Pinned Tweet
Every 90 days-sometimes 180-there's a attack bubbling over Indian soil. Our intel folks stop it cold. Not luck, they live it: heartbeat-by-heartbeat, sleepless nights, family second. I clap loud. Don't you dare underrate that
For the people 🇮🇳
jai Hind jai jawan jai kisan 1/4
cat /etc/shadow retweeted
Happy Navratri everyone 🙌💫
May She shower her divine blessings upon you, guide and protect you, and fill your home with happiness, health, and prosperity.
Worst banking services are provided by Indian banks fuck your services always down when needed
@AxisBank @SBICard_Connect @IDFCFIRSTBank @HDFC_Bank @ICICIBank @kotakneo
cat /etc/shadow retweeted
i am a power of kivi, definitely recommended. go now and install
cat /etc/shadow retweeted
Today, @MidcenturyAI introduces MC-EgoHands, our frontier 3D harness for human egocentric video.
PA-MPJPE across four public hand-pose datasets:
> ARCTIC - 3.67 mm
> HOT3D - 3.98 mm
> H2O - 5.24 mm
> FreiHAND - 4.30 mm
Introducing MC-EgoHands, the first all-in-one harness for turning raw ego video into training-ready data.
→ Frontier hand pose (<7mm) across 4 public benchmarks
→ Human grasps retargeted to Panda/LIBERO and Yam in one pass
→ Occluded frames flagged as interpolated or missing
→ Structured episodes in @huggingface @LeRobotHF v3
cat /etc/shadow retweeted
Found a useful dataset for security researchers.
Real audit findings with descriptions, severity, PoCs and remediation.
Take one vuln class → study 50 findings → extract recurring mistakes → build your own hunting checklist.
huggingface.co/datasets/Zaev…
cat /etc/shadow retweeted
⚠️ CVE-2026-94545 (CVSS 9.5) ⚠️
Your Next.js OG image endpoint can hand an attacker a shell. 😱
If you use next/og on the Node runtime with sharp installed (what Next recommends for prod), one unauthenticated POST to that route runs commands on your server. Here's why: Satori builds the image as an SVG and drops your text in without escaping it, so an attacker breaks out of the tag and injects their own markup. It reaches the native image libs (sharp, libvips, librsvg, libxml2) and corrupts memory there, and since Node ships non-PIE, a hardcoded ROP chain lands execve every time.
This is the default prod setup, not some weird edge case. 🚨
Not affected: edge runtime or no sharp — that path uses the wasm renderer.
Patched in Next.js 16.3.6 / Satori 0.33.5. On 16.2.0–16.3.5? Update now.
🔥 PoC + setup: github.com/EQSTLab/CVE-2026-…
#Nextjs #RCE #CVE #PoC #Exploit #CyberSecurity #nextog #CVE_2026_94545
I agree with you, @rez0__
They didn’t calculate the impact threshold properly. Microsoft and Openai seems competing who will pay the least bounty on P1 vulnerabilities
cat /etc/shadow retweeted
🚨 Microsoft Admin + ~17 Trillion Rows of Data
💰 Bounty: $5,000 💀
Titan sat behind a “VPN REQUIRED” page, but its API was still reachable from the internet with a public Swagger file exposing every route, including one that accepted raw SQL.
✤ The researcher sent a token that literally said “this token needs no signature” (alg: none).
Titan checked the name, department, everything printed on the card.
It never checked the hologram. 🪪
So the researcher sent a card saying “no hologram on this one” (alg: none) and named himself admin in the payload.
✅ All checks passed.
💀 17 trillion rows behind that handshake.
🕰️ Old versions of a target’s pages are attack surface.
Check:
→ web.archive[.]org/web/*/target
→ Archived JS & config endpoints
→ Old login/privacy pages for forgotten configs
Microsoft locked the endpoint down 4 days after the report and awarded $5,000. 💰
cat /etc/shadow retweeted
‼️ BREAKING: A 16-year-old hacker broke into an internal Microsoft analytics service with a forged, unsigned login token and ran SQL as admin, reaching databases that held over 17 trillion rows, including Bing search analytics and 17,990 employee email records.
The service, called Titan, checked every field on the token except its signature, so just claiming to be "admin" got him in, writes the researcher, who goes by Faav.
He says he only pulled metadata and two single rows of Bing data, never touched customer data, and reported the flaw to Microsoft the same night.
Microsoft locked the endpoint four days later, paid him $5,000, and had editorial control over his write-up, cutting sections and figures and reshaping how the impact was described before it went public.
