An Pham
92 posts
@D0ct3rStr Found some 0-day RCEs in Ollama and LM Studio and submitted my entries for Pwn2Own.
Both are still unpatched, so I’m gutted I won’t be making it this time 😢
I’ll be posting the full analysis once the fixes are out :)
English
@j3ssie @D0ct3rStr @thezdi Em gửi email trễ + submissions của em quá nhiều đội đăng kí trước đó, tụi anh gửi ngày cuối nhưng chỉ được nhận 2/7 như trên đó, nên anh đoán vậy.
Tiếng Việt
@thezdi do I really need a Token Assigned for competing Pwn2own ? I've received the invitation letter for Visa before but the process is so vague
Qrious Secure@qriousec
5 folks x 2months x 26 0days : found - fixed - found new - ready to fight 😎 ( We requesting zdi to swap Esxi with LM studio 🙏 )
English
@D0ct3rStr @thezdi ko có token thì không có slot thi nha e, chắc bọn nó quên gửi email no slot cho team em.
Tiếng Việt
This bug being laughed is one I reported to Google.
It was a small side-issue found during my research. But definitely still a security boundary being crossed.
If I perform actions on a site, then I don't want that site being able to steal files I've uploaded on another site
English
Announcing #Pwn2Own Berlin 2026! We've got 10 categories for targets, including an expanded #AI target list. We have 4 AI categories - including coding agents (looking at you #Claude). More than $1,000,000 in cash & prizes available. Read the details at zerodayinitiative.com/blog/2026/3/11…
English
Late good bye to LINE Corp, it was a great experience working as Security Engineer. Thank you my boss @jz__ and my friend @03sunf , I appreciate all the things we did. Here are some recap blog.drstra.in/posts/new-life/
English
@YShahinzadeh @samm0uda I think it's quite easy if you already solved the Amir's chall
English
Yousef (@samm0uda) gave me a challenge few days ago, it's a redesign of Amir's recent challenge, the solution is quite interesting, I was able to solve it in 10 minutes as I'd previously debugged QS library it, I highly RECOMMEND it, the source code:
gist.github.com/samm0uda/91efe…
YS@YShahinzadeh
this is the best challenge of 2026 so far. the idea is crazy. BIG shout out to him for the creatinvity. I think it's very practical due to the inconsistency between layers that happens in daily hunting, HIGHLY recommended =]
English
@AmirMSafari any hint please ? I found out some character in qs.parse with allowPrototypes true causes the parsed value different with URLSearchParams but URLSearchParams is so simple that any character is not stripped or anything so have to use the "redirect_uri" anyway, which cannot bypass
English
Level-Up was very fun.
And I also writeup for this chall.
If you interested in line ctf's chall, I recommend you to read the writeup below.
goldleo1.github.io/posts/line-ctf…
Plain@0xp1ain
Finished LINE CTF in 10th place with hypersonic team due to overlap with another ctf, I only solved one web chall (level-up) (@goldleo01 thanks for your contribution) + advancing to finals with 2nd place in whitehat conteest : )
English
When I started writing Hono 4 years ago, I was alone. Now, Hono has 26K starts, 9M/mo downloads, 687 contributors.
Yesterday. We did Hono Conference. 184 came in person. 184? Who was expecting this? 184 people were there for my software, which I wrote alone. Tomorrow never knows
English
