âfasfasfafs $ARCA

â

[Muqsit 𝕏 @mqst_]

🟧 Cloudflare Zero-day: Accessing Any Host Globally

Blog: https://t.co/XZOYLVidWp

Author: @FearsOff

[Ivan (Adem El Adeb) @Ivanklydz]

unathenticated RCE + unathenticated SSRF that leads to RCE in gitea. Yumm

[Oren Yomtov @orenyomtov]

i just won $200k using this one prompt

[Abhishek @aacle_]

Apple just paid $150,000 for a path traversal.

Not a jailbreak. Not a prompt injection.

A ' ../ ' in a boot process.

https://t.co/GkZxHXn1FV

[Kle0z @Kle0z]

One more on YWH, this time an SQLi Crit!
Wanna join the action?

👉https://t.co/ErlEQXaLv5

- New program/target live notifications
- Report counts
- Submission fees & rewards
- Target types, API, MCP, WEB
- 22+ different bug bounty platforms and more!

[Marius du Preez @mdp_sec]

I made $101,388 hunting bugs in 162 days.

Before anyone treats that as a blueprint, I want to be honest about something.

The compute I used to do it cost $199,501.

[Zee Zee @zee43ze]

Hồi học cấp hai, thầy vật lý nói: "Nhỏ vài giọt mực xanh vào chậu nước, sau đó cho quần áo trắng đã giặt sạch vào ngâm một lúc rồi vớt ra phơi".

Nhờ làm theo cách này, mà quần áo tôi bao năm vẫn như mới!

[BuBu @BooBooCola]

@lcMenci 这种 web fetch 的服务挺多的。我自己给 pi 配置的 provider 就有 https://t.co/aXwrGn70K7, https://t.co/tD4SW9rbEV, defuddle.md 还有 ollama cloud 也提供 web fetch 服务。

但是这些服务都是国外 IP 访问的，有些国内网站是不给国外 IP 访问的

[九原客 @9hills]

不错，1 美元。然后我反手就是一个
pi install pi-commandcode-provider

在 Pi 里面用，美滋滋。

1 美元 = 10 刀（DeepSeek-V4-Pro 可以用 40 刀）

[Kle0z @Kle0z]

This was a 10k USD simple but critical time-based sqli bug i found a while ago, with the help of https://t.co/IzMYJTVaH1 notifications.

> New target went live -> Instant Discord notification
> Basic recon
> Ghauri against api endpoints
> Full db dump

Sometimes its as simple as being first.

[skull @brutecat]

StubZero: $148,337 RCE in Google Cloud Production

https://t.co/m7cBnSTaj4

[giyu_codes @giyu_codes]

thanks for this btw
before and after

[V12 @v12sec]

new fragnesia variant (unpatched)

[SickSec 🇲🇦 🇵🇸 @OriginalSicksec]

Did you know you can Claude Max using Bountylens MCP
https://t.co/KlKF9BDc4T to hunt on target with the least dupe and highest payout automatically

Run it last week and it came with 2 crits and 2 highs
@BountyLens @Hacker0x01

[Philo Groves @PhiloGroves]

11 hours was longer than I expected, but...

https://t.co/FPtae2hi17

[Yasho @YShahinzadeh]

I published one of the techniques that I've been using against OAuth providers, honetly, it's led me to discover many flaws, and recently I used it to find a 1-click ATO on one of the most widely visited websites,I hope you find it useful :-)

https://t.co/o7OO8Y7e3K

[Sachin 🇮🇳 @shinchina_]

I vibecoded "JS+" chrome extension to monitor and scan JS URLs for given targets. Inspired from 0xJS by @4osp3l

https://t.co/RyNuAbC47p

#bugbounty

[shubs @infosec_au]

We got frustrated with dealing with vendor dependencies when reverse engineering large applications. @ITSecurityguard from @SLCyberSec’s Sec Research Team built Hyoktesu to solve this problem forever: https://t.co/rQM2ypLLuW - releasing this today! Blog: https://t.co/KCPSTnFjVN

[Behi @Behi_Sec]

Meet BugSkills.

I built a tool to convert the knowledge and methodology used in your HackerOne reports into AI skills you can use to automate vulnerability discovery.

Thank you @rez0__ for the idea.
https://t.co/Ywb3SXQ2QJ

[Anatomist @th3anatomist]

🚨 We got RCE on Solana 🚨
Finally revealing FULL details about the RCE vulnerability we found 2 years ago.
Found it. Lost it. Exploited it anyway.
🔬 Here’s what real-world bug hunting looks like: https://t.co/k6o6IKtuSW