gujjuboy10x00

Vishal Panchani Security Engineer | Hall of Fame: Google, PayPal, Apple, 500+| Top 10 All-Time on HackerOne | Hack the planet

[gujjuboy10x00 @vis_hacker]

Another milestone 😍, Its 2.5 years with h1 family and Finally Completed 20k reputation @Hacker0x01 .
2nd indian after @emgeekboy who just joined 20k club
Next: more focus on signal #20kclub #togetherwehitharder #bugbounty

[gujjuboy10x00 @vis_hacker]

@mattjay we do use ‘safe-chain’ to prevent installation before 48hours for any new packages.

[Deriv People @DerivPeople]

What if every pull request got a security review as thorough as your best engineer, at any scale?

At Deriv, our Security Tech Lead, Vishal (@vis_hacker), built exactly that. Managing 700+ repositories and hundreds of pull requests every week, manual security reviews simply couldn't keep up.

Watch below to see his solution

[gujjuboy10x00 @vis_hacker]

Two CVEs just patched by @Oracle , credited to me:

CVE-2026-21996 , CVE-2026-35233

Root-privileged parser eating attacker-supplied ELF. Classic trust-boundary bugs.

Advisory: https://t.co/JU5VHDeE6c
Write-up: https://t.co/bAZHt2WSna

[gujjuboy10x00 @vis_hacker]

@zseano true!!!

[gujjuboy10x00 @vis_hacker]

Watched this and yeah…
Claude AI model casually hunting 0-days like it’s a CTF challenge.
We’re entering a different era.

https://t.co/VQIcgg5Bcj

[gujjuboy10x00 @vis_hacker]

@samm0uda Really impressive bug chaining , learned something new about how seemingly low-impact issues can be combined into full ATOs. Well deserved bounties 🔥

[gujjuboy10x00 @vis_hacker]

@Nithin0dha WhatsApp as DR is cool, but… maybe consider an actual secondary WAF/CDN next time? Trading platforms deserve more than a chat-based backup 😅

[shubs @infosec_au]

I've pushed a few updates to https://t.co/9CqANckHK0. Vercel and Netlify are no longer flagged as vuln. Offsite redirs not followed. Custom header support in case you need auth or custom UA. Redir test cases are more accurate now (both base path and redir tested).

[gujjuboy10x00 @vis_hacker]

@_thruster @Hacker0x01 bday bounties!

[gujjuboy10x00 @vis_hacker]

Facts. Skills, mindset, and consistency.

[Jenish Sojitra @_jensec]

You do not need Courses and Certificates to make your first 100k in InfoSec.

[gujjuboy10x00 @vis_hacker]

Do not sign any crypto transactions right now — a major NPM supply chain attack is redirecting approvals & transfers to attacker wallets.

[cygaar @0xCygaar]

I would strongly recommend not signing any crypto transactions right now.

There is a huge supply chain attack on popular NPM packages that may have compromised various crypto websites (frontend, not the actual contracts).

It changes the destination address of transactions and approvals to be the attacker's addresses rather than the address you're actually trying to interact with.

[Elon Musk @elonmusk]

Is the left really just a giant kleptocracy?

The evidence increasingly suggests it is.

[Michael Stepankin @artsploit]

Last year, I committed to uncovering critical vulnerabilities in Maven repositories. Now it’s time to share the findings: RCE in Sonatype Nexus, Cache Poisoning in JFrog Artifactory, and more! Read it all below 🧵

[Suraj @PwnFunction]

my daily ritual starts with this
https://t.co/fkPINYsxzh

[Elon Musk @elonmusk]

How can this be called a “continuing resolution” if it includes a 40% pay increase for Congress?

[Elon Musk @elonmusk]

Mario Draghi’s critique is accurate.

A thorough review of EU regulations to eliminate unnecessary rules and streamline activity in Europe would revitalize growth and strengthen competitiveness.

Things should be default legal, rather than default illegal.

[Orange Tsai 🍊 @orange_8361]

Thrilled to release my latest research on Apache HTTP Server, revealing several architectural issues! https://t.co/7ygwWXY0pd

Highlights include:
⚡ Escaping from DocumentRoot to System Root
⚡ Bypassing built-in ACL/Auth with just a '?'
⚡ Turning XSS into RCE with legacy code from 1996

[James Kettle @albinowax]

When researching request smuggling, I decided that TE.0 would never be exploitable because it requires the back-end server to accept a HTTP request starting with a number + newline.... and no server would be that crazy 🤦‍♂️

Awesome work! Never under-estimate the crazy.

[shubs @infosec_au]

Our security researcher @hash_kitten found one of the most critical exploit chains in the history of @assetnote. Affecting 40k+ instances of ServiceNow, we could execute arbitrary code, access all data without authentication. You can read our blog here: https://t.co/2yTgn1NzhY

[gujjuboy10x00 @vis_hacker]

@h1_sp1d3r @Hacker0x01 Congrats bro!