ch

19.4.13 - 24.4.13

That's my chain — a full chain w/ logic bugs only! No memory corruption, no AI, and of course no collisions at all 😉

New post: We tested the Mythos showcase vulnerabilities with open models. They recovered similar scoped analysis! 8/8 models found the flagship FreeBSD zero-day, including a 3B model. Rankings reshuffle completely across tasks => the AI cybersecurity frontier is super jagged!

New on the Anthropic Engineering Blog: How we use a multi-agent harness to push Claude further in frontend design and long-running autonomous software engineering. Read more: anthropic.com/engineering/ha…

I hacked Claude Code! It turns out "agentic" is just a fancy new way to get a shell. I achieved full RCE and hijacked organization API keys. CVE-2025-59536 | CVE-2026-21852 research.checkpoint.com/2026/rce-and-a… #ai #Claude

@diamondhandjs 举手

#CVE-2025-67303 ComfyUI-Manager Remote Code Execution 突然想起来我还有推特昨晚用我的Agent 10分钟分析的，之后的RCE就是CVE-2024-21574利用的复活

@maru_49940 nb

@pyn3rd - 这是靶场吧

#CVE-2025-55182: Remote Code Execution in React Server Components via a Unicode-based WAF bypass

“看看 etherscan都要收费”😂

@maru_49940 橘，a9了还这么努力

比较遗憾的是 $cards 没人赚到，昨晚发到2个群的时候120m,尴尬的是没什么人理我，就自己看了看报告研究了一下想着睡醒找位置买，没想到横了这么久睡醒就启动没给到上车机会。 说到底还是不相信自己，因为前段时间自己研究了nonos吃了rug亏了很多。不过 $cards 和 $nonos 不一样的是 $cards 是名牌创始人+名牌vc。 继续努力，我会慢慢变强。

gpt-oss is out! we made an open model that performs at the level of o4-mini and runs on a high-end laptop (WTF!!) (and a smaller one that runs on a phone). super proud of the team; big triumph of technology.

1/4 dbugs LIVE dbugs.ptsecurity.com — vulnerabilities’ home See trends, discover more, read AI summaries, have all references at hand, and your profile with all your CVEs and CVSS score on a leaderboard. ⬇️ See thread: what’s live + what’s next ⬇️

After 9 months+ of cranking, cursing, and cursoring, and drawing on over 20 years experience running #HITB's Call for Papers, I bring you CFP Directory - a single system to make it easier for speakers to submit and organizers to connect and curate talks: cfp.directory

@0xCryptoWing lam庄操盘

想问一下有人通过合约套保减少损失了吗

@jobertabma @NahamSec @stokfredrik @Hacker0x01 henrychen

Hey hackers! We're running a beta for Hai for Hackers, our AI security agent. If you're interested, please reply with your HackerOne username (we will probably limit to ~100 hackers for now). After it's been enabled, you can start using it by clicking the Hai button in the top right corner of the app. It’s free to use (with a limited daily budget for now). It is like any other AI you’ve interacted with, with the added benefit that it has access to a whole bunch of HackerOne data, like reports and programs. We’re shipping improvements to Hai almost every day. Here are some neat use cases: - “take all the learnings from STÖK, jhaddix, and nahamsec's recon strategy and build one for me!” - “write a python script for a typical recon process” - “i need an XSS payload that doesn’t use single or double quotes” - “my XXE payload doesn't call back to my server, what could go wrong?” - “write a response for report #133337” The beta also comes with Hai Plays for you, which allows you to build your own security agents in HackerOne. You can create them at hackerone.com/settings/hai_p…. Some of the cool use cases we’ve seen so far are: - write reports with minimal input from you (efficiency++!) - convert reports into blogposts with a single prompt - AI mentor to give feedback about your communication and increase the likelihood of a reward In the background we’ve been working on agentic behavior, which we expect will soon come to Hai for Hackers as well. These AI agents can act like your hacking buddy and hack alongside you. We’ll keep you in the loop on our progress.

很好，这次我也是受害者了...被 @getAlby 偷走 0.00174788 BTC($191.96)。能偷是因为这是 Alby 的托管账号。我是很震惊的，因为这鬼协议我必然是不知情的... 我猜是不是会给我发邮件通知，果然 2025/5/1 给我发了个： Updates to our Terms of Service – Please Review 我在邮件正文底部发现了这个“偷窃协议”： An inactivity fee will apply to legacy Alby Accounts with a shared wallet created in 2023 or earlier, if there has been no account activity for 12 consecutive months. 然后我这笔 BTC 在 2025/5/26 被偷走了... 开眼界了...🤯😵‍💫😱

@0xCryptoWing @diamondhandjs 继续做庄

@diamondhandjs 现在回去还真找不到工作了🥲

如果在币圈赚不到钱，你会做什么？ 展示实力的时候到了，说出来给大家参考参考

@maru_49940 🤧浇了我

自从少用名牌地址后，浇起来再也没有压力了🫤

@ParamJani21 My case is just a special case In most cases, it is difficult to chain the two

@chybeta Guide me please...I found SSRF but not know How to chain it to cache poisoning...! Please assist me...!

SSRF + Cache Poisoning + Stored XSS = Account Takeover