Abhishek Meena 🏵️

3.6K posts

Abhishek Meena 🏵️

@aacle_

Building @Vulncure ⚡| Helping founders fix vulnerabilities before hackers find them. Talk to me about: Bug Bounties, LLM Security & React.👇 Book a 15-min Demo

Katılım Haziran 2017

284 Takip Edilen47K Takipçiler

Sabitlenmiş Tweet

Abhishek Meena 🏵️@aacle_·5 Ara

We've curated entire API Pentesting Series into a single, auto-updating Notion page. • All existing parts • Future parts added automatically • One link to bookmark Access the full library here: vulncure.com/api-pentest/ap…

English

122

590

29.2K

Abhishek Meena 🏵️@aacle_·1h

8/ What to do today: - Don't open untrusted repos on your main Windows machine. Use Windows Sandbox. - Treat every cloned repo like an npm install from a stranger. - Watch for the patch. Until it ships, git.exe in any repo you open is a loaded file. @Aacle/the-cursor-zero-day-that-sat-through-70-versions-a144c79ae20f?sk=372fde5c15c261ad4685534f0659ba4d" target="_blank" rel="nofollow noopener">medium.com/@Aacle/the-cur…

English

Abhishek Meena 🏵️@aacle_·1h

7/ Why this is bigger than Cursor AI-assisted IDEs aren't editors anymore. They run code, resolve paths, inherit your machine's trust. Most teams haven't audited surface. The bug will get patched. The pattern stays. This is new perimeter for dev teams, and most haven't noticed.

English

Abhishek Meena 🏵️@aacle_·1h

1/ A researcher renamed Windows Calculator to git.exe, dropped it in a folder, opened it in Cursor. Calculator opened. He didn't click anything. One file. One rename. One folder open. Code execution. And it's still not patched after 7 months. Here's the story. 👇

English

387

Abhishek Meena 🏵️@aacle_·6h

The WordPress RCE PoC was built by Claude in 10 minutes. A human would have taken a whole day, maybe days. This is where Claude is now.

SickSec 🇲🇦 🇵🇸@OriginalSicksec

WP RCE POC created by claude 4.6 in 10 minutes

English

620

Abhishek Meena 🏵️ retweetledi

Bug Bounty Insights 🪄@bbr_bug·21h

If your external recon stops at running Amass and a standard Nmap scan over an ASN, you’re missing 80% of attack surface. Real-world hunting means tracking → analytics tracking IDs, → fuzzing VHosts on naked IPs, → and watching CT log renewal clusters. Efficiency > scale.

English

309

Abhishek Meena 🏵️@aacle_·13h

You asked for this enough times that I had to finish it. Part 3 of the MCP Bug Bounty Guide is live @Aacle/prompt-injection-is-just-ssrf-for-text-7c864c73571e?sk=72f8e982df275aaa51704ec32e733d99" target="_blank" rel="nofollow noopener">medium.com/@Aacle/prompt-…

AnmolSecSavvy@AnmolSecSavvy

@aacle_ brooo when we will get MCP part 3?

English

1.2K

Abhishek Meena 🏵️@aacle_·15h

Before you read another take on the WordPress RCE, run the checker. wp2shell.com 5 seconds. Tells you if your site is vulnerable. Not patched? Block /wp-json/batch/v1 in your WAF now.

English

954

Abhishek Meena 🏵️@aacle_·16h

I used to think prompt injection was an AI safety problem. Then I wrote it up as SSRF and the whole thing clicked. → The boundary is the same. → The bug is the same. → The bounty table row already exists. Part 3 of the MCP bug bounty guide: @Aacle/prompt-injection-is-just-ssrf-for-text-7c864c73571e?sk=72f8e982df275aaa51704ec32e733d99" target="_blank" rel="nofollow noopener">medium.com/@Aacle/prompt-…

English

Abhishek Meena 🏵️@aacle_·17h

Bug hunters: stop only fuzzing endpoints. Start reading tool descriptions. Whoever writes an MCP tool's description writes instructions the model will follow and it's a real, reportable vuln most programs are ignoring. @Aacle/the-tool-list-itself-is-the-attack-mcp-bugbounty-series-part-2-107e0311be94" target="_blank" rel="nofollow noopener">medium.com/@Aacle/the-too…

English

939

Abhishek Meena 🏵️@aacle_·20h

43% of the web runs on WordPress. Right now the core itself has a pre-auth RCE before it's fully patched.

shubs@infosec_au

Note on WordPress pre-auth RCE (CVE-2026-63030). There are SQLi poc's out there, but RCE PoC has not yet been exploited in the wild. Will only release our technical post if we have proof of exploitation. Our RCE payload does NOT require poorly configured MySQL.

English

2.3K

Abhishek Meena 🏵️@aacle_·22h

6 tools above. But if you only take one thing from this thread, take this:

Abhishek Meena 🏵️@aacle_

7/ The one that pays more than any tool: read 10 paid, disclosed HackerOne reports per vuln class before hunting that class. Not tutorials. Reports. You learn what "impact" looks like to a triager.

English

1.2K

Abhishek Meena 🏵️@aacle_·23h

Bookmark the ones you'll use. Drop your under-the-radar one below, always looking for more.

English

281

Abhishek Meena 🏵️@aacle_·23h

7/ The one that pays more than any tool: read 10 paid, disclosed HackerOne reports per vuln class before hunting that class. Not tutorials. Reports. You learn what "impact" looks like to a triager.

English

1.4K

Abhishek Meena 🏵️@aacle_·23h

1/ Everyone knows HackTricks and PortSwigger. These are the resources that actually find bugs. Less hyped, higher yield. A short list I keep going back to. 🧵

English

3.5K

Keşfet

@elonmusk @BarackObama @taylorswift13 @cristiano @BillGates @NASA @nikifrancismediavine @katyperry