christian. father. hacker. founder. advisor. podcast: https://xitter.cf/t.co/1aFavJN2h8 blog: https://xitter.cf/t.co/JBPT1CJWJH products: 💻 https://xitter.cf/t.co/iPdpsEAc1h 🤖 https://xitter.cf/t.co/EVhQl8HTlp 📚 https://xitter.cf/t.co/MMmhw0cnaz

/Users/rez0/ai
Joined March 2011
👑 WE WON! 🎉 LFGGGG! @Rhynorater @0xLupin @monkehack and I won MVH at the Google Live Hacking Event in Tokyo last week! It was focused on their AI products. We also had an awesome time in Japan. I'll post some of the highlights below.
46
30
1
554
94,038
hot take: php 0-day is bad. eMudhra's small d is bad. but we'll probably all be fine even if 0-days rain from the sky, nothing happens. there are only so many bad guys. cybersecurity is fake. /s
8
1,746
Joseph Thacker retweeted
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.
144
1,805
397
11,313
892,828
Imagine if they had daybreak red and didn’t fight refusals
gotta give it to @OpenAI and their sane daybreak program heif heist by harsh kvmescape by paulos php2shell by lcfr gitlab rces by joaxcar chrome full chain by moyix wordpress rce by hashkitten all largely thanks to openai daybreak giving researchers access to gpt 5.6 sol.
26
2,445
Anddddd now railway
🚨 Nightmare day for cybersecurity Multiple major security incidents, active exploits, supply chain compromises... If you run production systems, start patching NOW. PHP: Two critical unauthenticated RCEs. Attackers already exploiting them. Patch NOW LiteLLM: v1.107.0 on PyPI and Docker is BACKDOORED. Steals cloud, SSH, and AI credentials. Pin 1.106.2. Rotate secrets. eMudhra: A certificate authority's keys were crackable. Update your browsers, systems, and trust stores. Node.js / Next.js / React: Security releases for Brotli RCE, TLS bypasses, and TWO critical Next.js RCEs. TiDB Cloud: PingCAP breached through stolen credentials. Customer information and other sensitive data exfiltrated. Read the attacker's release, fun stuff. Plex2Shell: Weaponized within HOURS of the PoC. Attackers already deploying cryptominers and proxy backdoors. BeyondTrust / Ivanti: Actively exploited zero-days added to CISA's KEV catalog. BeyondTrust attacks linked to a China-nexus campaign. And that's not even the full list. Patch. Audit. Rotate. NOW.
2
5
32
3,415
Legit one of the coolest products
Yesterday we asked: what if you could turn back the clock? We can’t, but we can see it sooner. Ethiack Zero is live: a public record of emerging 0-days. Open feed, API, MCP and methodology. Check our numbers and tell us what’s missing. zero.ethiack.com
2
18
4,204
Joseph Thacker retweeted
Decision models have old school issues. 😂 Trust No AI
3
2
17
1,745
Joseph Thacker retweeted
To everyone who keeps expanding scope and raising bug bounty rewards in the AI era: Thank you. You’re absolute badasses. 🤘 #BugBounty
3
5
91
3,320
And bug hunters, leave a comment on reports when you’re gonna stop hacking on them. Do so assertively but not disrespectfully. Heres an example of one I recently sent. If we never give them feedback, how can they know to do better?
pay attention bug bounty program owners. if your top hackers are walking away and not submitting anything anymore, then you have failed somewhere. (although let's be honest.. these days *most* programs don't actually care if people stop submitting. they're like "okay w/e")
22
11
5
292
25,619
Wowwwww
92% of 77 CTBBP researchers surveyed have stopped or reduced submissions due to poor program experiences. Fair treatment ranked above bounty size when choosing a new program. Our new research with @ctbbpodcast: The Researcher Attention Problem bugbountymaturity.com/resear…
2
13
3,218
we live in a weird timeline
4
3
92
6,937
Joseph Thacker retweeted
We plugged Google Research’s Harness² into JEV 1.14. Zero weights touched, yet driving massive gains on vision benchmarks round after round. Under the hood, the system: ⚡️ Rewrites its own prompts 🛠️ Builds its own tools 🧠 Distills its own experience JEV-Harness² repo drops soon. Stay tuned.
Google just open-sourced Harness². (turn any harness into a self-improving system) a harness is everything wrapped around the model, like the system prompt, tools, memory, skills, and subagents. today a person designs it once, and the agent runs every new task with that same fixed setup. Harness² lets the agent refine that setup for each new task on its own, with the model weights left untouched. on every task, the agent proposes edits to its harness, runs a few candidate versions, and composes a better harness by comparing how those runs behaved. because it learns from the differences between runs, it needs no correct answer or grader for the task. that covers a single task. Harness² also carries what it learns from one task into the next. after each task, it saves the harness it settled on along with the lessons that held up across the runs. the next time it refines a harness, it starts from those notes instead of from scratch. this means every finished task makes the next round of edits more informed. Google tested this with Gemini 3.5 Flash and GLM-5 on legal, office, and professional work benchmarks. one round of edits was enough to beat their original harnesses, and giving the agent more rounds pushed scores higher. those extra rounds can go wide or deep. the agent either tries several candidate harnesses at once or keeps refining a single one step by step, using OpenCode or Codex to carry out the work. you can find the Harness² repo here: github.com/google-research/h… I wrote about a similar idea for agents already running in production, where the harness should repair itself after a failure instead of waiting for someone to debug the trace by hand. that piece walks through how @Cometml's Opik (open-source) closes this loop, going from a failing trace to a proposed fix to a regression test that stops the same failure from coming back. it's quoted below.
64
286
25
2,750
170,221
Joseph Thacker retweeted
genuinely curious, how do you run one of the biggest routers by volume (possibly #1?) and only have recently applied to daybreak and red??? is no one there focused mainly on cybersecurity?
we coincidentally applied for it a few days ago and it got approved yesterday i don't think anyone is refusing to help us
29
7
4
345
37,196
Joseph Thacker retweeted
I take the bugs from the clankers and bring them down to the bug bounty programs
6
26
2,354
Joseph Thacker retweeted
✈ DeepSeek-V4.1-Flash-1017 is on Ollama! US-based hosting with zero data retention. It's strong on agentic tasks while being cheaper per task. Try it on Ollama Cloud: ollama run deepseek-v4.1-flash:1017-cloud Claude Code: ollama launch claude --model deepseek-v4.1-flash:1017-cloud OpenCode: ollama launch opencode --model deepseek-v4.1-flash:1017-cloud
🚀 DeepSeek-V4.1-Flash-1017 is here! Stronger benchmark performance, faster task completion, and shorter outputs than the previous version—a Pareto improvement in performance and cost. Now live on our website, app, and API. 🛠️ Optimized for @DeepSeekHarness, Tencent CodeBuddy, WorkBuddy, and more. Upgrade to DeepSeek Harness v0.2.1-rc.1 or later for the best experience with the new model. 1/4
107
91
34
1,323
146,101
Follow me too for tips like this 😂
Follow me for such tip 😄 😜😅😂
1
32
3,671
Joseph Thacker retweeted
Last year I thought Threads was an existential risk to X. When Meta puts its full weight behind something -- by injecting the app into Instagram, it’s DEFCON 5: You have to squeeze out every last drop of growth from all available surfaces to save the app. However, I started to realize that the opposite was happening: It was strengthening X. If you look at any announcement by Zuck, you will see the most rude & toxic comments on the internet. But when he makes those same announcements on X, people are thrilled about how he’s pushing humanity forward. X is a place where people are excited about the future, so it’s no surprise he and his top lieutenants are using it more than their own app. Threads — and Bluesky — have effectively quarantined some of the worst people on the internet. And so I had an epiphany: those apps are X’s anti-abuse systems.
1,072
1,184
335
23,223
1,085,068
I know this guy
How does a top hacker prepare for a Live Hacking Event (LHE)? 😏 Let’s hear it from a pro:
7
69
4,577
Joseph Thacker retweeted
Dear @sundarpichai I wear the new Fitbit Air and it does exactly what I’d like it to do. Great product. What I do not like is the Google Health app. When I finish a run I’d like to share a Strava like map with distance and pace info etc I can’t do that today. It shows the map but there’s not even a way to download it, and it doesn’t have any data on it. It also shows the actual street names etc so would dox me. Please hire me for 2 weeks at Google and I will ship this feature myself. Thanks.
1
3
841
Joseph Thacker retweeted
The best practitioner (not lab) AI evals for offensive cybersecurity I follow myself: 1) The @dreadnode dreadindex. Evals al the way down to the vuln category level, and refusals accounting dreadnode.io/research/dreadi… 2) @AikidoSecurity white-box but i've confirmed that it extends to dynamic testing well aikido.dev/aikido-arena 3) BArena by @mdp_sec focused on bounty-like black box bugs. blackboxarena.ai/ 4) @mindfort 's nexbench has info downto the config of a model including thinking or effort setting, and cost per finding, which many omit. mindfort.ai/blog/introducing…
16
65
4
345
177,692
Joseph Thacker retweeted
If Discord is only paying $5k for an RCE in their desktop client, it's probably time to uninstall it
16
98
3
2,354
106,753