Piyush Kumar (@SilverPoision) header
Piyush Kumar (@SilverPoision) profile picture

I craft weird ASCII patterns that make the internet panic.

India
Joined March 2017
Photo by Piyush Kumar (@SilverPoision)Photo by Piyush Kumar (@SilverPoision)Photo by Piyush Kumar (@SilverPoision)Photo by Piyush Kumar (@SilverPoision)Photo by Piyush Kumar (@SilverPoision)Photo by Piyush Kumar (@SilverPoision)Photo by Piyush Kumar (@SilverPoision)Photo by Piyush Kumar (@SilverPoision)Photo by Piyush Kumar (@SilverPoision)Photo by Piyush Kumar (@SilverPoision)
Piyush Kumar retweeted
Our security researchers built an autonomous cyber vulnerability discovery, exploitation, and patching pipeline. In a single run with an upcoming cyber model, it validated and generated patches for 948 local privilege escalation vulnerabilities in the Linux kernel at a total API cost of $1.2 million.
680
1,341
912
12,827
2,354,425
Piyush Kumar retweeted
Generating strings without parentheses in javascript How to achieve the opposite of jsf*ck: generate arbitrary strings in javascript without using any special characters By Bartosz blog.ikaes.de/generating-str…
5
22
2,785
Piyush Kumar retweeted
Replying to @Suhail
I’ve heard several OAI people say there are unfixable bugs in hardware that are exploitable by AI models directly speaking machine code so even if we could solve software that’s not enough. We need defense to move faster than offense if that’s even possible we may just have a new normal that requires adapting to insecure software (bank transfers require going into a branch and taking a dna test 🤣😬)
188
283
264
4,815
1,367,499
Piyush Kumar retweeted
SITUATION DETECTED: CloudFlare CEO Matthew Prince says he is aware of additional severe vulnerabilities in other pieces of critical software, and said “I think we’re going to have a couple years where every single week it’s going to feel like the sky is falling,” per Reuters.
93
414
142
5,524
524,324
Piyush Kumar retweeted
⚠️ Node.js is vulnerable to remote code execution. CVE-2026-111497 (high): A Node.js process that decompresses attacker-controlled Brotli data can be made to leak memory or run arbitrary code. You’re exposed if your app or a library decompresses bad Brotli data (e.g. the built-in fetch(), body-parser) Aikido detects this. Patches are available.
38
157
98
1,167
257,821
Piyush Kumar retweeted
Irrespective of whether software engineering is coming to an end or not, think of it as a roller coaster ride. You are already on it, so have fun while it lasts. Either it crashes or lands you safely. You have to be optimistic about technology. If things go wrong, it will be the end for everyone. If AI is here to stay and you refuse to adapt, you will be left far behind. Your best bet is to stay positive with tech ... always :)
96
118
18
2,295
67,588
Piyush Kumar retweeted
Bangalore has successfully convinced an entire generation that: ₹25 LPA + 2 hour commute + ₹35k rent + 9 hours of meetings is “I’m doing pretty well.”
213
521
100
9,023
508,584
India mein koi 5 minutes number Google kar le to doodh ka doodh paani ka paani ho jaye. RBI surplus to Govt : ₹2.87 Lakh Crores (US$30 Bn) Total listed bank profits : ₹4.11 Lakh Crores (US$42 Bn) NPCI - which runs UPI pre tax ‘surplus’ : ₹ 1,888 crores (US$200 Mn) To nuksaan kis ka ho raha hai UPI se aur kaunsi subsidy de rahi hai Govt UPI pe jo chubh rahi hai? Cost of running ATMs and cash logistics in India is ₹30,500 crores (US$ 3.0 Bn). If you want to optimise shut ATMs and promote UPI instead. Any levy on UPI is just tax collection. UPI is the one scientific achievement of India everyone acknowledges par ab tax ki bali chadhegi.
UPI Charges Row | Ashneer Grover Exclusive If I transfer ₹1 lakh to my friend through UPI, or I pay ₹3,000 using a QR code, what is the cost of running the system? The cost is the same. So, if I transfer ₹1 lakh to my friend, nobody is making money from it. But if I make a payment of ₹2,500 to a small shopkeeper then the government wants to put charges, what’s the logic? — @Ashneer_Grover speaks to @shreyadhoundial
1,874
14,986
600
59,359
4,400,288
Piyush Kumar retweeted
I hate when VS Code eats up 1GB and takes 7 seconds to start, so I built px0.ai, which does the same things in 20MB of RAM and starts in 1ms. The last time we edited code in an IDE was in 2025, so our IDEs should become read-only but fast. Give it a shot.
326
203
52
4,112
490,093
A logical bug that I've reported to MariaDB has just been disclosed! 🎉 It's a nice logic issue that allows any user (no matter their rights) to update the password of any other user, including root :D You can find more details 👇 hackerone.com/reports/387643…
8
157
25
829
158,484
Piyush Kumar retweeted
Built "deckrun" - that allows you to present your Markdown and self-contained HTML docs easily. Write a deck in plain Markdown, run one command, and it opens a local server and presents it as slides in the browser. A few things worth knowing - - A live editor with a byte-identical preview - Autosaved deck library. - Fully customizable and more importantly - Fourteen themes :) Also, it can help you present self-contained HTML docs as a single continuous page. Everything stays local. The server only binds to 127.0.0.1, and every deck you write is saved to localStorage right there in your browser; nothing is ever uploaded until you choose to export it. Give it a shot and let me know what you think. Hope this helps.
21
16
2
252
18,201
Recently, I've been looking at DOMPurify again, trying to find ways to bypass 3.x.x after browsers started encoding attrs during serialization. I ended up with a nice ≤3.2.6 Safari default-configuration bypass using only SMIL tags/attrs :D Details 👇 mizu.re/post/dompurify-bypas…
4
55
256
11,029
Piyush Kumar retweeted
What started with a simple question on Discord, ended in *reviving an old XS-Leak technique* for probing status codes in background requests! Unravel the mystery with me in the latest @ctbbpodcast blog post:
We know you're all hyped with DEF CON stuff but here's one more thing to get excited about: @J0R1AN just released a new research over at the Critical Research Lab! And this time it was inspired by a discussion we had on our discord, go check it out! lab.ctbb.show/research/solvi…
5
52
3,033
Piyush Kumar retweeted
Introducing XSS2Shell ⛓️: WordPress Core preauth XSS→RCE vulnerability affecting 43% of the internet, discovered autonomously by pwn (using open-source models), affecting all WordPress versions. pwn.ai/blog/xss2shell Please patch CVE-2026-64638 as soon as possible!
30
201
35
977
1,662,377
Piyush Kumar retweeted
We're starting to leave the territory where you'd test an LLM by e.g. "create an svg of pelican on a bicycle". As one idea to generalize it, I was interested what Opus 5 would do if I gave it the first paragraph of the Lord of the Rings, a 1M token budget (~$10) and asked for three js render of it. Opus went off for ~2 hours and wrote 5500 lines of code that (procedurally) rendered the story. It's kind of janky but fun. But it's a bit mindboggling that the LLM has to place and orchestrate various polygon assets in (x,y,z) coordinates and write code that animates it all, and that it even does anything at all. I also like this kind of examples because no one in their right mind would ever spend the time to write something this custom but LLMs have all the stamina and patience in the world, so it's an example where we go from "no one would ever do this" to "sure, why not, it's ~free". There might be a lot more. But I'm excited about creating hyper custom worlds that you can imagine dropping players into, e.g. here to participate in the LoTR story as a spectator NPC, or one of the characters, or etc. Something like an ephemeral GTA of X on demand. Last thought is that the domain of worlds/games exposes a weakness in LLMs: they can't easily audit their work because they aren't able to efficiently and natively perceive videos or play games within them. Here, Opus 5 had to very slowly and painstakingly take screenshots at different points, and it messed up a few times and created a bunch of jank. An example of raw capability (multimodal, gameplay) that I think is still quite lacking.
1,805
2,316
752
29,796
6,308,983
Piyush Kumar retweeted
🚨 CRITICAL: Researchers at Ethiack just dropped an RCE in Ruby on Rails, the wildly popular framework that powers GitHub, Shopify, Airbnb, GitLab, Basecamp, and many more. Update now! Full technical writeup 👇 ethiack.com/info-hub/researc…
3
15
4
37
11,120