Security Research Engineer 💂 Founder of CTF Team: Hack@Sec 🇳🇵 Crypto and Web w/@hackasec 🕸️ Blackhat MEA 2023/24/25 CTF Finalist 🎩 BBH at Hacker0x01 🐞🇳🇵
NP
Joined June 2017
- Tweets1.7K
- Following2.8K
- Followers1.5K
- Likes5.1K
I_am_Bishal retweeted
Introducing PwnEscape 🦉: a full KVM guest-to-host escape via a Linux kernel networking flaw affecting industry standard hypervisors.
CVE-2026-99999 went from untrusted VM code to host-kernel memory reads, controlled writes, and root command execution. More below:
🤖 Made with AI
I_am_Bishal retweeted
We had an amazing time at #Pwn2Own Ireland 2026 - our 40th Pwn2Own ever! We awarded $1,262,000 for almost 100 0-days. Catch all the highlights at youtu.be/qDTSScQ67Mg?is=CdmJ…
I_am_Bishal retweeted
🏁 Hackअस्त्र CTF 2026 has officially concluded! 🚩
An incredible journey from the Qualifiers to the Finals.
🔥 455 teams
👥 1100+ participants
The online Qualifiers narrowed the competition down to the Top 12 Finalist Teams, who advanced to the Hackअस्त्र CTF Finals 2026.
I_am_Bishal retweeted
Nice write-up!
$148,337 RCE in Google Cloud Production.
brutecat.com/articles/google…
I_am_Bishal retweeted
That's a wrap on Pwn2Own Berlin 2026! 🏆 $1,298,250 awarded. 47 unique 0-days. 3 days of absolute chaos. And talk about main character energy - congrats to DEVCORE for claiming Master of Pwn with 50.5 points and $505,000 - they never slowed down. See you next year! #Pwn2Own #P2OBerlin
I_am_Bishal retweeted
Mind blown alert 🤯! Nguyen Hoang Thach (@hi_im_d4rkn3ss) of STARLabs SG (@starlabs_sg) used a Memory Corruption bug to exploit VMware ESXi with the Cross-tenant Code Execution add-on, earning a sweeeeeet $200,000 and 20 Master of Pwn points. Full win let's go! #Pwn2Own #P2OBerlin
It's changing very fast, it's been more than 5 years doing and don't want to completly stop doing. I still try to stay in game limiting myself to just one good CTF a month will see how this goes, and hoping to see different format and more onesite game 🥲
I started playing CTFs in 2022, and LLMs definitely changed the **competitive** CTF scene a lot, especially since mid-2025. I also started using LLMs in late 2025. Yes, those models did one-shot many challenges, but what's the fun of slopping them? I learned absolutely nothing 🥲
ALT DaveZero's personal opinion towards AI slopping in CTFs. @Srdnlen CTF 2026 Quals Discord server.
I_am_Bishal retweeted
I've been seeing posts all over about the state of CTFs post-LLM. I've seen many attempts to explain why this is just a new evolution of CTFs, but I fundamentally disagree. I believe the original spirit is gone and I've written why in my blog.
kabir.au/blog/the-ctf-scene-…
I_am_Bishal retweeted
That's my chain — a full chain w/ logic bugs only! No memory corruption, no AI, and of course no collisions at all 😉
Confirmed! Orange Tsai (@orange_8361) of DEVCORE Research Team (@d3vc0r3) chained 4 logic bugs to achieve a sandbox escape on Microsoft Edge, earning $175,000 and 17.5 Master of Pwn points. Full win! #Pwn2Own #P2OBerlin
I_am_Bishal retweeted
This should change the opinion of the last person who doubted AI
‼️🚨 Pwn2Own Berlin 2026 just hit a wall. For the first time in 19-years, ZDI rejected dozens of working zero-day RCE submissions because organizers ran out of contest slots.
Rejected hackers are now going public with PoC demos and direct vendor disclosures, breaking Pwn2Own's usual secrecy.
▪️ AI surfaces a massive wave of 0-day RCEs.
▪️ Submissions overwhelm ZDI past max capacity.
▪️ Slots run out. Researchers with working chains get rejected.
▪️ "Revenge disclosures" begin. ← we are here.
Confirmed casualties so far:
▪️ @xchglabs : 86 vulnerabilities prepared (PyTorch, NVIDIA, Linux KVM, Oracle, Docker, Ollama, Chroma, LiteLLM, llama.cpp). All rejected. Now reporting directly to vendors with writeups dropping as patches land.
▪️ @ggwhyp : full-chain Firefox RCE on Windows. Rejected. Publicly demoed (HTML page → cmd.exe → calc.exe). Responsibly disclosed to Mozilla.
▪️ @yunsu_dev : working RCE chain, rejected. Submitting elsewhere.
▪️ @ryotkak : tried to register for 3+ weeks. ZDI confirmed "at maximum capacity, can't add extra contest days." Considered canceling flight and hotel.
▪️ @anzuukino2802 : Claude Code RCE PoC. Rejected.
▪️ @desckimh : 0-day RCEs in Ollama and LM Studio. Rejected.
Reported impact: a community-estimated 150+ researchers tried to register. Accepted contestants are now being warned about collisions. Rejected vulnerabilities going to bug bounty programs may trigger pre-event patches that invalidate the work of those who got in.
ZDI has not publicly addressed the capacity issue. The event still runs May 14-16 in Berlin.
I_am_Bishal retweeted
New blog - documented our CVE research process - patch analysis, setting up debug environments across different stacks, and keeping research organized.
projectdiscovery.io/blog/how…
I_am_Bishal retweeted
Final Black Friday Giveaway!
Win FREE access to:
• 1 CRTP seat
• 1 CRTE seat
How to participate:
1. Like
2. Comment which course you’re interested in and why
3. Repost
If you've already availed the Black Friday offer, you're still eligible.
Winners will be announced on Dec 15, 2025.
Few days left to grab your Black Friday deals:
• Up to 25% OFF Labs & Bootcamps
• No coupon code needed
• Use anytime within 6 months
For More details: alteredsecurity.com/online-l…
ALT Black Friday Giveaway Altered Security
I_am_Bishal retweeted
I did some vulnerability research on bareiron minecraft server project and found 3 vulnerabilities which resulted in RCE:
CVE-2025-69806
CVE-2025-69808
CVE-2025-69809
youtube.com/watch?v=LLTLZ_No…
I've officially passed the Certified Cybersecurity Educator Professional (CCEP) exam! 🎓
courses.redteamleaders.com/e…
