Kirill Firsov

Our latest research is out! If you missed a good write-up for nice vulnerabilities, I brought you one! Enjoy the reading! @FearsOff @Cloudflare

@stam_325 I guess better is to upgrade to either 2.x or to jackson

@k_firsov I got hit hard by the Fastjson vulnerabilities. I drove the fix across hundreds of applications, but new issues kept emerging shortly afterward.

We found a gadget-free RCE in Fastjson 1.2.83 - the final release of the 1.x line, and still one of the most widely-deployed Java JSON libraries in production today, even with 2.x around. No classpath gadget. One payload-> RCE.

@stam_325 We still see it in too many apps.

@k_firsov Why are people still researching Fastjson after all these years?🤣

We're doing coordinated disclosure with affected organizations first. Full technical write-up to follow once they've had time to remediate. Stay tuned.

The Fastjson 1.x repo was archived on Oct 23, 2024 - read-only. There will be no patch. The only remediation is enabling SafeMode, or migrating to Fastjson 2.x (which is not affected by this).

@richardvanorton @FearsOff @Hacker0x01 Hackerone(via) paid me almost a million dollars just for 2025 knowing I am an UAE resident. I haven't had any problems with any service as UAE resident. I don't think it's related. I believe there is a mistake done by their new AI features yet they don't want to communicate.

@k_firsov @FearsOff @Hacker0x01 I don't know if it's connected, but many platforms (outside cybersecurity) used to have a blanket ban on UAE residents due to the EU AML blocklist. The EU recently removed the UAE from its list, but historically, the UAE has been on and off.

I got permanently banned from @Hacker0x01. Account deleted. No explanation. Years of work gone overnight. Submission history, achievements, leaderboard ranks, every contribution I made to the security and crypto ecosystems through HackerOne. Wiped, like I was never there.

Maybe their ToS allow them to ban their users randomly, but not giving an explanation for the ban goes completely against the very ethos of ethical hacking/security research: trial and error, hard work, and a constant pursuit of improvement... how are we supposed to do that if we don’t even know what we did wrong?

@k_firsov @FearsOff @Hacker0x01 They are probably planning to launch a competing service against your company? I'm sure they have a clause buried somewhere in their terms of service justifying random bans.

@windhustler This is not true. How did you come up with it?

bug bounty platforms prohibit white hats from providing security services to projects where they score bounties this is perhaps the biggest talent waste there is. You have someone who has spent substantial time breaking a protocol and who's unable to continue contributing to its security how do we change this?

@sb_chadi @Hacker0x01 Hey @grok how would you do it?

We need a serious non profit organism for security researchers You can’t depend on the goodwill of platforms and you can’t have your career achievements denied or deleted whenever it pleases them We are important actors of the ecosystem and yet most of the time we are treated like shit

@0x21SAFE @Hacker0x01 Appreciate the trust.

@k_firsov @Hacker0x01 Hi Kirill, it is sad how unfair is this world. I know that you are one of the best web3 hackers. If you earned that much, and you already have a team. You may start your own bug bounty platform and I will be happy to hunt there.

Today, HackerOne joins Project Glasswing, Anthropic's controlled-access program for Claude Mythos 5. We'll use it to harden our own security and evaluate it across the full CTEM workflow, including discovery, validation, prioritization, and remediation. Two things up front, because researchers will ask. Your reports are not training data. Vulnerability submissions stay where they belong: with the customer and the researcher who found them. And AI is not replacing the bounty model. In the first 6 months of this year, researchers earned approximately $47M in bounties through HackerOne, up 25% year-on-year. More AI on offense and defense means more code shipped, more attack surface created, more reports filed, and more bounty work. What we learn from applying Mythos to HackerOne’s internal scope will be shared with the wider community. Read the announcement. bit.ly/3SW96lx

@bigbrainer33 @WonderU360 @recon33r @Hacker0x01 @yeswehack @jobertabma I am not located in Russia, I live in Dubai, UAE.

@k_firsov @WonderU360 @recon33r @Hacker0x01 @yeswehack @jobertabma i guess that explains it then.

@H_Mosafer @Hacker0x01 The bounty has been paid long before, although I still might have some in the account.

@k_firsov @Hacker0x01 Did they pay the bounty and then ban your account, or did they ban your account without paying the bounty?

@WonderU360 @recon33r @Hacker0x01 @yeswehack @jobertabma The only thing comes to mind that I am Russian but I don't live there for a long time.

@k_firsov @recon33r @Hacker0x01 @yeswehack @jobertabma Surely it wouldn't be due to moral reasons I'm not judging here but most bans on h1 are due to not respecting the TaC I know someone who was banned because the bank account wasn't in their name So you can't tell

@uglybyte @Hacker0x01 We gonna think about it!

@k_firsov @Hacker0x01 That’s insane, hope they make it right otherwise you should prob start your own, I’d join :)

@WonderU360 @recon33r @Hacker0x01 @yeswehack @jobertabma I guess you just need to wait for your turn 😂

@recon33r @k_firsov @Hacker0x01 @yeswehack @jobertabma Nonsense Then why i'm not banned? The only thing i hate about h1 is the triage

@Man8out181406 @Hacker0x01 All bounties had been paid long time ago. It's not the case

@k_firsov @Hacker0x01 Maybe the vendor can't afford to pay you for finding the bug, so they choose to do this 🤔🤔

@KHIZER_JAVED47 Exactly my thoughts

???

@reclu3a @Hacker0x01 Definitely agree with that!

@k_firsov @Hacker0x01 The suspension caused by HackerOne’s mistake is ultimately a loss for both the vendors and HackerOne. I hope they give you a satisfactory explanation and make things right.