rahmetu

fixing printers and Learning how to code, hack :)

[rahmetu @sshbounty]

Yay🥳, I was awarded $750 bounty on @Hacker0x01! #TogetherWeHitHarder It's my first ever bounty. It took me 2 years to get my first payout. Yeah,it took me that long to get a reward and I am so glad I did it. A little tip for those who are struggling with bug bounty hunting

A 🧵

[Yasho @YShahinzadeh]

My First RCE by Reverse Engineering an EXE File With the Help of AI

A secure web app → a JS file leaking a download endpoint → a .NET binary → AI-assisted reverse engineering → a localhost WebSocket with no origin check → RCE

Write-up: https://t.co/CN6VM92hqA

[Critical Thinking - Bug Bounty Podcast @ctbbpodcast]

Double Auth Headers FTW

[Critical Thinking - Bug Bounty Podcast @ctbbpodcast]

Learning Code Review? Master THIS

[zseano @zseano]

i'm taking a pause from hacking to resume building https://t.co/H7tDJivomZ. i regret closing it down and I shouldn't of done it. everything will be back online EXACTLY as it was very soon and i've got some big plans for the future. and yes, that includes zseano methodology v2 ;)

[NetworkChuck @NetworkChuck]

Ever wondered how to hide your most sensitive data in plain sight? 🕵️‍♂️

One file, two different volumes, two different passwords! 

Learn how to create a hidden VeraCrypt volume, a "secret room" inside an encrypted container that only appears if you use a specific password! 🔐

[H4x0r.DZ 🇰🇵 @h4x0r_dz]

cPanel fixed A critical authentication Bypass 🧐 no CVE yet
https://t.co/YNIVPYBUK0

[PortSwigger @PortSwigger]

Meet the Burp Ambassadors: @rana__khalil 🌍

Rana Khalil is a security educator and founder of Rana Khalil’s Academy.

Her mission: make web app testing accessible to more people.

#BurpAmbassador #BurpSuite

[Starter Story @starter_story]

Day in the life of a solopreneur who makes $77k per month:

[David Bombal @davidbombal]

The distance between your dreams and reality is called action.

#DailyMotivation #inspiration #motivation #bestadvice #lifelessons #changeyourmindset

[Douglas Day @ArchAngelDDay]

The best career move I ever made was abandoning traditional employment and doing my own thing!

The "safe" path is not that safe in the long run!

[Yanir Tsarimi @Yanir_]

I've discovered CVE-2026-32173 by steering a single agent

The vuln: you could listen to anyone's AI chat stream on Azure SRE agent. Including LLM thinking, commands, tools.

The auth check was there, but at the wrong place.

Patched. Critical, Information Disclosure. $20k bounty

[Luke Stephens (hakluke) @hakluke]

Me in 6 months

[Shreyas Chavhan @shreyas_chavhan]

Happy to share that my first CVE is now public: CVE-2026-5189

This allowed an attacker to gain unauthorized read/write access to the internal database and execute arbitrary OS commands.

🔗 Public Advisory: https://t.co/onfsv6Bstt

#bugbounty

[Mo @atmoio]

AI is giving every CEO the same advice

[rahmetu @sshbounty]

@GrahamHelton3 You don't how much this has helped me in my journey as well excited for the new one

[Graham Helton (too much for zblock) @GrahamHelton3]

I've begun working on a long overdue follow up to the post I get the most questions about, specifically, how I use obsidian to manage my entire career. A lot has changed since 2023 and it's now more useful than ever.

This will be a long one worth your time

[Dave Kennedy @HackingDave]

Alright, I've stayed away from the Mythos stuff for a little bit. Going to comment on that, but AI as a whole.

First, this AI industry is absolutely insane. I feel like I'm back in the 90s/2000s with innovation, but it's not tempered or methodical - it's pure chaos.

Everyday there is some AI-dude-bro (or gal) clawing for followers claiming end of cybersecurity, end of software engineering, or this breakthrough changes everything. We're seeing the "streamer" effect of video games now exploding in every industry that hasn't been in whatever industry, but is now a AI-expert thus an expert in anything AI touches because they can prompt.

Largely it's not, but what it is doing is requiring us to understand what AI will do to virtually every industry in the future. I'm sitting here right now at a conference I'm presenting at, and I spoke with an individual which was like man... I'm just trying to get through this SAP implementation at my company, I don't even know where to start with AI at the moment.

We are still in the extreme early stages of what AI can do, and I think that's really the exciting part - we are at the infancy stages of this.

Most enterprise can't handle AI, as most companies couldn't handle agile workflow when it came out either, it took time, but eventually adopted.

I won't dive deep into the scalability of releasing AI to the masses based on compute, power, or subsidies because these are real hurdles we need to solve. As you can see with Claude's spike in popularity is causing them to have to dumb the model down upwards of 65% just to stay afloat (Claude is absolutely awful right now for coding - beware).

Mythos is cool, really cool - but it's not earth shattering as claimed. The potential here we are seeing a glimpse of what can actually happen though.

The ability to do extremely complex tasks, with insane context windows, and high-end reasoning. But, what we saw from other current frontier models including open LLMs, they were able to find the same issues, but had to be specifically targeted towards those code sections because of context limitations and complex task reasoning which was drastically improved in Mythos.

What does this mean? Basically. Nothing. It's a lot of marketing hype - but it does prove out that as these models become smarter, it will inevitably produce much better code, be able to work in mind blowing fashions that we haven't seen before - but it will all come down to cost. Right now Mythos is extremely expensive because of the compute needed, and we may solve that over time, but it's not there yet.

The subsidies right now means AI is not ready. Scale is our biggest bottleneck right now and until that's solved, the industry will not move as fast as it could.

What's particularly impressive is how the open models are starting to perform on par (or better) with the frontier models and become way more efficient without restrictions (turboquant) as an example.

Our ability to use near parity models on our own hardware will only continue to get better which is a huge threat for these companies. I at first looked at Cursor's implementation of Kimi as they were falling behind because it wasn't "their own model". That wasn't accurate, its that the open models are performing substantially better than from 6 months ago, and will soon be leading the charge or close to it.

What does this mean for cybersecurity? The industry is changing rapidly, and I absolutely freaking love it. We needed a swift kick in the ass in this industry that was largely stagnant for the past 10-15 years.

What used to be a handful of incredibly talented security researchers that knew systems internals, savants at reverse engineering and reading through millions of lines of ASM is now being afforded to the masses, but still has a long way to go.

The reason AI is so good at doing this stuff is because they paved the way, and will continue to do so in different ways. Not eliminated or removed, enhanced and better than ever. AI is single handedly the largest theft of plagiarism that has ever happened in human history. I just got a 10K check from Claude for ripping off my Metasploit book to train its model to be smarter actually :P

I am all for things that make the world a safer place. Our goal in cybersecurity is to fix the world, make it less harmful when using technology - we should be adopting this. Note that it's going to come with a ton of fluff, hype, doomsday predictions, people that are now AI exports or coding experts but have never written a line of code themselves. That's all to be expected if you have ever been to an RSA conference. AI will product meaningful change in an industry that needed it.

Cybersecurity is much more than bugs or defects, it's protecting against risk. AI is a new emerging risk, it's going to keep us insanely busy right now, and for the foreseeable future.

[Phillip Wylie @PhillipWylie]

Overcoming public speaking fears? Toastmasters is your secret weapon. Recording yourself on video revealed you *don't* look as nervous as you feel. Practice speaking, refine your delivery, and build unshakeable confidence. #PublicSpeaking #Toastmasters

[Web Security Academy @WebSecAcademy]

Here's how to deliver reflected XSS through a HTTP request smuggling vulnerability! 👇

Try this Practitioner lab now: https://t.co/7PTUqvwHSd

[Truffle Security @trufflesec]

🚨 Google told devs: API keys aren't secrets. Gemini changed that.

😱 We found ~3,000 public keys silently authenticating to Gemini - exposing private files, cached data & charging for LLM usage

💥Even Google's own keys were vulnerable.

🔗 https://t.co/UYRE9uCozc