Alibaba Cloud Security open to bug bounty collaboration @HackenProof Security Researcher Just dm https://xitter.cf/t.co/VVU1OV5yz6
Joined August 2017
- Tweets520
- Following4.9K
- Followers14.3K
- Likes4.6K
#bugbountytips A postMessage listener whitelisting *.platform.com is worthless if anyone can sign up and get a subdomain there.Both times it was the same 3rd-party SDK. Free account, deployed my page, opened the target in a popup
some examples: lovable.app · storylane.io · framer.app · webflow.io · netlify.app · vercel.app · github.io and so on
ch retweeted
We successfully achieved an RCE on GitLab in its default configuration.
Historically, most GitLab RCEs have lived in the web or application-logic layers. This time, guided by the @depthfirstlabs spirit, we went deeper: into the low-level gem dependency chain beneath GitLab.
The result? By sending crafted JSON data, we could exploit memory-corruption vulnerabilities buried deep in that chain and take control of the GitLab application server.
@depthfirstlabs brings together some of the smartest people, and is building the best security AI agent. Follow our work, and come join us!
Read more about this in the comment...
ch retweeted
That's my chain — a full chain w/ logic bugs only! No memory corruption, no AI, and of course no collisions at all 😉
Confirmed! Orange Tsai (@orange_8361) of DEVCORE Research Team (@d3vc0r3) chained 4 logic bugs to achieve a sandbox escape on Microsoft Edge, earning $175,000 and 17.5 Master of Pwn points. Full win! #Pwn2Own #P2OBerlin
ch retweeted
New post: We tested the Mythos showcase vulnerabilities with open models.
They recovered similar scoped analysis! 8/8 models found the flagship FreeBSD zero-day, including a 3B model.
Rankings reshuffle completely across tasks => the AI cybersecurity frontier is super jagged!
ch retweeted
New on the Anthropic Engineering Blog:
How we use a multi-agent harness to push Claude further in frontend design and long-running autonomous software engineering.
Read more: anthropic.com/engineering/ha…
ch retweeted
I hacked Claude Code! It turns out "agentic" is just a fancy new way to get a shell. I achieved full RCE and hijacked organization API keys. CVE-2025-59536 | CVE-2026-21852
research.checkpoint.com/2026…
#ai #Claude
“看看 etherscan都要收费”😂
万万没想到我们第一时间出手帮忙 Venus 大户 @KuanSun1990 跟进调查被盗事件，第一时间就给其指明了 Venus 风控必要性，风控后，然后我们协助他把被黑根本原因调查出来，他却在自己的群聊里全面诋毁我们“毫无作用，纯坑，看看 etherscan 都要收费，还有脸要赏金要致谢”。
现在的伦敦时间你 @KuanSun1990 可能还没醒，你醒了，来给个交代，否则我们会让大家知道什么是现实版的农夫与蛇，什么是两面三刀（你看看你和我私聊的嘴脸吧，你是如何诋毁其他帮你的角色的）。就你这样的人，以后谁还敢出手帮你。
本来我已经和你说了这次可以不要赏金，既然你如此踩我们（但这几天推文又都又在公开致谢我们…包括你历史上第一次被盗，你写的真的是声泪俱下，感动了很多人，包括我），这次的赏金我肯定要，你受益于我们，为什么我不能要赏金？我给谁做公益，也不可能给你这种人做公益。
ch retweeted
gpt-oss is out!
we made an open model that performs at the level of o4-mini and runs on a high-end laptop (WTF!!)
(and a smaller one that runs on a phone).
super proud of the team; big triumph of technology.
ch retweeted
1/4 dbugs LIVE
dbugs.ptsecurity.com — vulnerabilities’ home
See trends, discover more, read AI summaries, have all references at hand, and your profile with all your CVEs and CVSS score on a leaderboard.
⬇️ See thread: what’s live + what’s next ⬇️
ch retweeted
After 9 months+ of cranking, cursing, and cursoring, and drawing on over 20 years experience running #HITB's Call for Papers, I bring you CFP Directory - a single system to make it easier for speakers to submit and organizers to connect and curate talks: cfp.directory/
ch retweeted
很好，这次我也是受害者了...被 @getAlby 偷走 0.00174788 BTC($191.96)。能偷是因为这是 Alby 的托管账号。我是很震惊的，因为这鬼协议我必然是不知情的...
我猜是不是会给我发邮件通知，果然 2025/5/1 给我发了个：
Updates to our Terms of Service – Please Review
我在邮件正文底部发现了这个“偷窃协议”：
An inactivity fee will apply to legacy Alby Accounts with a shared wallet created in 2023 or earlier, if there has been no account activity for 12 consecutive months.
然后我这笔 BTC 在 2025/5/26 被偷走了...
开眼界了...🤯😵💫😱
ch retweeted
#vulhub #CyberSecurity #opensource #infosec
Announcing some exciting news from the Vulhub project! We've been busy making big improvements:
1⃣. Completely rebuilt our website from the ground up! Check it out: vulhub.org
