Co-founder and research @hacktronai | auditing at @cure53berlin | prev @zomato @vimeo @pdiscoveryio @httpvoid0x2f
Joined April 2015
- Tweets3.4K
- Following1.3K
- Followers27.8K
- Likes5.7K
Anthropic's last usable model for cyber was Opus 4.8...Now even in CVP, it cant do shit, and btw CVP on my personal account is rejected again.. I downgraded to $20 plan... @OpenAI's comeback with daybreak and sol for cyber is insane, and massive thanks for the access to individuals.
gotta give it to @OpenAI and their sane daybreak program
heif heist by harsh
kvmescape by paulos
php2shell by lcfr
gitlab rces by joaxcar
chrome full chain by moyix
wordpress rce by hashkitten
all largely thanks to openai daybreak giving researchers access to gpt 5.6 sol.
Harsh Jaiswal retweeted
gotta give it to openai and their sane daybreak program
heif heist by harsh
kvmescape by paulos
php2shell by lcfr
gitlab rces by joaxcar
chrome full chain by moyix
wordpress rce by hashkitten
all largely thanks to openai daybreak giving researchers access to gpt 5.6 sol. anthropic took the opposite approach, gatekeeping access, there is a lesson to be learned here
Harsh Jaiswal retweeted
Let’s set the record straight: @lcfr_hax was the first to discover php2shell and develop a working exploit. See his August 5 tweet: xitter.cf/lcfr_hax/status/208503…
His work convinced the PHP Foundation to invest in fixing this entire bug class. He then worked around the clock to review, test, and retest the patches.
Harsh Jaiswal retweeted
Very excited to share details on the bugs used in our full chain Chrome exploit! We used three bugs (V8 corruption, V8 sandbox escape, and renderer sandbox escape via Crashpad). The third bug is my favorite!
we really want to present heif heist as there's so many things to talk but unfortunately no conference date are aligning.
Harsh Jaiswal retweeted
heif heist?
@HacktronAI moving exploitation base to san francisco
hit us up, would love to meet people.
Dont be sleeping on Heif Heist! Meta paid 100k for my RCE on FB/Instagram!
heif-heist.com/
Harsh Jaiswal retweeted
NEW: Turning the HEIC decoder into a SHA-256 computer
irisc2.com/blog/heic-hashqui…
Agree. At Hacktron we follow 30 days disclosure policy. here’s why:
once a security-relevant fix is committed or released, motivated attackers can monitor commits, diff changes and reverse engineer with capable models to identify the fixed vulnerability and turn that into a working exploit.
people who are least likely to be doing that are the defenders. without a clear public signal that an issue is serious sooner than later, those defenders may have little reason to prioritize an update.
that is why I think the traditional 90 days long embargo model can become counterproductive after a fix is available. It can create a period where sophisticated attackers have enough information to investigate the patch, while a large portion of defenders remain unaware of the urgency. public disclosure changes that asymmetry, security teams can notice that and priortize fixes.
Ive seen this directly in our other research. With the critical BeyondTrust issue we reported (beyondtrust.com/trust-center…), the vendor communicated the issue publicly and urgently, and in our own Internet-wide observations we watched the number of exposed affected deployments fall from thousands to the hundreds within a span of 2–3 days. Similarly, with Next.js, we reported the HEIF Heist issue and, immediately after remediation and release of patched versions, Vercel published a public advisory (vercel.com/changelog/nextjs-…) explicitly warning users about a critical vulnerability in AVIF image optimization and telling self-hosted users to upgrade.
I believe that making the risk visible and get systems patched quickly, not saying go and drop the full exploit, but dont rely on the assumption that attackers will not be able to reverse engineer and exploit during a prolonged quiet period.
this is what we followed with our Discourse disclosure tho we didnt release the exploit to not make it obvious for everyone.
Frontier models have lowered the bar for discovering and exploiting vulnerabilities. This has resulted in an increase of CVEs and workload for both SWE and vulnerability management teams.
And yet the norms around coordinated vulnerability disclosure timelines have remained around 90 days. This timeline worked 10 years ago, but is unlikely to survive much longer. We need to move closer to a window of 30 days.
But in order to do this we need to rely on those same models to accurately fix those vulnerabilities and coordinate the release and deployment of new versions. The primary blocker here seems to be confidence in those models to do that job well, and reluctance to remove humans from that loop.
Every day the probability of another shellshock, log4j, or heartbleed rises. If you were in the trenches for those events then you know how difficult it was to track vulnerable assets, test and deploy patches, and ensure the risk was mitigated.
We shouldn’t wait for a crisis like this to rethink and change these norms. We need to move much faster and that requires shorter disclosure timelines, and removing humans from the vulnerability management loop.
This is the email we sent to Discourse CEO before our blog. Hard agree that 90 days should not be standard anymore.
Frontier models have lowered the bar for discovering and exploiting vulnerabilities. This has resulted in an increase of CVEs and workload for both SWE and vulnerability management teams.
And yet the norms around coordinated vulnerability disclosure timelines have remained around 90 days. This timeline worked 10 years ago, but is unlikely to survive much longer. We need to move closer to a window of 30 days.
But in order to do this we need to rely on those same models to accurately fix those vulnerabilities and coordinate the release and deployment of new versions. The primary blocker here seems to be confidence in those models to do that job well, and reluctance to remove humans from that loop.
Every day the probability of another shellshock, log4j, or heartbleed rises. If you were in the trenches for those events then you know how difficult it was to track vulnerable assets, test and deploy patches, and ensure the risk was mitigated.
We shouldn’t wait for a crisis like this to rethink and change these norms. We need to move much faster and that requires shorter disclosure timelines, and removing humans from the vulnerability management loop.
It sucks that the security community’s frontier moves slower than the developer frontier. New models CVP/TAC access often comes months later and we can't even benchmark properly.
