ๅๆฐๅ / CTF with ${cYsTiCk} / script kiddie at @d3vc0r3 / Tรขi-gรญ, zh-TW, en-US, es-PY / ๐โโฌ
Tsu-lรด-Kuฤn, Formosa / Taiwan
Joined July 2019
- Tweets373
- Following640
- Followers2.5K
- Likes3K
Tomorrow at @SEC_T_org, Iโll be breaking down the journey of how I found paths to compromise software supply chainS.
Weโre going down the Linux side this time ;)
Next week at @BlackHatEvents #BHUSA, I'll present โBorn Corrupted: How We Backdoored Trusted Language Binariesโ
We found ways to compromise Python, Go, Flutter & Julia at the supply-chain layer, turning trusted bins into whatever hackers want them to be!
Check out the abstract:
an incredibly simple but also incredibly critical bug i found on Python[.]org!
big thanks to PSRT and the maintainers for the quick fix and thorough follow-up
for the tl;dr: i can do this:
The Python Security Response Team patched an authentication bypass in the python.org release management API in under 48 hours. No evidence of exploitation, all artifacts verified.
Check out the full writeup ๐
pyfound.blogspot.com/2026/06โฆ
#Python #Security #PSF
pyfound.blogspot.com/2026/06โฆ
Booyah it's been confirmed! ๐ splitline (@_splitline_) of DEVCORE Research Team chained 2 bugs to exploit Microsoft SharePoint, earning $100,000 and 10 Master of Pwn points. Massive aura farming this year at #P2OBerlin. Full win! #Pwn2Own
