Principal Security Consultant @FORTBRIDGE
London, England
Joined February 2010
- Tweets3.3K
- Following744
- Followers645
- Likes56.7K
Pinned Tweet
Achievement Unlocked: Spoke at @Microsoft 's @BlueHatIL 🏆💻
(And yes, it was epic.)
BHIL '25 is a wrap, and it was a privilege to be on that stage and connect with so many brilliant minds. I had an absolute blast.
Huge shoutout to the incredible Day 2 speaker lineup—every talk was insightful, creative, and inspiring:
@BLanyado , @DrorOphir , @yarden_shafir , @AradCohen, Omer Nevo, @NetanelBenSimon , @BlauMeir , @avi_lum , @GalElbaz1 , @cglyer , Efim Hudis, @sh0oki , @SecurityBaby , Edan Zwick, Yohan Guez, @sapirxfed , Dor Amit, Shaked Ilan — I learned so much from each of you.
Big thanks to @Microsoft and the amazing BlueHat IL organizing team — @shirleyhermann , @IdaVass1 , @AsherVered10 , and everyone else who made this event happen — thank you!
And last but not least, a special thank you to the CFP board legends. I’ll name just a few that I had the pleasure of meeting face-to-face:
@gentilkiwi , @ace__pace , @dwizzzleMSFT , @ItaiGrady , @TalBeerySec , @j0nathanj — you guys rock.
Also, great to finally meet @LiveOverflow and @ghidraninja in person — super chill guys.
Grateful to have been part of something this special. Until next time!
#bluehatil #CyberSecurity #Microsoft
Lord Steak retweeted
My goat, Sir Patrick Stewart, time for the last great adventure. Five-card stud, nothing wild.. and the sky's the limit 🥃
Lord Steak retweeted
Confirmed, and yeah this seems like a horrible idea
haha, so apparently OpenAI are about to start training on your Daybreak Blue sessions, with no way to opt out.
Literally stealing people's private work, as they do it, is cartoonishly evil.
It also will presumably kill Daybreak usage by security researchers. Or at least, it should. The thing OAI have had to swear they are not doing to math researchers, they are now explicitly about to start doing to security researchers.
Yet another reminder of the importance of open models.
Lord Steak retweeted
Anthropic trains on every request that hits a classifier.
OpenAI will start training on all cyber requests.
Kimi K3.1 Pro removes cyber from their mid/post training.
DeepSeek has a supposed cyber endpoint hidden behind KYC (unverified)
We must hold the line and train strong open source cyber.
Lord Steak retweeted
Huge announcement by OpenAI on Daybreak Blue (TAC): Starting November 29th, OpenAI will force train its models on all personal account AI sessions enrolled in Daybreak Blue, even when model training is disabled! Keep that in mind when feeding the model private reports or research.
I grew up watching this series :(
Legendary ‘X-Men’ and ‘Star Trek’ Actor Patrick Stewart Has Died, farewell captain. gizmodo.com/patrick-stewart-…
Lord Steak retweeted
I learned that infosec companies are buying reviews to push their mediocre courses and fool my audience, so I'm launching a promotion campaign for my own Zero Day Engineering training system to raise visibility and remind how it differs:
- My training programs are 100% original content produced by my own first-hand VR work at the frontiers;
- My attendees include prominent security researchers and I heard them getting $250K bounties with the frameworks that I teach more than once;
- I'm seeing insanely high ratios of repeat and bundle purchases of my high ticket courses; clearly, people are getting the value;
- My company website has a wall of grateful reviews from past attendees, published across all the social platforms;
- I am an active exploit engineer specialized in hardened systems, and happy to share my expertise with paying clients;
- I built a unique universal methodology in 23 years of reverse engineering professionally that works across systems, classes and objectives;
- My methodology proved useful to keep finding bugs in the most difficult systems for well over a decade;
- I don't buy reviews, ads, or distribution - I trust that genuine value will speak for itself;
- I don't build alliances or leverage capital to "beat" other creators - I believe in infinite-sum games, and that every offer has its place on the market;
- I don't force sales or marketing - I let my audience discover my work and make their purchase decisions on their own timelines;
- I run my business solo and take offense personally.
Details of the promo in the comment below
Lord Steak retweeted
Many of the CVEs you see coming out these days are actually not very weaponizable against real production systems, for one reason or another
Example: Anthropic’s recently reported Linux network RCE, which takes almost an hour to run, causes a kernel panic on any system that has even the default level Linux Firewall, in our testing
Often, the reason why you have even of these these bugs is because firms put them in the throwaway conference-talk category
Important to keep this in mind
Lord Steak retweeted
I do feel ownership of what I instruct the AI to do. So it just feels like using a tool like a fuzzer and find stuff.
And it’s actually easier to share stuff, because I can just say “AI did that”. If it’s bad what I share, I can offload this responsibility to AI 🙃
Lord Steak retweeted
What it feels like when you start using a Chinese model and it actually just does what you want without a fucking condescending moral lecture.
Lord Steak retweeted
After a few years in beta, the V8 Sandbox is now considered a real security boundary! (Just announced at OffensiveCon Tokyo together with @mlippautz). This is less about reaching a particular software milestone than about two things:
Lord Steak retweeted
By the way, in case anyone was still wondering whether they are completely useless, Binance holds SOC 2 Type 2, ISO 27001, and several other certifications.
Lord Steak retweeted
PHP2Shell in three CMS labs: WordPress and Joomla reached RCE; selected Drupal PHP files disclosed memory, but our tests did not reach RCE. Worker scheduling and routes mattered. Not a CMS security ranking.
fortbridge.co.uk/research/ph…
Lord Steak retweeted
CVE-2026-97229: CISA lists a GitLab RCE flaw as actively exploited. Alpine Linux reported an attempted exploit but found no evidence of success. Check affected instances and patch promptly. Contact FORTBRIDGE for support. #GitLab #CyberSecurity
Lord Steak retweeted
if anyone's confused, gpt plans used to be
5x - pro 100
20x - pro 200
then a month ago
5x - pro 100
10x - pro 200
25x - pro 500
now after today:
10x - pro 100
20x - pro 200
50x - pro 500
Day 25/
We are doubling all usage limits for all Pro 100/200/500 tiers and Business Premium, effective today.
We heard your kind feedback and won’t be reducing usage limits for Pro 200, so your Work and Codex usage will stay the same. We’re also going to continue offering extended limits for dots for now, and usage of your dot will still continue to be separate from your default usage.
And we'll of course also keep shipping better models and other efficiency improvements that increase your effective usage over time.