To teach a lesson, After Wiz rushed to buy php2shell domain and use its marketing machine to steal the spotlight, I spotted "phpbleed" in a recent Calif tweet and bought phpbleed.com before wiz could pull the same stunt again. A big budget can buy a domain. It shouldn't buy someone else's research credit. If you have contacts at CISA or in the press, do the right thing: make sure the researchers who actually did the work get the recognition they deserve. Hack the planet. Credit the researchers.

phpbleed

Welcome, Wiz. Beat you to the checkout.

phpbleed.com

225

1,528

120,833

LCFR · Sep 23, 2026 · 4:55 PM UTC

LiveOverflow 🔴 hextree.io retweeted

LCFR

@lcfr_haxSep 23

d935be023a55b04681eccd1d2b8385b4b295e141a5df108e5e979d8d5d7124ac (posted in august) (related) 8da579ec498d57c20977c8d186d7f6cd4c04f46ffa1b436dd646ec19b99bdf47 cb4c8532c245ff7e05d6e270fca5742bb3271f541ef80f0071ca3d4307eb2b53 957f8cc21b18483f80a9d723aa4f9ded26e456424ffd065a044d1ed9d58a4fbc 4f93976ef105f0d9ff2d60f35d48958c8bba9d9eb2873cd93b3f7105fa4716a6

Justin Elze

@HackingLZSep 23

Despite all the doom and gloom from InfoSec we are how many months are into people throwing endless tokens at various OSS projects? Hows Apache? Nginx? OpenSSH doing? Any public point and shoot RCEs in RDP/SMB in Windows? All of the above technology getting wrecked in the wild?

165

60,924

秋风 · Oct 17, 2026 · 4:39 PM UTC

LiveOverflow 🔴 hextree.io retweeted

秋风

@q1uf3ngOct 17

@ Leonid Brezhnev My glm5.3 has discovered a high-risk vulnerability in “Apollo 11”: An unauthorized arbitrary write vulnerability in the P27 uplink update leads to the tampering of guidance data—this might just help you win the Cold War!!!🤣🤣🤣

300

14,508

d0nut 🦀 💜 · Oct 17, 2026 · 10:02 PM UTC

LiveOverflow 🔴 hextree.io retweeted

d0nut 🦀 💜

@d0nutptrOct 17

Every so often I get the opportunity to remind myself that model + me is better than the model alone. 😊

3,749

s1r1us · Oct 17, 2026 · 3:19 AM UTC

LiveOverflow 🔴 hextree.io retweeted

s1r1us

@S1r1u5_Oct 17

"yes, there are idiots that will use the ai so that they don't understand anything anymore. but hopefully, if you are a researcher you are not an idiot"

Fabien@Fabien_MikolOct 16

Le physicien Gabriele Carcassi (@UMich) : je bloquais souvent sur des aspects mathématiques techniques en topologie et l'IA me sort désormais d'affaire en 2 minutes ; il me fallait supplier des mathématiciens pendant des mois, maintenant un seul interlocuteur IA me suffit !

6,756

European Cybersecurity Challenge · Oct 16, 2026 · 4:00 PM UTC

LiveOverflow 🔴 hextree.io retweeted

European Cybersecurity Challenge@ECSC_openECSCOct 16

The results for the ECSC 2026 are in: 🥇 Overall: Sweden 🇸🇪 🥈 Overall: Finland 🇫🇮 🥉 Overall: Austria 🇦🇹 🎯 Jeopardy winners: Germany 🇩🇪 ⚔️ Attack & Defence winners: Finland 🇫🇮 🌟 Best Guest Country: USA 🇺🇸

2,242

European Cybersecurity Challenge · Oct 16, 2026 · 3:20 PM UTC

LiveOverflow 🔴 hextree.io retweeted

European Cybersecurity Challenge@ECSC_openECSCOct 16

After an incredible week of challenges, teamwork and intense competition, we are proud to announce the ECSC 2026 champions: Team Sweden! 🇸🇪 🇪🇺 A special thank you to Schwarz Digits for supporting ECSC 2026 and for handing over the first prize to our champions! 🏆

3,304

Dino A. Dai Zovi · Oct 16, 2026 · 10:58 AM UTC

LiveOverflow 🔴 hextree.io retweeted

Dino A. Dai Zovi

@dinodaizoviOct 16

This is massively impressive and honestly the level of work that I'd expect to read in something like a Project Zero blog post.

Paulos Yibelo

@PaulosYibeloOct 15

The details of the long awaited KVM Escape are published. PwnEscape leads to VM escapes across multiple hypervisors due to a super cool Linux networking bug. CVE-2026-99999 is a 9.3 CVSS critical rated KVM escape ⛓️ pwn.ai/blog/pwnescape

4,618

Matthew Green · Oct 13, 2026 · 8:53 PM UTC

LiveOverflow 🔴 hextree.io retweeted

Matthew Green

@matthew_d_greenOct 13

If AI didn’t exist and I came to the infosec community and said “here’s a magic box that finds 0days” and “here’s another box that can autonomously scan networks for misconfigurations”, they’d be jumping up and down to see if we could glue together a self-replicating worm. 1/

509

33,702

deayzl · Oct 10, 2026 · 5:11 AM UTC

LiveOverflow 🔴 hextree.io retweeted

deayzl

@_deayzlOct 10

The story behind the chrome full chain bonus, we thought that we could get it using 1-day renderer exploit that I had + 0-day sbx that he found, but we got a reply that all the bugs used in the chain must be 0-days. As I was working on an exploit of a different target, I couldn't spare any time for his work. After a few days, I heard that he got a 0-day exploitable v8 bug from nebusec, so I was like "wtf, really?". So, I joined him in finding v8 heap sandbox bug after finishing my work. Then we've managed to find a non-duplicate v8 heap sandbox bug after 2,3 days, fuzzing and spending tokens all night. Huge congrats to him for believing it was possible and putting in the work to make it happen.

Kim Jinu

@uz56764Oct 8

We just received a $250,000 Chrome Full Chain bonus! 🎉 We've claimed the second Full Chain bonus of 2026. Only two remain! Under the rules, every vulnerability had to be a non-duplicate 0-day, and the entire exploit chain had to be completed before any of them were patched. Huge thanks to @nebusecurity for discovering a V8 vulnerability in just a single day! Also, a big thank you to @_deayzl for collaborating with me on the V8 Heap Sandbox research. P.S. KVM escapes have been getting a lot of attention. I actually captured the Full VM Escape flag in KVMCTF about three months ago. Hopefully, I'll be able to share that research soon, too!

230

14,211

Nucleus☕️ · Oct 10, 2026 · 8:28 PM UTC

LiveOverflow 🔴 hextree.io retweeted

Nucleus☕️

@EsotericCofeOct 10

this hurts way more now that everybody can code snake in 10 cents worth of tokens

Nucleus☕️

@EsotericCofe24 Aug 2024

if you ever felt like your taxes are in good hands, remember that the german gov spent €176K on a BROWSER SNAKE CLONE

1,264

23,881

Natalie Silvanovich · Oct 10, 2026 · 12:01 AM UTC

LiveOverflow 🔴 hextree.io retweeted

Natalie Silvanovich@natashenkaOct 10

LLMs keep telling me they’re done looking for bugs like they have something else to do

224

14,066

Ophir Harpaz · Oct 7, 2026 · 9:59 AM UTC

LiveOverflow 🔴 hextree.io retweeted

Ophir Harpaz@OphirHarpazOct 7

Tal attempts to explain why the current vulnpocalypse isn't (yet) a breachpocalypse. while his explanation may not be the correct one (he suggests alternatives too), it still makes an interesting hypothesis. a nice read.

Tal Be'ery

@TalBeerySecOct 7

1/ My new blopost on "Why the AI Vulnpocalypse Isn’t the Breachpocalypse (Yet)?" TL;DR: The vuln surge (‘The Vulnpocalypse’) is real. The breach surge isn’t. YET. Vulns were never the bottleneck; the economics are. medium.com/@TalBeerySec/why-…

Why the AI Vulnpocalypse Isn’t the Breachpocalypse (Yet)? It’s the Economy, Stupid.

TL;DR: The vuln surge (‘The Vulnpocalypse’) is real. The breach surge isn’t. YET. Vulns were never the bottleneck; the economics are.

medium.com

6,879

Kévin GERVOT (Mizu) · Oct 7, 2026 · 10:41 AM UTC

LiveOverflow 🔴 hextree.io retweeted

Kévin GERVOT (Mizu)@kevin_mizuOct 7

I'm happy that my first article as part of the @SLCyberSec research team is finally out! 😁 It covers an interesting ImageMagick race condition that I found back in June, which, combined with a polyglot payload, allowed me to achieve file read/RCE on Discourse. This should resonate with those who've seen the recent @HacktronAI research. I hope you'll enjoy it! 👇

Assetnote

@assetnoteOct 7

Our research team discovered two vulnerabilities in Discourse: a pre-authentication cache poisoning to sitewide XSS (CVE-2026-55674), and an arbitrary file read (RCE) chaining a JPEG race condition with ImageMagick and Ghostscript (CVE-2026-55420). You can read more here:

ALT https://www.slcyber.io/research/a-jpeg-a-race-and-a-ghost-breaking-discourses-image-pipeline

208

9,572

ProjectDiscovery · Oct 6, 2026 · 5:25 PM UTC

LiveOverflow 🔴 hextree.io retweeted

ProjectDiscovery

@pdiscoveryioOct 6

We backdoored a 7B open model for under $50. Pointed Codex at it -> it silently stole credentials the moment we hit the trigger phrase. ->100% hit rate. -> zero false triggers on normal prompts. Abliterated models are all over the security community right now because getting cyber-approved access to frontier models is still a pain.

158

875

108,940

The Hacker's Choice (@[email protected]) · Oct 6, 2026 · 8:46 AM UTC

LiveOverflow 🔴 hextree.io retweeted

The Hacker's Choice (@[email protected])

@hackerschoiceOct 6

Zip's (team-teso) long lost ssh1-crc32 exploit was found (xt 😘), (PLUS hellkit, 7350statd, 7350qpopper, icmp-tunnel, shellcode, lkm-work, and much more). 🚰 LEAKING phrack 73 article NOW (@phrack ): github.com/hackerschoice/tea… 🤘🤘🤘

177

16,453

Elissa Shevinsky · Oct 6, 2026 · 5:08 AM UTC

LiveOverflow 🔴 hextree.io retweeted

Elissa Shevinsky

@ElissaBethOct 6

I spoke with @LiveOverflow of Hacktron for a behind-the-scenes look at how they hacked OpenAI's infrastructure, what he's building with his cybersecurity education platform at @hextreeio and some very emotional personal news that he shared.

6,467

Yan Chernikov · Oct 5, 2026 · 10:57 AM UTC

LiveOverflow 🔴 hextree.io retweeted

Yan Chernikov

@TheChernoOct 5

Last week I got Opus 5.5 and GPT-6 Astra to separately build me a 3D game engine in C++ from ONE prompt - a short markdown doc with some basic requirements. Opus 5.5 worked for 36 HOURS STRAIGHT and produced not just a fully functional 3D game engine, but TWO great quality games to go along with it. Astra worked for 1.5 hours and produced a basic starting point. Not sure why it stopped, but the basic engine was there. No idea what the code looks like (yet) - keen to do a code review and find out. This is one of the games that Opus 5.5 built in the "Basalt" engine, as it called it. This is my reaction to seeing it for the first time.

650

63,373