0xSha

935 posts

0xSha banner
0xSha

0xSha

@0xsha

~2 decades into tech. Security researcher, AI / blockchain engineer, occasional startup CTO, and CS PhD candidate. I build and break stuff, sometimes in public.

Katılım Ekim 2009
742 Takip Edilen10.7K Takipçiler
Sabitlenmiş Tweet
0xSha
0xSha@0xsha·
🐚 wp2shell RCE now needs no cracking. thanks @rez0__ for the nudge. forge a fake WP_Post (route confusion) → it runs a customize_changeset as an existing admin → POST /wp/v2/users makes a new admin → log in → shell.
0xSha tweet media
English
4
54
240
16.7K
0xSha
0xSha@0xsha·
Chinese labs, no top-tier chips: full frontier weights, take them. Anthropic/Fable: I can't help with cyber, that could be misused. OpenAI: hasn't opened anything since GPT-2/OSS. Thank god for Qwen, GLM, Kimi, and DeepSeek. Can't even imagine the gatekeeping level without them.
English
0
0
3
425
0xSha
0xSha@0xsha·
@N3mes1s @rez0__ oEmbed_cache + customize_changeset is the crack-free trick, SQLi still works.
English
0
0
2
44
0xSha
0xSha@0xsha·
Here's wp2shell 🐚 single-file, zero-dependency PoC for the WordPress core pre-auth RCE (CVE-2026-63030 + CVE-2026-60137) one anonymous HTTP request: REST batch route confusion → unauth SQLi → admin hash → shell default install. no plugins. no login. the best of other public PoCs, unified into one file. scanner + full-chain code + deep dive + lab to play 👇
English
6
27
148
25.8K
0xSha
0xSha@0xsha·
SQLi still works
0xSha tweet media
English
1
0
4
1.8K
0xSha
0xSha@0xsha·
🐚 wp2shell RCE now needs no cracking. thanks @rez0__ for the nudge. forge a fake WP_Post (route confusion) → it runs a customize_changeset as an existing admin → POST /wp/v2/users makes a new admin → log in → shell.
0xSha tweet media
English
4
54
240
16.7K
0xSha
0xSha@0xsha·
@rez0__ yes it requires offline cracking correct ! let me check other path mentioned in model answer .
English
1
0
1
137
Joseph Thacker
Joseph Thacker@rez0__·
@0xsha For anybody watching along, I do hate that so many conversations today involve copying and pasting what top models are saying, but it also only makes sense here
Joseph Thacker tweet media
English
2
0
2
144
0xSha
0xSha@0xsha·
@rez0__ ask your agent this check and read --preset users do an unauthenticated SQLI through the batch route confusion and pull admin + the $wp$2y$... hash out of wp_users.
English
1
0
1
128
0xSha
0xSha@0xsha·
@rez0__ correct hash is not directly used you need to crack it -> admin -> plugin upload -> shell.
English
1
0
1
314
Joseph Thacker
Joseph Thacker@rez0__·
@0xsha I had 5.6 analyze your POC and it explicitly says it never uses the hash at all lol.
Joseph Thacker tweet media
English
2
0
1
336
0xSha
0xSha@0xsha·
@rez0__ Sqli does extract the admin hash.
English
1
0
1
312
Joseph Thacker
Joseph Thacker@rez0__·
@0xsha Oh no it’s the same. The exploit doesn’t steal or use the admin hash
English
1
0
2
564
0xSha
0xSha@0xsha·
@kimmonismus If the benchmarks hold up in real-world tasks, Kimi K3 becomes the #1 model. When GPT-5.6 and Fable 5 are heavily restricted on many interesting tasks, raw benchmark performance stops telling the whole story. A model is only as good as what it actually lets you do.
English
0
0
0
112
Chubby♨️
Chubby♨️@kimmonismus·
Official In benchmarks, Kimi k3 is reportedly just behind GPT-5.6 and Fable 5, but ahead of Opus 4.8. However, in terms of price, it’s on par with Sonnet 5. An absolute game changer. Insane!
Chubby♨️ tweet mediaChubby♨️ tweet media
English
151
263
4.2K
305.5K
0xSha
0xSha@0xsha·
Thousands of engineering hours. Thousands of alignment hours. Countless hours building cyber guardrails and gatekeeping frontier capabilities. Then frontier-class open weights dropped. Now gatekeep and guardrail this.
Kimi.ai@Kimi_Moonshot

Introducing Kimi K3: Open Frontier Intelligence 🔹 2.8 Trillion Parameters, 1 Million Context, Native Multimodal 🔹 Kimi Delta Attention enables up to 6.3x faster decoding in million-token contexts 🔹 Attention Residuals deliver ~25% higher training efficiency at <2% additional cost 🔹 Built for long-horizon agentic coding and self-evolving workflows Kimi K3 is now live on on Kimi.com, Kimi Work, Kimi Code, and the Kimi API. Open Weights by July 27, 2026. 🔗 API: platform.kimi.ai 🔗 Tech blog: kimi.com/blog/kimi-k3

English
0
0
1
484
0xSha
0xSha@0xsha·
Early results from GPT-5.6-sol: It’s restricted, Feels closer to Fable-level restrictions, just not quite as bad.
0xSha tweet media
English
0
0
1
565
banteg
banteg@banteg·
new safety refusal just dropped
banteg tweet media
English
12
0
123
21.1K
0xSha retweetledi
DarkGrove Labs
DarkGrove Labs@DarkGroveio·
stop opening 10 tabs to hunt for a job. 🌲 new free tool from the lab: jobaggr. we crawl 10+ niche boards for AI and crypto roles and aggregate them into one feed. ~1k jobs live now, fresh every few hours. free, no signup. 👉 jobs.darkgrove.io
English
0
5
7
686