sushrut

how you do anything is how you do everything
prev: founding eng@merlin ai (yc s24), engineer@jlr .
iit bombay '23

[sushrut @sushru7]

CVE-2026-19304 (CVSS 7.7)
one backslash bypasses SSRF guards in IBM's Langflow and CrewAI.
http://127.0.0.1:8080\@1.1.1.1/

Writeup: https://t.co/K2P7ycvHsr

[sushrut @sushru7]

@unfiltered_ajit 23k for a hand job is too much

[sushrut @sushru7]

@fleur18rose chess

[sushrut @sushru7]

@cianlangoutlook @GayBearRes Dude I remembered the Sunny episode with Charlie😭

[sushrut @sushru7]

nice

[sushrut @sushru7]

@adilburaksen bugcrowd triage is retarded

[sushrut @sushru7]

@S_pentest @endlesspain777 @Bugcrowd as long as the source sink is the same a higher impact doesn’t matter. Since they plan on fixing the root cause because of an earlier report, even if your report has more impact, it wouldn’t work once the fix goes through

[sushrut @sushru7]

@njcve_ always in-scope for the black market

[sushrut @sushru7]

@RichardMCNgo guys grow their hair long and suddenly feel like they just have to post the dumbest opinions.

[sushrut @sushru7]

@SCAREFACE_1030 @Hacker0x01 wait for internal duplicate message in a week.
jk bro i hope that doesn’t happen🤞

[sushrut @sushru7]

@orenyomtov this just goes to show that even the biggest projects can have fundamental flaws which can be exploited.
brush up on your OS internals everyone, it's not over yet xD

[sushrut @sushru7]

@adnanthekhan how do you manage costs, do you set a fixed budget or something else?

[sushrut @sushru7]

@actuallyclover only going to get worse btw, idk if they’re even being honest anymore lmao

[sushrut @sushru7]

@zonduu1 v4 pro is terrible, wasted $100 on absolutely nothing. flash is pretty good at basic tasks like enumeration though

[sushrut @sushru7]

why is no motherfucker is racing to solve cancer like this smh

[leo 🐾 @synthwavedd]

I am told the Hodge Conjecture is very close to being verified by OpenAI, and that one of OpenAI or Anthropic are also close to solving Birch-Swinnerton-Dyer. The race to be 'next' behind the scenes is unlike anything I've had described to me before

If true - and it may not be, given the scale of the rumour mill right now - it could mean 3 Millennium Problems fall in the space of a month. Crazy times

[sushrut @sushru7]

SSRF vuln found in @langflow_ai and crewAI

[sushrut @sushru7]

CVE-2026-19304 (CVSS 7.7)
one backslash bypasses SSRF guards in IBM's Langflow and CrewAI.
http://127.0.0.1:8080\@1.1.1.1/

Writeup: https://t.co/K2P7ycvHsr

[sushrut @sushru7]

@ibrahimatix0x01 especially with all the duplicates.
sadly very few are doing it for the love of the game nowadays

[sushrut @sushru7]

absolutely hate it when this shows up.
I thought at least sonnet was fair game

[sushrut @sushru7]

@serros404 I'm building my own harness just for fun. Let's see how it does

[sushrut @sushru7]

@saxenism kind of makes you want to go blackhat doesn't it? maybe if this happens to me enough number of times, i might 🥰