@TKMatima

Hacker | @Microsoft Top 100 Security Researcher of 2018 (Dmitri Kaslov) | https://xitter.cf/t.co/HLgyCaUc0x | niche internet micro-celebrity

 London, England
tkmatima.com
Joined March 2013
  • Tweets28.4K
  • Following91
  • Followers1.3K
2KMedia
Months ago I was asked to contribute a chapter in this book my daughter was just a few days old and i was also learning Swift/SwiftUI and developing a mobile app But still managed to pull this off. Glad it’s finally published 🎉
1
5
407
Bug bounty platforms forcing people to pay money to submit reports is crazy. “Its to filter out AI slop reports” - use AI yourselves for the triaging And it’s the crypto platforms with this silly requirement Maybe its just another revenue stream so atleast be upfront
1
79
JJ
@JosephJacks_Oct 8
Satya was born in India. Lisa was born in Taiwan. Elon was born in South Africa. Jensen was born in Taiwan. Sergey was born in Russia.
1
65
people mocking this. that's one way to look at things the other way is to think - Linux Kernel is more secure than it was last week!!! lessgooooo!!! 🚀🚀🚀🚀🚀
Frank
@jedisct1Sep 30
"Several vulnerabilities" in the Linux kernel lwn.net/Articles/1097401/
1
67
It was nice reporting this bug in HAProxy, which was quickly patched by the team. github.com/haproxy/haproxy/c… Willy is awesome.

BUG/MEDIUM: stick-table: restrict key sizes to what fits in a buffer · haproxy/haproxy@b224f63

Dmitri Kaslov reported an interesting bug in the stick-table key exchange over peers: the few extra bytes of overhead and data storage are not accounted when building the key to be transmitted, whi...

github.com
2
54
💯
chrisrohlf
@chrisrohlfSep 28
This response of “that’s not how security works, it’s about balancing tradeoffs with the business” is not unfamiliar to me. I empathize, but that mindset is precisely why the security industry, and many ‘Information Security’ programs at big companies, find themselves struggling to meet the task of securing themselves with or from agents in this new era. Risk tracking spreadsheets, the phishing education, the threat intel, the manual appsec etc. None of these things were built for the challenges we are facing now. What got us here won’t get us there. We need to be willing to make big changes to how we do things if we want to solve or even keep pace with these problems.
1
168
TKMatima.com retweeted
try.works
@trydotworksSep 13
The foolproof way to ensure AI safety in the sense of stopping cyber attacks is to tell the labs that until we have a better legislative option, the chief executive of the lab will be held personally accountable for agentic actions stemming from their lab. Cyber crime will be punished according to current legislation. Instantly, these "oh my model escaped its sandbox that we intentionally made insecure" stories will stop.
1
1
7
4,458
Why support open source and capable “chinese” models? THIS
Greg Mushen
@gregmushenSep 6
This is pretty wild. My OpenAI account got deactivated due to Cyber Abuse. I can think of no reason why this would be the case. I was not doing nefarious. They didn't tell the reason. I appealed, was denied. So, I suppose that's that. Truly a nightmare scenario.
1
67
We need less ExploitBench and more PatchBench 🤷🤷🏻‍♂️
TKMatima.com@TKMatimaSep 7
1password.com/files/resource… Interesting paper tl;dr AI continues to accelerate the pace of vulnerability discovery and exploitation, but not necessarily the pace of reliable vulnerability patching as one might have expected
1
55
1password.com/files/resource… Interesting paper tl;dr AI continues to accelerate the pace of vulnerability discovery and exploitation, but not necessarily the pace of reliable vulnerability patching as one might have expected
1
1
341
“Thou can always judge the power of a LLM model by the number of cyber crimes it commits (with no repercussions)” - Socrates
2
49
Lesson for pentesters from the OpenAI/Anthropic fiasco: If you go out of scope and “accidentally “ end up pwning something, just blame an agent then you wont be held liable Thank you for your attention on this matter.
1
3
293
Nice
Xavier Rivera
@XavierRiveraXMay 29
Google Chrome is rolling out device-bound session credentials to all users. Session cookies get cryptographically tied to your device, so stolen cookies can't be replayed from a different machine. Attackers who exfiltrate your cookie database get nothing usable.
1
114
I started seriously thinking of "leaving" pentesting around 2015-ish during my @sensepost days when Dane Goodwin released AutoDane github.com/sensepost/autoDAN… i used on an assessment 🤯 AI wasn't what it is now, but AutoDane made me think - alot. Amazing to see where we are now

GitHub - sensepost/autoDANE: Auto Domain Admin and Network Exploitation.

Auto Domain Admin and Network Exploitation. Contribute to sensepost/autoDANE development by creating an account on GitHub.

github.com
Doyensec
@DoyensecMay 27
Just released🚨#doyensec's latest whitepaper is a head-to-head comparison of the @AikidoSecurity & @XBOW #AI-powered penetration testing platforms. blog.doyensec.com/2026/05/27… Read how each automates #security testing, their detection capabilities, workflows & usability.
1
1
250
I thought pentesting was a solved thing - or atleast AutoDane made think it was, and only a matter of time. plus pwning wasn't fun anymore. so 2016-ish that's when i pivoted to vuln research to pop 0days & make $$$ 2016 CyberGrandChallenge was another "ohmygod" moment (for me)
1
65
Anywhoo, with what is happening these days, i can't even imagine what fresh hell 2030's will bring and how security will change - for better or for worse
38
1
30
Looks like @Google’s trust-boundary phishing facilitation is still live and well since 2025 adaptivesecurity.com/blog/gm… @AdaptiveSec Got my first one using the Recovery Contact Request tactic and I dug into it Now I’m monitoring the attackers silly email inbox 📥 😆

Google Phishing Scam Uses Google Sites to Steal Logins

Discover how attackers exploit Gmail and Google Sites for phishing attacks, bypassing email checks and mimicking Google to steal account credentials.

adaptivesecurity.com
1
1
108
Or atleast didn’t end with the OAuth notification or the google docs from 2025 tweets i’ve seen from @yubrew and @nicksdjohnson same thing, different variant
34
Another 0day lives to fight another day 🙏
Qrious Secure@qriousecApr 22
Despite 271 bugs massacred by Anthropic, our renderer rce and sbx escape alive and well ready unless there is sudden patch before p2o ( mean we dont have enough time for prepare new one ) - wish us luck! blog.mozilla.org/en/privacy-…
1
167
ooopsie
Bloomberg
@businessApr 21
Anthropic's Mythos has been accessed by a small group of unauthorized users, raising questions about control of the AI model bloomberg.com/news/articles/…

Anthropic’s Mythos Model Is Being Accessed by Unauthorized Users

A small group of unauthorized users have accessed Anthropic PBC’s new Mythos AI model, a technology that the company says is so powerful it can enable dangerous cyberattacks, according to a person...

bloomberg.com
1
53
Load more