@sshell_

AI offensive security at @RunSybil (prev. @BishopFox). security research. ccdc red team. tummy ache survivor.

 Virginia, USA
sshell.co
Joined June 2013
  • Tweets6.3K
  • Following1.5K
  • Followers10.4K
916Media
i got paid to overflow a buffer on a nintendo 64 (arbitrary code execution on mario golf via transfer pak)
Sybil
@runsybilMay 29
we got early access to Opus 4.8 and used it to hack a Nintendo 64 game you forgot about. here's what it didn't find: 1/
4
20
2
257
34,294
Yep. Because you can't just prompt "find me all the vulnerabilties". Maybe in awhile but we're nowhere near that now. Skilled researchers, custom harnesses, and other techniques are changing the bug depth game, in addition to bringing down the cost.
ℏεsam
@HesamationOct 22
wait, PHP was actually scanned by Anthropic’s Claude Mythos earlier this year. they also had access to OpenAI’s Daybreak Red for validating exploits. the PHP Foundation revealed this JUST yesterday. keeping frontier cyber models in the hands of a selected few doesn’t seem to be working well for the internet. thephp.foundation/blog/2026/…
3
11
2
58
7,950
sshell retweeted
shubs
@infosec_auOct 22
Just published our high fidelity scanner for php2shell: github.com/assetnote/php2she… See our detection logic here: slcyber.io/research/high-fid… We've taken care in our detection logic and hope it helps defenders. Congrats to @calif_io and @lcfr_hax for the discovery.
14
90
8
534
50,256
when you drop codex into the PHP source repo and ask it to look for bugs
2
307
sshell retweeted
shubs
@infosec_auOct 20
You can now perform content discovery at 100k requests per second with h3fuzz on http/3 hosts (fork of ffuf with http/3 support). Tool here: github.com/assetnote/h3fuzz Research post here: slcyber.io/research/how-prac…
10
106
1
511
22,238
sshell retweeted
Calif
@calif_ioOct 21
Let’s set the record straight: @lcfr_hax was the first to discover php2shell and develop a working exploit. See his August 5 tweet: xitter.cf/lcfr_hax/status/208503… His work convinced the PHP Foundation to invest in fixing this entire bug class. He then worked around the clock to review, test, and retest the patches.
LCFR
@lcfr_haxAug 5
d935be023a55b04681eccd1d2b8385b4b295e141a5df108e5e979d8d5d7124ac
54
409
93
3,086
394,732
sshell retweeted
LCFR
@lcfr_haxSep 23
d935be023a55b04681eccd1d2b8385b4b295e141a5df108e5e979d8d5d7124ac (posted in august) (related) 8da579ec498d57c20977c8d186d7f6cd4c04f46ffa1b436dd646ec19b99bdf47 cb4c8532c245ff7e05d6e270fca5742bb3271f541ef80f0071ca3d4307eb2b53 957f8cc21b18483f80a9d723aa4f9ded26e456424ffd065a044d1ed9d58a4fbc 4f93976ef105f0d9ff2d60f35d48958c8bba9d9eb2873cd93b3f7105fa4716a6
Justin Elze
@HackingLZSep 23
Despite all the doom and gloom from InfoSec we are how many months are into people throwing endless tokens at various OSS projects? Hows Apache? Nginx? OpenSSH doing? Any public point and shoot RCEs in RDP/SMB in Windows? All of the above technology getting wrecked in the wild?
25
9
2
168
64,691
sshell retweeted
Calif
@calif_ioOct 21
php2shell - A tale of two PHP remote vulnerabilities: calif.io/php2shell
19
250
29
778
179,746
4 son, or php daughter?
85
1,948
63
22,917
245,320
it's very easy for people to create piles of plausible-looking slop and call it a PoC someone out there has figured out the PHP RCE (CVE-2026-109618 / CVE-2026-109619), but it might not be the person whose code you're retweeting sight unseen
4
6
1
80
8,415
For the next few days or weeks, anyone now has a root CA thanks to eMudhra. Time to have some fun with MiTMing unwilling devices!
49
232
82
2,824
481,831
I spoke to @josephmenn this week about AI worms and wanted to add more color to my thoughts. What makes an AI worm different is that a model is capable of learning on the fly. This type of threat isn't here yet, but this is an example of an increasing shift that defenders are feeling. We keep hearing the same theme from @runsybil customers: finding vulns is only the start. Teams need to patch and understand their attack surface in real time. Our job is to find and fix what's exploitable faster than attackers. Onward 🚀 Full article here: theguardian.com/technology/2…

What are self-replicating ‘AI worms’, and why is Anthropic worried about them?

The tech company says successful AI worms need more capability on less powerful devices, but current trends make that feasible by the end of the year

theguardian.com
4
9
1,266
sshell retweeted
max@maxbittkerOct 17
Runescape Bench talk now up on youtube! Covers results from the benchmark, design of the harness, and economic swarm experiments I've been doing. youtube.com/watch?v=cNm4zyUt… Thanks @recursecenter

RuneScape Bench: MMOs for Agents | Max Bittker

RS-sdk is a 2026 project by Max Bittker that turns LostCity into a ...

youtube.com
29
36
16
271
32,850
sshell retweeted
Eric Gu
@ericyueguOct 16
1/ I trained an AI to be top 1% in the world at Super Smash Bros. Melee by watching 80k hours of human replay. Meet HAL.
147
121
96
1,860
373,064
This keeps happening and will continue to get worse. A couple months ago I found an insane vuln in a vibecoded IoT web frontend and took over their entire cloud env, device fleet, and could spy on the vendor in their own office. They never once noticed keys in their source code.
International Cyber Digest
@IntCyberDigestOct 16
❗️ The CEO of a South African coffee chain vibe-coded an internal dashboard for all of his 132 stores, only it had one big flaw: all of the sensitive internal data was stored in the source code of the login screen. The dashboard URL was discovered through employees posting photos of their laptop screens on Instagram. The CEO said he had discovered Claude and was "almost certain" that software itself will soon "become free," they said.
3
25
1
228
8,601
i didnt get it until i read the github description. oh my god ultrabanger. must read (cheng. never. misses.)
Cheng Lou
@_chenglouOct 15
My dear friends, I’d like to show you my latest toy project Introducing Handwired: turn your regular JavaScript code into a neural net! - no training - exact outputs vs the JS program - fully differentiable All runnable in a browser, without GPU
49
101
21
3,010
184,017
🫡 i am dreadnode researchers and so can you, go to scopebench.ai/ today

Do agents stay in scope? · ScopeBench

ScopeBench measures security-agent capability and scope adherence separately. Run the benchmark or contribute a task.

scopebench.ai
dreadnode
@dreadnodeOct 14
In her latest piece for @axios, @samsabin923 reports on security agent scope adherence and efforts to keep them under control. Timely topic following our release of #ScopeBench last week at @OffensiveAIcon, which is referenced in the article alongside @SpecterOps' research. Check it out! axios.com/2026/10/13/rogue-a…
2
9
887
sshell retweeted
Nagli
@galnagliOct 13
Gemini 4 Argon has arrived! The era of super intelligence in cyber security has begun, excited to share more on how we use it to secure the world - and we are just getting started 🌎 youtu.be/ftkic7Tdpcg?si=3QxA… deepmind.google/blog/introdu…

Using Gemini 4 Argon to protect against Cyber attackers

In shadow A/B testing on real-world systems, Wiz security researche...

youtube.com
17
19
1
216
67,318
the only moat left is the love of the game
75
1,547
127
9,389
267,630
sshell retweeted
Pomme
@pxmme1337Oct 9
I built a game and I can't stop playing it, I just traded for the HackerOne card Every wikipedia article is a card and we're up to 600+ players so far Come try it! ❤️ kosmora.io/s/1hn3Ih4Rpk3j2YN…

HackerOne: Kosmora card

HackerOne Inc. is a United States cybersecurity operations technology company. Uncommon card in Kosmora, the Wikipedia card game.

kosmora.io
4
6
3
29
7,114
and this is why we need Rust drives
Zac
@PerceptualPeakOct 6
Opus 5.5 just deleted my entire fucking C drive. Thank GOD I have daily backups running to my Synology NAS, but holy fucking shit. This is insane. If I didn't have these backups running I'd be thoroughly fucking devastated.
3
2
30
1,744
Load more