Third Hand

just ordinary people Y_Y

[International Cyber Digest @IntCyberDigest]

‼️🚨 Pwn2Own Berlin 2026 just hit a wall. For the first time in 19-years, ZDI rejected dozens of working zero-day RCE submissions because organizers ran out of contest slots.

Rejected hackers are now going public with PoC demos and direct vendor disclosures, breaking Pwn2Own's usual secrecy.

▪️ AI surfaces a massive wave of 0-day RCEs.
▪️ Submissions overwhelm ZDI past max capacity.
▪️ Slots run out. Researchers with working chains get rejected.
▪️ "Revenge disclosures" begin. ← we are here.

Confirmed casualties so far:
▪️ @xchglabs : 86 vulnerabilities prepared (PyTorch, NVIDIA, Linux KVM, Oracle, Docker, Ollama, Chroma, LiteLLM, llama.cpp). All rejected. Now reporting directly to vendors with writeups dropping as patches land.
▪️ @ggwhyp : full-chain Firefox RCE on Windows. Rejected. Publicly demoed (HTML page → cmd.exe → calc.exe). Responsibly disclosed to Mozilla.
▪️ @yunsu_dev : working RCE chain, rejected. Submitting elsewhere.
▪️ @ryotkak : tried to register for 3+ weeks. ZDI confirmed "at maximum capacity, can't add extra contest days." Considered canceling flight and hotel.
▪️ @anzuukino2802 : Claude Code RCE PoC. Rejected.
▪️ @desckimh : 0-day RCEs in Ollama and LM Studio. Rejected.

Reported impact: a community-estimated 150+ researchers tried to register. Accepted contestants are now being warned about collisions. Rejected vulnerabilities going to bug bounty programs may trigger pre-event patches that invalidate the work of those who got in.

ZDI has not publicly addressed the capacity issue. The event still runs May 14-16 in Berlin.

[Third Hand @p4rcomx]

@0xf4c0 aihhhhhhhhh

[Third Hand @p4rcomx]

@gothburz crossing the line isn't wise

[Third Hand @p4rcomx]

@IndiHomeCare cek dm min

[Third Hand @p4rcomx]

@traveloka cek DM plsss

[Matthew @embee_research]

Decoding a Cobalt Strike Loader with Cyberchef and Emulation

A short video looking into a common CS loader and methods for extracting C2 addresses from Shellcode 😁

https://t.co/2DY4hgNw1k

#Malwareanalysis #Cobaltstrike

[0xblackbird @0xblackbird]

Mega-thread on IDORs

[Arkbird @Arkbird_SOLG]

I share the samples and a Yara rule for the new backdoor #WarHawk used by #SideWinder group.
Samples:
https://t.co/uGO7VNEapB
ref :
https://t.co/RX46TgOOEK
Yara:
https://t.co/QfRupH6Oea
cc @h2jazi @ShadowChasing1 @c3rb3ru5d3d53c @f0wlsec

[Third Hand @p4rcomx]

@traveloka udah saya DM ya min

[Third Hand @p4rcomx]

min @traveloka ini maksudnya gmana ya? jadi gw harus miss flight?

[Third Hand @p4rcomx]

@haeboys @nojenen9 @shortamess @tanyakanrl https://t.co/sSJZJWfubr

[Samir @SBousseaden]

detailed analysis of the BLISTER Loader along with a config extractor h/t @DanielStepanic @soolidsnakee and MARE team

https://t.co/slJZ8g0huM

https://t.co/R65utJNvzv

[Third Hand @p4rcomx]

@indodax kalo lo ga becus ngurus migrasi, mending balikin ke bttold, biar bisa ngirim ke exchange lain dan lo bakal di tinggalin

[Samir @SBousseaden]

Some Detections for this IR report
https://t.co/hGZLzekBCl:

https://t.co/Y3BvgeInbG

https://t.co/9BUpvMjSKE

https://t.co/wRfQ8jxzQu

https://t.co/KryLkzNEaO

https://t.co/DrfDvWTkiy

https://t.co/bGZXazMFJQ

[Stuhli @stuhlonsky]

Hello #DFIR people,
since i often have to look up event IDs when doing analyses, i have structured my bookmark collection a bit and put it into a repo. Not much so far. And since that's how you do it today, I hope it turns into an awesome collection.

https://t.co/IJCMp6dC6o

[Today Cyber News @TodayCyberNews]

31 days of API Security Tips

https://t.co/mDjOzxIJOJ

#HackENews #cybersecurity #bugbountytips #bugbounty #api

[Third Hand @p4rcomx]

@txtdrmks dehhh barambang na taba 😂

[Third Hand @p4rcomx]

@IndiHomeCare hai indihome, mau nanya soal prosedur pemutusan layanan sementara, gimana ya?

[raptor @0xdea]

A cool vulnerability in FreeBSD ftpd

https://t.co/IyyUnqr42h