@xscorp7
Account based inIndia
About this account
- Account based in
- India
- Connected via
- India App Store
Account-level information from X, not a live location or the device used for a specific post.
I enjoy security stuff and automation! Security Researcher | Say hi: xscorp aT pr0tonmail
Joined September 2019
- Tweets1.4K
- Following392
- Followers335
- Likes3K
Pinned Tweet
I and @d0tdotslash presented our research at @bsidesahmedabad 0x03. Kudos to the volunteers and organisers for making it an awesome experience. And thank you everyone for the amazing response.
X S C O R P retweeted
i used to hate the security market because it used to be market for silver bullets. (read ian grigg’s the market for silver bullets)
tldr is, buyer doesn’t know if the product makes them secure, and seller doesn’t really know either. so the market ends up optimizing for reputation and relationships instead of the thing that is sold. if your ciso trusts or is friends with a vendor, that can matter more than whether the product materially improves security.
unfortunately, this changes with ai. imagine, if swarm of abiliterated glm-6 by a sophisticated threat actors try to continuously find ways to pwn you, the feedback loop is going to be crazy, you can’t be selling snake oil anymore. either vendors you pay secures you, or your ass will be whooped by swarms
Whats the best value for concurrency, parallelism and rate limit for mass HTTP requests, considering you will face WAFs, and you don't need to worry about CPU and memory limits? Whats that sweet spot for faster and reliable results?
X S C O R P retweeted
If you are a young vulnerability researcher, it's important to remember this: When people write blog posts or give conference talks on the brilliant multi-bug exploit chains that they discover, they generally talk about it as though they just elegantly pranced from one brilliant insight to another.
The reality, of course, is almost always much less elegant, and involved a lot more banging of one's head against the wall to finally stumble into each brilliant insight.
But you can't blame people for doing this, because talking about the 1,001 things that didn't work would make the talk or blog post way too long and incomprehensible.
X S C O R P retweeted
Three days after chalosansad.in was registered, a single-page, fully sourced explainer on the NEET paper-leak protests and the “Chalo Sansad” march of 20 July 2026, was suspended by the .IN Registry operated by NIXI. No notice. No hearing. No reasons. 1/12
Read More: internetfreedom.in/first-inv…
X S C O R P retweeted
Here's the link, we'll be streaming our talk @ 1PM PT
If this breaks, it's Track 1 Main Stage on the #DEFCON YT channel nitter.cf/i/broadcasts/1qJVmmdYd…
X S C O R P retweeted
‼️ BREAKING: An active npm supply chain attack has compromised at least 868 packages carrying over 2 billion monthly installs with a credential-stealing worm. Shai-Hulud is back.
It started with the compromise of the GitHub account of the maintainer behind keyv, a library with roughly 127 million weekly npm downloads.
A preinstall hook fires on npm install and drops a stealer that sweeps npm, GitHub, AWS, Kubernetes and Vault secrets, and then spreads to more maintainers.
Wow this was a good read!
1-Click GitHub Token Stealing via a VSCode Bug
blog.ammaraskar.com/github-t…
I am unable to understand those recursive set of requests to bypass `method` and `author_exclude` validation. Can anybody help with an explanation?
Seems that wp2shell PoCs are now floating around the internet, so we've published our blog post including our research methodology for finding the bug as well as a deep dive into the chain itself - slcyber.io/research-center/e…
X S C O R P retweeted
Ownkube now support basic auth and Google Oauth2 protection in a single toggle.
A lot of our users needed a way to securely share apps and mockups they are building to external users/investors for review.
I was surprise to see almost none of our competitors made this easy so we shipped it.
Now all your apps deployed via Ownkube get automatic access control at the click of a toggle.
X S C O R P retweeted
‼️ BREAKING: Anthropic has embedded hidden spyware-like code in Claude Code that covertly targets Chinese users. It then sends information regarding every user by injecting it into their prompt message.
Claude Code is sending info like timezone, proxy and possible AI Lab connections into the system prompt in ways Chinese users can't notice.
A coding agent with repo and command permissions should not silently hide routing metadata inside prompts. This is a serious breach of user trust.
X S C O R P retweeted
The 9.3 Critical Vulnerability Microsoft Dismissed: A Dependency Confusion Story - Wahid Fayad @0xcdn
wahidfayad.com/blog.html?pos…
X S C O R P retweeted
‼️🚨 BREAKING: Another researcher skipped coordinated disclosure entirely and dropped a critical 1-click GitHub token theft in public because he doesn't want to deal with MSRC. In his own words: "I really don't want to deal with MSRC on VSCode bugs."
The bug: just clicking a link can hand an attacker a GitHub token that reads AND writes to all your repos, including private ones. It lives in github[.]dev, GitHub's browser-based VSCode editor, which passes the browser an OAuth token that isn't scoped to a single repo. That token can touch everything you can.
Researcher Ammar Askar found that VSCode's sandboxed "webviews" leak keyboard events to the main editor. A malicious repo opened via one link can simulate keystrokes, install a local extension that skips VSCode's publisher-trust check, and exfiltrate your token. He published a working proof-of-concept.
He says when he reports github[.]dev bugs, GitHub tells him they're out of scope and to go report to MSRC, and a prior VSCode bug he reported was silently fixed with no credit. One commenter summed up the mood: "MSRC has turned into Feedback Hub."
X S C O R P retweeted
claude mythos just broke Apple's $2 billion defense system. it did so by discovering a completely different attack vector to break in
only took it 5 days costing ~$35K of mythos api time (the same exploit class costs $5-10M on grey market)
the researchers that commandeered the exploit produced a 55-page report that was delivered to Apple HQ in-person (hoping they release it after patching).
most shocking part for me is apple's MIE worked as intended. mythos just discovered a new way to side-step it entirely by poisoning the data the M5 chip ingested.
at this point i think we have to accept that mythos walks the walk.
As the anthropic red-team explicitly confirmed this week - this is NOT a compute resource issue. its national defense.
❗️🚨 BREAKING: Researchers used Mythos Preview to find the first public macOS kernel memory corruption exploit on Apple's M5 silicon, they give a glimpse into Mythos say it’s really powerful.
Apple spent five years and an estimated several billion dollars building Memory Integrity Enforcement (MIE), the hardware-assisted memory safety system built around ARM's MTE. It was the flagship security feature of the M5 and A19, designed specifically to kill the entire memory corruption bug class.
Researchers from Calif built a working exploit in five days.
According to Apple's own research, MIE disrupts every public exploit chain against modern iOS, including the recently leaked Coruna and Darksword kits. Calif walked into Apple Park this week and handed over the report in person.
Full 55-page technical report drops after Apple patches the vulnerability.
GOAT
Aaaand it's official! Orange Tsai (@orange_8361) of DEVCORE Research Team chained 3 bugs to achieve Remote Code Execution as SYSTEM on Microsoft Exchange, earning a whooping $200,000 and 20 Master of Pwn points. Full win! #Pwn2Own #P2OBerlin
X S C O R P retweeted
That's my chain — a full chain w/ logic bugs only! No memory corruption, no AI, and of course no collisions at all 😉
Confirmed! Orange Tsai (@orange_8361) of DEVCORE Research Team (@d3vc0r3) chained 4 logic bugs to achieve a sandbox escape on Microsoft Edge, earning $175,000 and 17.5 Master of Pwn points. Full win! #Pwn2Own #P2OBerlin
Always the ‘pull_request_target’
This attack leveraged GitHub Actions Cache Poisoning.
Payload deployed here: github.com/TanStack/router/p…
It looks like it detonated here: github.com/TanStack/router/a…