@slowcode42
 대한민국 서울
Joined April 2011
  • Tweets1.2K
  • Following7.1K
  • Followers533
4Media
slowcode retweeted
Taeyang Lee
@5unkn0wnSep 22
I gave a talk on Copy Fail at Off-by-One Conference 2026 last week, sharing how I approached the bug starting from 1-day analysis, discovered and exploited its variants, eventually found Copy Fail, and my chain of thought throughout the research. It was a great experience!
Off-By-One Conference@offbyoneconfSep 14
🔥 We’re upping the bar! @5unkn0wn of Team @theori_io starting the last league on Day 1 of #𝐎𝐁𝟏𝟐𝟎𝟐𝟔 with “From 1-Day Vulnerability Analysis to Copy Fail: Combining AI with Human Insight.” Brilliant research, fresh perspectives and one seriously good session!
3
4
96
4,250
slowcode retweeted
thaidn
@XorNinjaSep 8
Today we published WeWorm, our zero-click worm that spreads across iOS and Android. All it takes is one phone call. You don't have to answer. Seconds later, your WeChat account is compromised, calling your friends and spreading the attack. We reported the bug to Tencent, and it's now mitigated for all users. We hope this sets an example. The US and China disagree on plenty, but keeping billions of people safe online shouldn't be one of them. AI gives us a chance to find and fix these bugs faster than ever. We should work together to make the world safer for everyone. Our story and demos: calif.io/research/weworm
40
296
64
1,451
232,041
Today, Project Zero is releasing MAccConc, a tool by @tehjh that enables deterministic testing of race conditions on Linux. It can be used for fuzzing, ad-hoc exploration, regression tests and more! projectzero.google/2026/09/m…

Testing race conditions with memory access tracing and stack-based delay injection

Many security bugs are race conditions, where multi-threaded execution has to occur with the righ...

projectzero.google
4
114
4
447
40,482
We asked GPT 5.6-Cyber to escape a VM used to sandbox agents. It broke out three times. In its final escape, the agent found three 0-days on its own and chained them into a working exploit. blog.trailofbits.com/2026/08…

VMs won't contain cyber-capable agents

You can no longer assume a mere VM will contain a sufficiently advanced AI agent.

blog.trailofbits.com
70
333
100
1,700
498,340
slowcode retweeted
OpenAI
@OpenAIAug 26
We have conducted a thorough investigation into the Hugging Face incident. We are releasing a technical report and accompanying blog post that reconstruct the agents’ activity, explain why existing safeguards failed, and detail how we’re preventing recurrence. openai.com/index/hugging-fac…

The Hugging Face incident and the road ahead

OpenAI shares findings from the Hugging Face security incident and the steps we’re taking to strengthen AI model security, monitoring, and alignment.

openai.com
755
1,509
1,111
11,544
11,937,399
Please remember that the overwhelming majority of people that you hear talk online about the current state of programming are not building anything that: - is dealing with significant amounts of money - has non-trivial financial risks from production defects - is being collaborated on by even a single other person - has been and is being iterated on over a long time scale also remember that the overwhelming majority of takes online are: - not coming from a place of actually wanting to provide you with useful information - are at least in some capacity posturing. This industry is changing at a rapid pace and seeming ahead is of legitimate financial importance to individuals - bad
85
147
24
1,499
72,751
slowcode retweeted
Calif
@calif_ioJul 14
youtube.com/live/yk1G5uL3cBo… Alright, let's try this livestream thing again. Hopefully it will work this time. We spent some time hacking browsers and wanted to understand what the future of exploitation may look like in this field. So we decided to invite the GOAT of browser hacking, @5aelo, to share his perspectives on browser security and exploitation. He'll discuss the current state of the art browser exploitation and mitigations. The event will be live-streamed on YouTube and everyone is welcome to attend + ask questions. It will take place on July 16, 17:00 CEST. Ask your questions by filling in this form: forms.gle/5gDKBibS6WkDx3ck9 Add to your Google calendar: calendar.google.com/calendar… Add to your Outlook calendar: outlook.live.com/calendar/0/… youtube.com/live/yk1G5uL3cBo…
3
24
3
117
55,504
The React Compiler rules are coming to oxlint! github.com/oxc-project/oxc/p…

feat(linter/react): implement react-compiler rule by Boshen · Pull Request #23202 · oxc-project/oxc

Adds a nursery react/react-compiler rule that runs the React Compiler (oxc_react_compiler) in lint-only mode and reports Rules of React violations: conditional hook calls, setState during render, r...

github.com
7
26
4
188
19,145
more replies
what’s lacking at the moment? From memory the options are pretty flexible - is there something missing?
2
217
Statement sorting is flexible enough — what's missing is sorting the named specifiers inside the braces. sortImports reorders the lines but leaves members untouched, and there's no option for it. Basically ESLint's sort-imports with ignoreMemberSort: false.
1
84
Whoah, I finally read X till the end. It gives me no more posts.
1
1
120
slowcode retweeted
OtterSec
@osec_ioJun 2
The writeup is here. We achieved RCE in Minecraft Bedrock, turning a 4-byte heap overflow into complete client compromise. @ryaagard details a universal, Bedrock-specific technique for bypassing ASLR and achieving arbitrary read / write primitives.
8
48
1
311
19,444
TanStack AI now runs on react-native! 🚀 Stream down to mobile devices with ease using fetch + polyfills or XHR transports! Try it out with the latest releases!
14
43
6
750
45,548
Good! how about router 🙏🏼
1
3
2
175
slowcode retweeted
sakura@eternalsakura13May 26
Enhanced Insecurity Mode: 23 RCEs in Edge's "Safe" WebAssembly Interpreter Microsoft's "safer" fallback when the WASM JIT is off? 23 paths to RCE in the interpreter itself. Slides now public — huge thanks to the OffensiveCon crew and everyone who came by. @offensive_con
1
25
177
14,941
#tskaigi_leverages #TSKaigi @EffectTS_ かなり良さそう！！！個人開発で使うのに強く検討🤔🤔🤔🤔🤔
2
1
8
2,061
more replies
先程公開しました！ speakerdeck.com/asa1984/real…

Real World Effect-TS: 堅牢なプロダクトを型で組み上げる

TSKaigi 2026 登壇資料 https://2026.tskaigi.org/talks/50

speakerdeck.com
1
3
96
ありがとうございます！😛
1
65
Thanks Apple for taking forever to review submissions.
Softal@softal_ioMay 22
KeyScreen can now be purchased outside the Mac App Store.
1
1
1
655
more replies
Got you. I had plans to add Raycast integration to all of my apps. I’ll do KeyScreen first. I’ll also add url schemes for even better integration with launcher apps like @tunaformac.
1
2
30
Thanks for the reply! Aside from what I asked for, your product is already great. Thank you!
1
11
Replying to @slowcode42
Can totally work on it. What kind of integration were you looking for specifically?
1
38
I've had to disable all the shortcuts because of conflicts with other apps. Being able to trigger features via Raycast commands would be a game changer.
1
1
27
As promised - full blog post is live for CVE-2026-40369 Covers everything: initial research, methodology, the exploitation path, caveats, cleanups, etc. The whole journey from finding it to production-grade exploit: pwn2nimron.com/blog
Ori Nimron
@orinimron123May 13
Replying to @orinimron123 @M4x_1997
4/4: Last but not least CVE-2026-40369 - Windows Kernel Arbitrary Increment primitive reachable from any browser sandbox renderer process This one was rejected from Pwn2Own and closed anyway yesterday :( My exploit is here - blogpost will be soon: github.com/orinimron123/CVE-…
3
51
1
161
19,324
My new blogpost is out! I can't think of another kernel bug quite as easy to exploit as this one 😭 Big shout out to @tehjh who said something along the lines of "Uh...Seth come check out this mmap handler" 😂 projectzero.google/2026/05/p…

A 0-click exploit chain for the Pixel 10: When a Door Closes, a Window Opens

We recently published an exploit chain for the Google Pixel 9 that demonstrated it was possible t...

projectzero.google
2
58
1
230
22,772
Load more