gujjuboy10x00

Another milestone 😍, Its 2.5 years with h1 family and Finally Completed 20k reputation @Hacker0x01 . 2nd indian after @emgeekboy who just joined 20k club Next: more focus on signal #20kclub #togetherwehitharder #bugbounty

You find Claude Code. You check the domain. You run the command. Your Mac is compromised. Our security team traced a live Google Ads campaign that used a genuine Claude page and a hidden download address to deliver the MacSync infostealer. Read the full article to find out why “check the domain” is no longer enough. By @InfosecShinobi, our VP of Security and AI Engineering, @Rajesh_TV , Senior Security Manager, and @vis_hacker, Product Security Tech Lead.

@mattjay we do use ‘safe-chain’ to prevent installation before 48hours for any new packages.

Everyone using Claude code and/or Codex - how are you enforcing them to not pull in new/potentially malicious packages from npm or PyPi?

What if every pull request got a security review as thorough as your best engineer, at any scale? At Deriv, our Security Tech Lead, Vishal (@vis_hacker), built exactly that. Managing 700+ repositories and hundreds of pull requests every week, manual security reviews simply couldn't keep up. Watch below to see his solution

Two CVEs just patched by @Oracle , credited to me: CVE-2026-21996 , CVE-2026-35233 Root-privileged parser eating attacker-supplied ELF. Classic trust-boundary bugs. Advisory: linux.oracle.com/errata/ELSA-20… Write-up: @vis_hacker/hunting-bugs-in-oracles-userspace-dtrace-cve-2026-21996-and-cve-2026-35233-56e3704c9c0b" target="_blank" rel="nofollow noopener">medium.com/@vis_hacker/hu…

@zseano true!!!

bug bounty programs don't care if you focus on them bug bounty programs don't care if you stop focusing on them you are easily replaced.

Watched this and yeah… Claude AI model casually hunting 0-days like it’s a CTF challenge. We’re entering a different era. youtu.be/1sd26pWhfmg

@samm0uda Really impressive bug chaining , learned something new about how seemingly low-impact issues can be combined into full ATOs. Well deserved bounties 🔥

Datr cookie theft and AI leading to Facebook account takeover ($24,000) ysamm.com/uncategorized/… Two-click Facebook account takeover via FXAuth ($30,000) ysamm.com/uncategorized/… Self-XSS in Facebook payments flow leads to account takeovers ($62,500) ysamm.com/uncategorized/…

@Nithin0dha WhatsApp as DR is cool, but… maybe consider an actual secondary WAF/CDN next time? Trading platforms deserve more than a chat-based backup 😅

Cloudflare powers approximately 20-25% of all internet traffic globally. It's the infrastructure behind millions of websites and apps—from content delivery and DDoS protection to DNS services. When Cloudflare has an outage, it doesn't just affect one company; it impacts a significant chunk of the internet simultaneously. Today, they had a brief outage that affected Kite along with numerous other brokers, fintech platforms, and online services worldwide. This is why we built Kite Backup on WhatsApp. This system is independent of our primary systems. When external outages impact Kite, you can still exit your positions through WhatsApp. Only a few thousand people used the WhatsApp service today. Check out the post in the comments for steps on how to use it. We're also actively working on reducing our dependency on Cloudflare. I'm really sorry for the inconvenience today.

I've pushed a few updates to github.com/assetnote/reac…. Vercel and Netlify are no longer flagged as vuln. Offsite redirs not followed. Custom header support in case you need auth or custom UA. Redir test cases are more accurate now (both base path and redir tested).

@_thruster @Hacker0x01 bday bounties!

Birthday bounties hit different on @Hacker0x01!

Facts. Skills, mindset, and consistency.

Do not sign any crypto transactions right now — a major NPM supply chain attack is redirecting approvals & transfers to attacker wallets.

Is the left really just a giant kleptocracy? The evidence increasingly suggests it is.

Last year, I committed to uncovering critical vulnerabilities in Maven repositories. Now it’s time to share the findings: RCE in Sonatype Nexus, Cache Poisoning in JFrog Artifactory, and more! Read it all below 🧵

my daily ritual starts with this youtube.com/watch?v=1S1fIS…

How can this be called a “continuing resolution” if it includes a 40% pay increase for Congress?

Mario Draghi’s critique is accurate. A thorough review of EU regulations to eliminate unnecessary rules and streamline activity in Europe would revitalize growth and strengthen competitiveness. Things should be default legal, rather than default illegal.

Thrilled to release my latest research on Apache HTTP Server, revealing several architectural issues! blog.orange.tw/2024/08/confus… Highlights include: ⚡ Escaping from DocumentRoot to System Root ⚡ Bypassing built-in ACL/Auth with just a '?' ⚡ Turning XSS into RCE with legacy code from 1996

When researching request smuggling, I decided that TE.0 would never be exploitable because it requires the back-end server to accept a HTTP request starting with a number + newline.... and no server would be that crazy 🤦‍♂️ Awesome work! Never under-estimate the crazy.

Our security researcher @hash_kitten found one of the most critical exploit chains in the history of @assetnote. Affecting 40k+ instances of ServiceNow, we could execute arbitrary code, access all data without authentication. You can read our blog here: assetnote.io/resources/rese…