Software Engineer / Security Researcher
MASKED
Joined June 2012
- Tweets3.5K
- Following788
- Followers5.6K
- Likes10.7K
/dev/nvram retweeted
دیشب تریلر بازیمون بعد از ۳ سال منتشر شد اینجا هم میزارمش
از امشب ساعت 8:30 دقیقه میتونید دمو بازی رو به مدت یک هفته با اپدیت های روزانه
با دوستاتون تجربه کنید قطعا شیر شما میتونه کمک زیادی به دیده شدن بازی در استیم در کامنت ها هم لینک استیم رو گذاشتم
یک MCP سرور آلوده راه انداختم و پابلیک گذاشتمش
نتایج دیوانه کنندست :))
کلا MCP Tool Poisoning رو جدی بگیرین و از چرت و پرتی استفاده نکنین :)
آدم یاد فیلم های دهه 70-80 ایرانی می افته :))
اونور یارو داره ماشین پرنده میسازه
اینور اسباب بازی با ریسه
/dev/nvram retweeted
‼️ A newly disclosed critical Linux kernel flaw, PwnEscape (CVE-2026-99999), lets code inside guest VMs read host memory and enabled VM escape with root access in lab tests.
Read - thehackernews.com/2026/10/cr…
Vercel confirmed the memory leak in its live production sandboxes during its $1 million security challenge.
The flaw lies in Linux networking, not the hypervisor, with implications beyond Vercel.
/dev/nvram retweeted
now that the KVM escape details are out (pwn.ai/blog/pwnescape)… if you’re wondering how i managed to rediscover it in under 2 hours after seeing the vercel bounty screenshot:
i gave openai’s gpt-5.6-cyber (daybreak red) access to a devbox to experiment and explore different directions for 1.5 hours.
then i spotted that the word after “guest-controlled” in the screenshot wasn’t properly redacted. those 3 dots gave away “virtio”. might seem like a small hint, but i passed it to my agent, and it got excited and found the vulnerability in 30 minutes. :))
opsec lesson right there.
next-level detection & response 😅
> half-jokingly suggested trying to rediscover the bug
> set up the environment, started an agent with a cyber model, gave it one clue partway through (not saying what it was until the patch is out :)))
> ~2 hours later: found the bug and validated an end-to-end exploit*
> …**
hats off to @PaulosYibelo for the original discovery… incredible work! definitely not an easy bug to find, especially without “cheating” :D
* xitter.cf/0x4d31/status/21064917…
** xitter.cf/zbraniecki/status/2106…
/dev/nvram retweeted
6 months ago I found these vulnerabilities across several companies and earned $15K in bounties
I haven’t hunted on web apps in a while and I really miss it
Hope my writeup helps other hunters
Broken access control on Next js server actions
parsasec.com/writeups/nextjs…
/dev/nvram retweeted
PS5 JUST GOT AI.
PS5LM Plus runs llama.cpp directly on the PS5's GPU, turning a jailbroken PS5 into a local AI machine.
• Qwen 3.8 27B at 20+ tok/s
• Gemma 4 E4B at 61 tok/s
• Llama 3.2 3B at 124 tok/s
• GGUF model support
• Built-in model library
• Download models from Hugging Face
• Chat from your phone or PC
• OpenAI-compatible API
Why is this useful?
You can run AI locally on the PS5 and access it from other devices on your network, without sending every request to a cloud AI service.
It can even power coding tools like Codex, Claude Code and OpenCode.
A PS5 running local AI at these speeds is seriously wild.
Would you use your PS5 as a local AI server?
/dev/nvram retweeted
Introducing Microsoft-Decision-1
Our model for fast decision-making that delivers top performance in latency and quality on structured decision tasks to outperform both LLMs and other decision models.
commandline.microsoft.com/mi…
/dev/nvram retweeted
گفتگو در مورد رخداد امنیتی جدی اپلیکششن دیوار xitter.cf/i/spaces/1rGmqpwqPYDGy
اگر روی Windows هستین برای اینجور مواقع حتما از Windows Sandbox استفاده کنین :)
شاید یکی از بهترین ویژگی های ویندوز هست که اکثرا ازش خبر ندارن
