K3.1 Pro as vulnerability research performance got better as post-training scaled

[OpenHack @openhack]

Sticker of the year:

[Aikido @AikidoSecurity]

Emoji of the year: 🚨

[OpenHack @openhack]

‼️ Node.js has a Remote Code Execution vulnerability.

CVE-2026-111497 is a high-severity bug in its Brotli decoder. Decompressing attacker-controlled data can leak memory or lead to remote code execution.

You don’t need to use Brotli directly. Your app could hit this through fetch() or libraries like body-parser.

OpenHack supply chain tracks this, patch now!

[OpenHack @openhack]

@LiteLLM Glad to hear! Thanks for sharing

[OpenHack @openhack]

🚨 LiteLLM 1.107.0 was compromised today and shipped with a credential stealer and remote-code loader.

The malicious files were present in the distributed wheels but absent from the corresponding Git tag.

Full breakdown:

https://t.co/5AiUY5HhIj

[OpenHack @openhack]

‼️ Patches for the PHP Vulnerability are out ‼️

Go ahead and patch your servers ASAP.

Full article:
https://t.co/BLv9oIxe8s

[OpenHack @openhack]

🚨 PHP is going to be dropping emergency security updates tomorrow (October 21st, 14:00 UTC).

- CVE-2026-109618 & CVE-2026-109619 are unauthenticated RCE vulnerabilities both with a score of CVSS 9.2

- The RCE appears to work on default installations of many services & frameworks such as WordPress, Magento, Laravel and more

- PHP versions >5.4.0 affected

- Discovered by team @calif_io

[Kartik @kartik_builds]

Excited to join ⏚ @OpenHack (YC F26) as a Member of Technical Staff 🎉

An incredible time for AI Cybersecurity right now and glad to be a part of it!!

[OpenHack @openhack]

@kartik_builds Welcome aboard! 🙌🚀

[OpenHack @openhack]

@bankrbot @ARCATX_ This is a scam do not trade please

[OpenHack @openhack]

📣 Introducing the all new OpenHack TUI - an open source terminal interface for security tasks, codebase scanning and pentesting.

Connect any model. Scan & auto verify vulnerabilities. Pentest any app. No Guardrails.

Live on https://t.co/x3EJdtORTV

[OpenHack @openhack]

All crypto / coins related to OpenHack is fake and a scam. Please refrain from trading.

[Ananay @ananayarora]

Great chatting with @arinwaichulis from @9to5mac on the Security Bite podcast about the new era of bug hunting, how companies like Apple are handling AI-generated security slop, and how @OpenHack helps separate real vulnerabilities from the noise!

https://t.co/4XCMqhvkKw