wannabe hacker... he/him 🌱 grow your hacking skills @hextreeio
Internet
Joined March 2015
- Tweets10.3K
- Following1.3K
- Followers164K
- Likes6.6K
LiveOverflow 🔴 hextree.io retweeted
Omg I found a copy of the original memory_limit advisory. marc.info/?l=bugtraq&m=10898…
LiveOverflow 🔴 hextree.io retweeted
To teach a lesson,
After Wiz rushed to buy php2shell domain and use its marketing machine to steal the spotlight, I spotted "phpbleed" in a recent Calif tweet and bought phpbleed.com before wiz could pull the same stunt again.
A big budget can buy a domain. It shouldn't buy someone else's research credit.
If you have contacts at CISA or in the press, do the right thing: make sure the researchers who actually did the work get the recognition they deserve.
Hack the planet. Credit the researchers.
LiveOverflow 🔴 hextree.io retweeted
d935be023a55b04681eccd1d2b8385b4b295e141a5df108e5e979d8d5d7124ac (posted in august)
(related)
8da579ec498d57c20977c8d186d7f6cd4c04f46ffa1b436dd646ec19b99bdf47
cb4c8532c245ff7e05d6e270fca5742bb3271f541ef80f0071ca3d4307eb2b53
957f8cc21b18483f80a9d723aa4f9ded26e456424ffd065a044d1ed9d58a4fbc
4f93976ef105f0d9ff2d60f35d48958c8bba9d9eb2873cd93b3f7105fa4716a6
LiveOverflow 🔴 hextree.io retweeted
"yes, there are idiots that will use the ai so that they don't understand anything anymore. but hopefully, if you are a researcher you are not an idiot"
Le physicien Gabriele Carcassi (@UMich) : je bloquais souvent sur des aspects mathématiques techniques en topologie et l'IA me sort désormais d'affaire en 2 minutes ; il me fallait supplier des mathématiciens pendant des mois, maintenant un seul interlocuteur IA me suffit !
LiveOverflow 🔴 hextree.io retweeted
The results for the ECSC 2026 are in:
🥇 Overall: Sweden 🇸🇪
🥈 Overall: Finland 🇫🇮
🥉 Overall: Austria 🇦🇹
🎯 Jeopardy winners: Germany 🇩🇪
⚔️ Attack & Defence winners: Finland 🇫🇮
🌟 Best Guest Country: USA 🇺🇸
LiveOverflow 🔴 hextree.io retweeted
After an incredible week of challenges, teamwork and intense competition, we are proud to announce the ECSC 2026 champions: Team Sweden! 🇸🇪 🇪🇺 A special thank you to Schwarz Digits for supporting ECSC 2026 and for handing over the first prize to our champions! 🏆
LiveOverflow 🔴 hextree.io retweeted
This is massively impressive and honestly the level of work that I'd expect to read in something like a Project Zero blog post.
The details of the long awaited KVM Escape are published. PwnEscape leads to VM escapes across multiple hypervisors due to a super cool Linux networking bug.
CVE-2026-99999 is a 9.3 CVSS critical rated KVM escape ⛓️
pwn.ai/blog/pwnescape
LiveOverflow 🔴 hextree.io retweeted
If AI didn’t exist and I came to the infosec community and said “here’s a magic box that finds 0days” and “here’s another box that can autonomously scan networks for misconfigurations”, they’d be jumping up and down to see if we could glue together a self-replicating worm. 1/
LiveOverflow 🔴 hextree.io retweeted
The story behind the chrome full chain bonus,
we thought that we could get it using 1-day renderer exploit that I had + 0-day sbx that he found, but we got a reply that all the bugs used in the chain must be 0-days.
As I was working on an exploit of a different target, I couldn't spare any time for his work.
After a few days, I heard that he got a 0-day exploitable v8 bug from nebusec, so I was like "wtf, really?".
So, I joined him in finding v8 heap sandbox bug after finishing my work.
Then we've managed to find a non-duplicate v8 heap sandbox bug after 2,3 days, fuzzing and spending tokens all night.
Huge congrats to him for believing it was possible and putting in the work to make it happen.
We just received a $250,000 Chrome Full Chain bonus! 🎉
We've claimed the second Full Chain bonus of 2026. Only two remain!
Under the rules, every vulnerability had to be a non-duplicate 0-day, and the entire exploit chain had to be completed before any of them were patched.
Huge thanks to @nebusecurity for discovering a V8 vulnerability in just a single day! Also, a big thank you to @_deayzl for collaborating with me on the V8 Heap Sandbox research.
P.S. KVM escapes have been getting a lot of attention. I actually captured the Full VM Escape flag in KVMCTF about three months ago. Hopefully, I'll be able to share that research soon, too!
LiveOverflow 🔴 hextree.io retweeted
LLMs keep telling me they’re done looking for bugs like they have something else to do
LiveOverflow 🔴 hextree.io retweeted
Tal attempts to explain why the current vulnpocalypse isn't (yet) a breachpocalypse. while his explanation may not be the correct one (he suggests alternatives too), it still makes an interesting hypothesis. a nice read.
1/ My new blopost on "Why the AI Vulnpocalypse Isn’t the Breachpocalypse (Yet)?"
TL;DR: The vuln surge (‘The Vulnpocalypse’) is real. The breach surge isn’t. YET. Vulns were never the bottleneck; the economics are.
medium.com/@TalBeerySec/why-…
LiveOverflow 🔴 hextree.io retweeted
I'm happy that my first article as part of the @SLCyberSec research team is finally out! 😁
It covers an interesting ImageMagick race condition that I found back in June, which, combined with a polyglot payload, allowed me to achieve file read/RCE on Discourse. This should resonate with those who've seen the recent @HacktronAI research.
I hope you'll enjoy it! 👇
Our research team discovered two vulnerabilities in Discourse: a pre-authentication cache poisoning to sitewide XSS (CVE-2026-55674), and an arbitrary file read (RCE) chaining a JPEG race condition with ImageMagick and Ghostscript (CVE-2026-55420). You can read more here:
ALT https://www.slcyber.io/research/a-jpeg-a-race-and-a-ghost-breaking-discourses-image-pipeline
LiveOverflow 🔴 hextree.io retweeted
We backdoored a 7B open model for under $50.
Pointed Codex at it
-> it silently stole credentials the moment we hit the trigger phrase.
->100% hit rate.
-> zero false triggers on normal prompts.
Abliterated models are all over the security community right now because getting cyber-approved access to frontier models is still a pain.
LiveOverflow 🔴 hextree.io retweeted
Zip's (team-teso) long lost ssh1-crc32 exploit was found (xt 😘), (PLUS hellkit, 7350statd, 7350qpopper, icmp-tunnel, shellcode, lkm-work, and much more).
🚰 LEAKING phrack 73 article NOW (@phrack ):
github.com/hackerschoice/tea…
🤘🤘🤘
LiveOverflow 🔴 hextree.io retweeted
I spoke with @LiveOverflow of Hacktron for a behind-the-scenes look at how they hacked OpenAI's infrastructure, what he's building with his cybersecurity education platform at @hextreeio and some very emotional personal news that he shared.
LiveOverflow 🔴 hextree.io retweeted
Last week I got Opus 5.5 and GPT-6 Astra to separately build me a 3D game engine in C++ from ONE prompt - a short markdown doc with some basic requirements.
Opus 5.5 worked for 36 HOURS STRAIGHT and produced not just a fully functional 3D game engine, but TWO great quality games to go along with it.
Astra worked for 1.5 hours and produced a basic starting point. Not sure why it stopped, but the basic engine was there.
No idea what the code looks like (yet) - keen to do a code review and find out.
This is one of the games that Opus 5.5 built in the "Basalt" engine, as it called it. This is my reaction to seeing it for the first time.