Yacyn;

I hack stuff'-- -

[sagitz @sagitz_]

This is the bug:
https://t.co/dT0gbyj6g1

[Calif @calif_io]

We've reproduced the pre-auth RCE chain in Wordpress (wp2shell). It's real, patch!

Shoutout to @hash_kitten at Assetnote for catching such an awesome bug!

[Yacyn; @yacynx]

@GlobalUpdates24 Fuck them both

@PlayStation you too

[Yacyn; @yacynx]

@BRICSinfo Fuck both

[Yacyn; @yacynx]

@PlayStation Fuck you

[Yacyn; @yacynx]

@petergyang

[Yacyn; @yacynx]

@ruhsuzejderha Bounties 🥲

[vladimir metnew @v_metnew]

Claude Code Full Sandbox Escape (CVE-2026-55607)

writeup: https://t.co/kzJ04Fqu4Y

prompt injection -> code execution on the host.
works even in read-only permissions mode + full sandbox
(it could be my Pwn2Own bug, but p2o was weird this year lol)

[Yacyn; @yacynx]

@brutecat @m0chan98 Insane 🔥

[skull @brutecat]

Hacking Google with A.I. for $500,000

https://t.co/S8NbDU9ZaN

[The Hacker News @TheHackersNews]

🚨 WARNING — New HTTP/2 Bomb exploit targets NGINX, Apache HTTPD, Microsoft IIS, Envoy, and Cloudflare Pingora.

A single client can consume 32GB of server memory in roughly 20 seconds, causing remote DoS conditions.

Details here: https://t.co/58xDxAKRcZ

[Yacyn; @yacynx]

@davi1337_ True

[Yacyn; @yacynx]

@BoringBiz_ If companies replace all workers, people will have no income... so who will buy their products?

[Yacyn; @yacynx]

@rez0__ Noise...

[Tim Becker @tjbecker]

Full technical writeup + exploit technique for this 20-year-old bug in PostgreSQL

https://t.co/xDqhAQWzf4

[s1r1us @S1r1u5_]

when react2shell hit last year, i think vercel handled it brilliantly.

to protect their users, they paid $50,000 for every bypass researchers could find. we decided to participate, and ended up earning $170,000.

read how we did it here: https://t.co/2dM6Mf9PHU

[Yacyn; @yacynx]

@Turki_alalshikh Noway 🤣🤣

[Jamieson O'Reilly @theonejvo]

https://t.co/uTQDBinxjM

[Unit 42 @Unit42_Intel]

Obfuscated #WebSocket backdoors are injecting credit card skimmers into hundreds of compromised websites. The payload sends stolen card information back to attacker's C2 domains. Details at: https://t.co/3UIzhZXYCv

[Yacyn; @yacynx]

Sure, I could publish everything and force them to fix it within hours... but I won’t. I did my part: I tested the app, found the issues, and reported them responsibly. I can live with that. If anything happens, it’s on them for failing to act.

[Yacyn; @yacynx]

This happened to me a few months ago. I tested an app because I was a regular user, and I ended up discovering several serious vulnerabilities, millions of chats, hundreds of thousands of users, their PII, and numerous files were exposed.

[impulsive @weezerOSINT]

if you've ever used Reframe to get sober, your private journals, your craving logs, what triggered you, how bad it got, your name, your email, all of it is sitting in a database that anyone can read without logging in

i unzipped the app and found a database key in a config file. thats it. thats all it took

357,939 users exposed. disclosed april 7, no response