Shesha

Speaker | Trainer - AppSec | OSWE | OSCP | CISSP. Tweets or likes are my bookmarks to access those on PC, mobile or in transit.

[Shesha @security_sesha]

One more awesome cert from OffSec #OSWE #offsec

[GMO Flatt Security株式会社 @flatt_security]

セキュリティリサーチャー RyotaK @ryotkak の技術ブログを公開しました。

今回、Claude Code GitHub Actions の権限制御を外部の GitHub Issue 経由でバイパスし、ワークフロー権限を悪用できる脆弱性、並びにそれに付随する設定ミスを発見・報告しました。

当該の脆弱性は v1.0.94 で修正済みですが、設定ミスについては各リポジトリにて対応が必要であるため、当該製品を利用されている場合は設定の見直しと実行ログの確認を推奨します。

https://t.co/6hjfE6xrsb

[Shesha @security_sesha]

https://t.co/q9sL3fZrMG

[Crusaders of Rust @cor_ctf]

Offensivecon 2026 talks are out! Check out the Minecraft 1-click RCE talk from our teammate @ryaagard at https://t.co/15gKKqwh5y😎

[Shesha @security_sesha]

Have a few speaker passes for DeveloperWeek NY + AI DevSummit NY, June 9–10 at TWA Hotel, NYC.

Good fit for devs, AI builders, eng leaders & startup folks.

DM if interested — sharing while they last.

https://t.co/TUdirlXBBf

#DeveloperWeek #AIDevSummit #NYC

[fwd:cloudsec @fwdcloudsec]

Tomorrow (June 1) is fwd:cloudsec North America! If you can't be there, watch the live stream:
Day 1, Room 1: https://t.co/bAHuLsL24j
Day 1, Room 2: https://t.co/Ms5oRp9LX4
Day 2, Room 1: https://t.co/IW0I85CTJE
Day 2, Room 2: https://t.co/KiRZnY3JXq

[Vivek | Cybersecurity @VivekIntel]

AI-Powered Red Team — 28 Specialized Agents for Offensive Security 🤖🔥

Turn Claude into a full pentesting team.

• 28 agents (Recon, AD, Web, Cloud, Mobile)
• Auto task routing → correct agent
• Real tools support (nmap, sqlmap, nuclei, BloodHound)
• Recon → Exploit → Report

🔗 https://t.co/DvJVKM2hY9

#artificialintelligence #RedTeam #Pentesting #cybersecurity #infosec

[johnny @zeroxjf]

New writeup with PoCs! I used Codex to follow breadcrumbs from @calif_io’s Mythos-assisted Apple M5 memory-integrity bypass demo & see what I could recreate from the outside.

Didn’t rebuild the chain, but did find 2 new macOS kernel bugs along the way.

https://t.co/H9QJUCpgSf

[starlabs @starlabs_sg]

4 RCE chains across 4 LiteLLM versions, each patched within days of working.

What started as #Pwn2Own Berlin prep turned into a race against the vendor’s commit log.

https://t.co/OFB7GBIosm
By @bestswngs & @bruce30262

[Gray Hats @the_yellow_fall]

Apple open-sources its Apple post-quantum cryptographic code and verification tools, revealing a hidden ML-DSA digital signature bug.

#AppleSecurity #PostQuantumCryptography #PQC #OpenSource #CyberSecurity #Cryptography #iMessage
https://t.co/vUCfDv2jiA

[Youming Lin @SudoR00tMe]

OffensiveCon Berlin 2026's conference videos are out.

Do check it out!

https://t.co/ckefJJlBl7

[Behi @Behi_Sec]

I had a few bugs like this😃

Bad Vibes - Pwning Coding Agents 70 Times With The Same Bugs.

https://t.co/lfnD70Iimk

[Shesha @security_sesha]

https://t.co/HTdYEGVEXI

[Preben @prebenve]

Found a cool bug at Meta.

From misconfigured Grafana instance to R/W access on 507 private Meta repositories.

Wrote up the full chain here:
https://t.co/LYQ0prc68d

$157k bounty awarded by @metabugbounty

[amrit @amritwt]

Ramanujan will forever be the standard for the smartest human alive

[Nicolas Krassas @Dinosn]

A Deep Dive into npm Supply Chain Attacks and Defense https://t.co/QGud1v3eVX

[Vivo @vivoplt]

Research papers you must read for AI Engineer interviews:

1. Attention is all you need (Transformers)
2. LoRA (Low rank adaption)
3. PEFT ( Parameter Efficient Fine Tuning)
4. VIT (Vision Transformers) 5. VAE (Variational Auto Encoder)
6. GANs ( Generative Adversarial Networks)
7. BERT ( Bidirectional Encoder Representation from Transformers)
8. Diffusion Models (Stable Diffusion)
9. RAG (Retrieval Augment Generation)
10. GPT (Generative Pre-trained Transformers)
11. MoE (Mixture of Experts)
12. RLHF (Reinforcement Learning from Human Feedback)
13. LLaMA (Large Language Model Meta AI)

[obscaries ❘ AppSec @obscaries]

Gitleaks, a really solid open-source secret scanning tool for detecting accidentally exposed credentials in repositories and CI/CD workflows.

It can help identify:
• API keys
• AWS credentials
• GitHub tokens
• database passwords
• private keys
• OAuth secrets

One leaked secret can sometimes lead to full infrastructure compromise, which is why tools like this are heavily used in modern AppSec and DevSecOps pipelines.

Definitely worth checking out for source code review and security automation workflows.

Source: https://t.co/9PRoXZ0Xim

#CyberSecurity #BugBounty #AppSec #DevSecOps #InfoSec #GitHub #Recon #SecretScanning

[skull @brutecat]

StubZero: $148,337 RCE in Google Cloud Production

https://t.co/m7cBnSTaj4

[ProjectDiscovery @pdiscoveryio]

[NEW BLOG]

Red-Teaming Cloud Infrastructure with Neo

We gave Neo a single prompt against an test AWS environment - no step-by-step guidance, no hints. It exploited a CI/CD auth bypass, extracted production secrets from build configs, pivoted to AWS via IMDS, and chained through a private subnet to reach the production database.

11 findings. 3 Critical. ~2.5 hours.

https://t.co/1u2GKeDUrt

[Help Net Security @helpnetsecurity]

AI red teaming agents change how LLMs get tested - https://t.co/THaPs7kWEM - @dreadnode #AIsecurity #RedTeam #LLMsecurity #CyberSecurity #AISafety