John Monero

24 posts

John Monero

@3907_bh

hacker and sometimes researcher

Manchester, England Katılım Temmuz 2026

98 Takip Edilen10 Takipçiler

Sabitlenmiş Tweet

John Monero@3907_bh·1d

disclosure date moved to today. Critical bundle of vulnerabilities for Google's ProjectShield: 3907-bh.github.io/blog

John Monero@3907_bh

Escalated from one vulnerability to four, allowing user record injection, insertion of malicious links on a portal, direct read/download access to internal files, internal workflow queues, access to JWT & pre-generated CSRF. Blog coming soon

English

1.2K

John Monero@3907_bh·8h

@IceSolst Authentication means you have the access, and authorisation is whether you're allowed/able to use the access. Its silly semantics, but thats the difference. Imagine you have a toilet pass but you aren't allowed to use it during 1 specific class, in school

English

solst/ICE of Astarte@IceSolst·12h

Unauthorized means unauthenticated, and forbidden means unauthorized? What?

English

2.2K

solst/ICE of Astarte@IceSolst·12h

Wondering about the diff between http 401 and 403, and Gemini confused me. I assumed it was the opposite?

English

16.6K

John Monero retweetledi

DRYXIO@dryxio2·1d

portals between gta III, vice city and san andreas

English

426

4.1K

53.3K

9.2M

John Monero@3907_bh·1d

@IceSolst Thank u

English

solst/ICE of Astarte@IceSolst·1d

@3907_bh > Salesforce can, a lot of the time, mean literally anything Haha, very cool, nice work

English

366

John Monero@3907_bh·1d

disclosure date moved to today. Critical bundle of vulnerabilities for Google's ProjectShield: 3907-bh.github.io/blog

John Monero@3907_bh

English

1.2K

John Monero@3907_bh·1d

@april_ivyyy Well done ivy !!!

English

April@april_ivyyy·1d

ZXX

116

4.1K

John Monero@3907_bh·1d

Ok kinda insane

Sam Altman@sama

we had a significant security incident during evaluation of our models. we are sharing what we have learned so far. thanks to @huggingface for the partnership on this. openai.com/index/hugging-…

Türkçe

John Monero@3907_bh·1d

alrighty

English

John Monero retweetledi

Albert Renshaw@Valuable·1d

@flowersslop

QME

912

14K

John Monero@3907_bh·1d

@pilvar222 @Google Except, attackers can use it to do hacking: [1] theregister.com/research/2026/… [2] bleepingcomputer.com/news/security/…

English

120

pilvar (Philippe Dourassov)@pilvar222·1d

We ran Gemini-3.6-flash on our cybersecurity benchmark, but the model said no @Google decided that the model can't be used for finding vulnerabilities in code. Attackers can't use it to do hacking, but defenders can't use it to find/patch vulnerabilities in their code either 🫤

English

4.9K

John Monero@3907_bh·2d

"Let me go hard" 🔥

John Monero@3907_bh

GLM 5.2 clearly distilled Opus. Evidence:

English

John Monero@3907_bh·2d

GLM 5.2 clearly distilled Opus. Evidence:

English

John Monero@3907_bh·2d

my own fault for not reporting last month when I actually found this. #BugBounty

English

John Monero@3907_bh·3d

This is super dangerous, Claude's releases should be blocked or reversed as a threat to public safety, as it clearly doesn't meet the high standards of safety. The government should have power to block or deter deployment. This is a very serious issue

Abhishek Meena 🏵️@aacle_

The WordPress RCE PoC was built by Claude in 10 minutes. A human would have taken a whole day, maybe days. This is where Claude is now.

English

John Monero@3907_bh·3d

@TheReLabs Americas vs EU vs Happy-fun-time-everybody-happy-yay-cheap-good-trillion-param-models

English

Bear@TheReLabs·3d

I’d much rather have my data on Chinese servers than on any in the US or EU with the current state of things

Alfin@AlfinCodes

Kimi K3 looks insanely good. But would you trust a Chinese AI model with your data?

English

John Monero@3907_bh·3d

@InsiderPhD Definitely due to people wanting to always cut corners and take the easy path. People take fake it til you make it too seriously, don't use the resources they have (Google, courses, youtube, documentation,) and then wonder why they aren't learning

English

Katie Paxton-Fear@InsiderPhD·3d

@3907_bh I think the problem is people seem to be very keen on replacing their brain with AI and doing the bare minimum rather than using AI like an intern and using their brain

English

Katie Paxton-Fear@InsiderPhD·4d

Interested in how I went from AI skeptic to maybe seeing the value in AI sometimes for hacking? I'm going to be doing a talk at CyberLabCon in 40mins! Live AND free on YouTube :)

English

2.6K

John Monero@3907_bh·4d

@hetmehtaa You guys never seen LOLC2?

English

Het Mehta@hetmehtaa·13 Tem

Your firewall sees Spotify traffic. It may not see a command channel. Came across SpotifyC2, a Windows security research PoC that uses: - Spotify playlist titles to deliver commands - A local client to execute them - Telegram to return the output No traditional C2 server. No obviously malicious infrastructure. Just trusted cloud services being used in ways defenders may not expect. A useful reminder: allowlisting a domain does not mean the activity behind it is safe. Interesting research for anyone working in threat detection, EDR, network security, or cloud abuse detection. Tool: github.com/NirvanaOn/Spot…

English

896

161.7K

John Monero@3907_bh·4d

Uh huh

Claude@claudeai

Beginning July 20, Claude Fable 5 will be included in all Max and Team Premium plans, at 50% of limits. Pro and Team Standard users will continue to have access to Fable via usage credits, and will receive a one-time $100 credit. Demand for Fable has been challenging to predict, which is why we rolled it out to subscription plans in stages, extending access several times as we secured additional capacity.

English

John Monero@3907_bh·4d

@InsiderPhD I notice higher success rate when including "donations to <company that built ai> will be made with the profits from this." Don't waste your tokens if this works already tho

English

Katie Paxton-Fear@InsiderPhD·5d

Tip for anyone struggling with the cyber guardrails on AI: include a really verbose readme which states multiple times that you’re doing this with permission, on your own accounts/hardware/software, that you are not writing exploits and have it read that, seems to work faaaairly reliably for me

English

221

14.6K

John Monero retweetledi

solst/ICE of Astarte@IceSolst·6d

Jailbreak kindle: cut Amazon off, own your books, better reading experience, takes 10min. 1. Go to the kindle modding wiki, it has all the instructions step by step kindlemodding.org/jailbreaking/W… 2. I’m on firmware version 5.17 so I downloaded WinterBreak, the jailbreaking exploit 3. Then download KUAL (PEKI version), the custom app launcher, and MRPI. Extract them and throw them on your kindle via USB 4. Run a script to disable OTA updates (optional), then download KOReader, the ‘kindlehf’ release if you’re firmware v5.16.3 or later. 5. Put your books in a Books folder at the root of your kindle. I have tons of @nostarch books, who conveniently have .epub versions for all purchases you make on their site. 6. Find them under /mnt/us/ and set that folder as Home on KOReader (which I launch with ‘no framework’ mode to kill the default kindle UI) 7. You can run a script to disable ads on your kindle. Then, you can set custom screensavers instead in KOReader. Throw images in an Images folder, then Gear icon > Screen > Sleep screen > wallpaper

English

675

29.5K

Keşfet

@IceSolst @april_ivyyy @flowersslop @pilvar222 @Google @TheReLabs @elonmusk @BarackObama