Pinned Tweet
This year I decided to make time to do research as it is a field I'm passionate about. This has resulted in discovering two critical vulnerabilities (CVE-2023-48022 and CVE-2023-48023)
See the below advisory to see how to escalate privs on the cloud from SSRF and file disclosure
The #opensource framework Ray from Anyscale is impacted by 3 critical #vulnerabilties: missing authentication, #SSRF, & insecure input validation. We recommend Ray users refrain from exposing Ray network services to a local network or to the Internet. More in the advisory by @dark1t. #infosec #cybersecurity
bfx.social/40YgQ6z
ALT Critical Security Advisory from Bishop Fox - Ray Framework
darkit retweeted
The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2.
PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.
darkit retweeted
one of my engineers reached out to me about how they struggled to find satisfaction in their work in the age of AI. I asked them if I could publish our brief exchange, and they agreed. I know people are feeling similarly, so maybe they can relate. shubs.io/do-we-still-enjoy-s…
darkit retweeted
Giveaway time!
Up for grabs is 3 free tickets to our “Attacking AI” live course!
Repost and like to enter!
arcanum-sec.com/training/att…
darkit retweeted
New Executive Offense: "RSA 2026: Hot Takes on AI, Agents, and Offensive Security Reality Checks"
(This one is more a an opinion piece but hope you enjoy it 🫶 )
executiveoffense.beehiiv.com…
darkit retweeted
We promised we'd be back!
Join us on our journey, from repro'ing N-days to stumbling into 0-days in SolarWinds Web Help Desk, eventually achieving pre-auth RCE.
This research fuels the watchTowr Platform, our Preemptive Exposure Management technology.
labs.watchtowr.com/buy-a-hel…
darkit retweeted
We hacked the AWS JavaScript SDK, a core library powering the entire @AWScloud ecosystem - including the AWS Console itself 🤯
How did we do it? Just two missing characters was all it took.
This is the story of #CodeBreach 🧵👇
darkit retweeted
1995: The movie Hackers was released. Yes, 30 years ago today. 🤯
It grossed just $7 million at the box office against a budget of $20 million. Ouch. A box office failure, but today it's a cult classic.
Crash Override.
Acid Burn.
Rollerblades.
Floppy disks.
Hack the Gibson!!!
darkit retweeted
When a SSRF is enough: Full Docker Escape on Windows Docker Desktop (CVE-2025-9074)
blog.qwertysecurity.com/Arti…
"How was it found
It was by mistake actually, I did not know much about container separations and its implication"
darkit retweeted
As it turns out, @orange_8361 and I have more in common than I had thought! If you love old school PHP quirks and CTF tricks I recommend you read our articles:
phrack.org/issues/72/5_md#ar…
phrack.org/issues/72/6_md#ar…
darkit retweeted
A las comunidades universitarias de ciberseguridad con estudiantes activos se les invita a la primera reunion de "NoTrustSec x Pwntacles - Student communities".
Registro y mas información:
docs.google.com/forms/d/e/1F…
darkit retweeted
¡Gracias por sus propuestas para #BSidesCDMX 2025!
A los speakers: estén pendientes de su correo, recibirán noticias pronto 📬
Ya comenzamos a armar la agenda! 🗓️
Y gracias al comité evaluador por su gran trabajo:
@phragma @bytevic @Yess_2021xD @dark1t @hecky
#securitybsides
darkit retweeted
Router RCE via the public WLAN interface *which cannot be disabled on your own router without calling the ISP* w/ bonus fault injection via HDD vibrations 🤠
👑King showing by @_r0ny and a shit show by @MEOpt
r0ny.net/FiberGateway-GR241A…
darkit retweeted
🚨🚨🚨 "We found the model attempting to write self-propagating worms, and leaving hidden notes to future instances of itself to undermine its developers' intentions."
darkit retweeted
🚀 We just released my research on BadSuccessor - a new unpatched Active Directory privilege escalation vulnerability
It allows compromising any user in AD, it works with the default config, and.. Microsoft currently won't fix it 🤷♂️
Read Here - akamai.com/blog/security-res…
