(a.k.a. SuperHei) ZoomEye https://xitter.cf/t.co/fzvFAoPrvG SeeBug https://xitter.cf/t.co/ldKpbho6eg KCon https://xitter.cf/t.co/46w4vXpfkv AiPy https://xitter.cf/t.co/bFgrqc8h9s,Team: 0x557

Joined March 2011
Pinned Tweet
Anthropic Cowork looks great, but it’s Claude Max + macOS only for now. AiPy has been doing "AI works on your computer" ("Vibe Working") for ~1 year — free + Windows/macOS/Linux. EN: aipy.app/ | ZH: aipyaipy.com/ | CLI: github.com/knownsec/aipyapp @AiPyapp
1
1
3
3,884
Just trying to cd into my Solana/Agave runtime codebase and OpenAI Safety decided dev/agave/runtime is a threat to national security. 😭 Turned Daybreak ON, and it still got blocked with: "Some cybersecurity requests are still limited, even when Daybreak is on." Is cd now a zero-day exploit? @thsottiaux 😅😅😅
3
3
26
1,739
Wo~~ Master Gu has joined GLM! Congratulations to @Zai_org I think A\ might not be able to sleep!
New journey, new mission! Thrilled and grateful for the opportunity to help build a safer cyberspace with the power of frontier AI @Zai_org
20
3,104
heige retweeted
Don't worry, many guys has 200+ cases with the same sitituation, they are worrier than you :-)
two months ago, I reported a critical bug to @msftsecresponse, but it has received no attention since. It's disheartening. I still appreciate the company, but there's no denying that their bug bounty program requires improvement 💔.
1
2
53
8,005
heige retweeted
I used /goal + ASC + adb to analyze my phone. The agent pulled 50+ APKs with uid=1000, then used ASC to analyze them without exporting any pseudocode. After 10 hours, the agent had rooted my phone...😐 #mobile #bugbounty #security github.com/MG1937/ASC xitter.cf/MGAldys4/status/209854…
Guys, I built a super fast Android decompiler called ASC. It completely replaced Jadx MCP for me and lets me analyze 10+ APKs in parallel. And this week my Agent use ASC found 2 RCE in Honor and Xiaomi! This tool now accepted by BlackHat EU Arsenal github.com/MG1937 #BHEU
18
63
2
598
51,867
heige retweeted
Guys, I built a super fast Android decompiler called ASC. It completely replaced Jadx MCP for me and lets me analyze 10+ APKs in parallel. And this week my Agent use ASC found 2 RCE in Honor and Xiaomi! This tool now accepted by BlackHat EU Arsenal github.com/MG1937 #BHEU
26
168
12
1,140
178,955
heige retweeted
2020 年的 Surface Duo
84
6
3
136
57,192
heige retweeted
Introducing GLM-5.3-Flash - Leading capabilities at a highly competitive price - Natively multimodal with a 1M-token context window - A 320B-A18B model released under the MIT License - Previously previewed as Ox Alpha, running entirely on Chinese AI chips Blog: z.ai/blog/glm-5.3-flash Available now across all official platforms: Weights: huggingface.co/zai-org/GLM-5… API: docs.z.ai/guides/llm/glm-5.3… Coding Plan: z.ai/subscribe ZCode: zcode.z.ai/en Chat: chat.z.ai AutoClaw: autoclaw.z.ai
1,000
2,608
2,012
23,793
6,978,010
Hard to believe OT exposure is still this widespread in 2026. (ps:ZoomEye data includes honeypots/test systems, but the trend holds). With LLMs accelerating vuln research, ICS will face even more pressure—7 Siemens CVEs entered CISA KEV in 2026. siemens.com/en-us/content/ce…
2
4
1,197
I have updated the CVE repo (github/Proteas/apple-cve) to include all (maybe) of the data from the past 25 years, covering 2001 to 2026. :)
3
18
1
121
15,131
梁文锋他真的我哭死😭
120
134
29
1,214
339,810
heige retweeted
My #BHUSA 2026 slides are online! It was an honor to share our AFD research and how a different perspective led to 30+ Windows kernel vulnerabilities. Blog post coming soon — check out the slides here: i.blackhat.com/BH-USA-26/Pre…
4
148
6
513
71,437
I’m amazed that the phpcodz project (github.com/80vul/phpcodz) from 10+ years ago has now been turned into a Skill. The LLM era is keeping the classics alive!
wp2root as promised :-) blog.calif.io/p/the-wordpres… Our chain is nothing fancy. Its value is in showing what real-world PHP hacking actually looks like, and how far AI has come. Cooking up a chain like this would usually take a skilled operator a few weeks; we did it with Codex in under an hour. The slow part was writing this article, explaining each step for readers without that background. This is how hacking is becoming. You write clear English prose describing what to do, and the model does it. Feed our article to your favorite model and it will happily reproduce the whole chain. But that raises a harder question. Directing the model takes knowing what is possible, and that knowing usually comes from having done the work yourself. If the model does the work from now on, where does it come from? We learned it the slow way, by hand, over years. How the next person learns it, once the slow way is optional, we honestly do not know. We do know one thing, though. You can outsource the hacking, but not the understanding.
1
11
1,732
Kimi K3’s performance in vulnerability research has been genuinely surprising, while DeepSeek Flash 0731 continues to push its price-to-performance ratio even higher. Apple’s machines have already gone up in price—and Spark is next.
1
10
1,748
heige retweeted
when root runs 'su - user1' interactively and exit, user1 becomes root
3
1
5
1,634
heige retweeted
谁做的,,,,无语了好恐怖
🤖 Made with AI
193
79
25
1,302
326,363
I haven’t submitted a vulnerability report in many years, and now I’m genuinely baffled. How can a company of Apple’s caliber still be putting up barriers that make it so difficult for security researchers to report vulnerabilities?
4
13
3,171
Tsecbench上线20天累计3196个ai跑分5262次,日均承载跑分任务260次,收到大家不少反馈。我们也在不断完善试题集和功能,今天云端托管跑分模式正式上线,欢迎大家来测试。 tsecbench.zc.tencent.com/
1
2
16
2,978
Releasing the model weights and technical report of Kimi K3. Kimi K3 is our most capable model: a 2.8T MoE model with native visual understanding and a 1M-token context window. New model architecture: 2.5x the intelligence per unit of compute, not just more params. Alongside Kimi K3, we're opening up more of the stack behind it — high-performance attention kernels, MoE communication library, and infrastructure for running agent environments at scale. Model weights: huggingface.co/moonshotai/Ki… Tech report: github.com/MoonshotAI/Kimi-K… Tech blog: kimi.com/blog/kimi-k3
1,544
7,191
2,353
46,015
14,746,993