edoardottt🐘 (@edoardottt2) header
edoardottt🐘 (@edoardottt2) profile picture

cybersec research & stuff, (open-source) software

Rome, Italy
Joined April 2020
Photo by edoardottt🐘 (@edoardottt2)Photo by edoardottt🐘 (@edoardottt2)Photo by edoardottt🐘 (@edoardottt2)Photo by edoardottt🐘 (@edoardottt2)Photo by edoardottt🐘 (@edoardottt2)Photo by edoardottt🐘 (@edoardottt2)Photo by edoardottt🐘 (@edoardottt2)Photo by edoardottt🐘 (@edoardottt2)Photo by edoardottt🐘 (@edoardottt2)Photo by edoardottt🐘 (@edoardottt2)
edoardottt🐘 retweeted
Google 的问题可以用这四张图总结一下
裁员工之前,能不能把高管先裁了?能不能把CEO 先裁了? 公司烂成这样,都是员工的责任吗?
47
38
10
1,415
315,926
edoardottt🐘 retweeted
wtf twitter links got trackers now yo remove everything after the ?
483
7,872
796
71,846
6,093,678
edoardottt🐘 retweeted
Still blows my mind someone at Google would of came up with the idea of Google Maps / Google Earth Then suggested that they drive down every road on the planet and take pictures of it And then they actually went and did it
272
2,301
142
59,096
942,615
edoardottt🐘 retweeted
Our security research team discovered a cross-site scripting vulnerability in Cloudflare's /cdn-cgi/image/ endpoint by chaining an SVG sanitizer bypass with a new Cache-Control header trick to bypass the CSP. The issue was reported to Cloudflare and has since been fixed. You can read more here: slcyber.io/research/cache-me…
6
63
6
326
20,201
edoardottt🐘 retweeted
Since the @Apple Bug Bounty Program is by far the worst program I've ever hacked on, I am going to be dumping all of the data/POCs/report write ups etc for everything found during the 4 months of hacking them. This will include POCs for vulns that didnt meet their bar for a bounty so wasnt reported to them, so you may be able to find ways to escalate some of them. Ill be uploading the data all this weekend.
120
329
59
7,197
461,758
edoardottt🐘 retweeted
“Microsoft And Epic Games Suddenly Agree That AI Is Theft”
147
10,551
66
103,482
974,570
edoardottt🐘 retweeted
Kiddo is already showing a strong understanding of dependencies (xkcd 2347)
30
297
12
5,651
66,135
edoardottt🐘 retweeted
A cybersecurity researcher says his Samsung TV was collecting far more data than he expected. The researcher, known as “log4j”, reverse-engineered a 2025 Samsung TV and found systems for collecting viewing data, screenshots and audio-related information. He also says the TV has AI components that can analyze what you watch, how long you watch it, which ads you skip and how far you get through videos. But the story gets even stranger. Log4j says OpenAI banned his account while he was working on the investigation. He posted an email saying his account had been deactivated for violating its terms regarding “Cyber Abuse.” He claims he never used OpenAI to exploit or find vulnerabilities, only for local reverse-engineering work on his own devices. He says the ban cost him around $500 and reset several of his accounts, but apparently motivated him to build a larger machine cluster for the investigation.
75
369
18
3,819
84,665
edoardottt🐘 retweeted
i own a relatively new (2025) samsung tv. i kept getting weirdly targeted ads. i tried reversing the firmware but it was aes encrypted and no keys unless tear it apart and do uart/jtag magic. zero days it is. root shell on new samsung TVs! discovered PRIVACY HORROR. write up?
717
3,874
657
36,745
4,805,414
Never seen a more flagrant and violent breach of privacy in my life, and probably never will. Doubtful that a privacy violation will ever even be able to compare to the scale of this evil and deliberate attack. Samsung should be eviscerated for this. Criminal charges please
turns out it classifies what audio it hears, before reporting back to samsung. sensor preferences, dog-barking and baby-crying event counters, and camera streaming duration are built into telemetry paths.
137
1,091
40
12,193
386,280
edoardottt🐘 retweeted
Evolving threat 🚨 CVE-2026-111497, previously known to affect Node.js (node2shell) and Python has evolved into “HTTP2Shell.” A significant blast radius. This vulnerability leaves many libraries and applications using HTTP vulnerable to pre-auth RCE via Brotli decompression. Please be aware. Fixes not yet available for all affected services. Look for Brotli (1.2.1) dependency upgrades when they become available.
118
852
429
3,451
810,112
Python2Shell is also a thing now. Advisory: github.com/advisories/GHSA-9…
21
97
12
877
89,937
edoardottt🐘 retweeted
Ils ont vibecodé le panneau de l’aéroport de Sicilie???
373
515
190
17,625
2,307,977
edoardottt🐘 retweeted
Set session.upload_progress.enabled=0 till next PHP release to block an unlikely RCE vector (CVE-2026-115560). Already recommended for CVE-2026-109619 Wed, keep disabled. Only apps with non-default serialize_handler switching it to "php" at runtime can be affected. #php #phpc
51
903
151
2,848
408,737
BREAKING: eMudhra exits SSL/TLS certificate business, blames social media instead of incompetence for the same
615
2,423
597
24,862
1,224,944
edoardottt🐘 retweeted
👀 L'inchiesta su Dataflow - l'eccellenza italiana che sviluppa codici per penetrare smartphone e computer con stretti legami con l'intelligence israeliana - pubblicata su @IrpiMedia (@faffa42) è oggi oggetto di un'interpellanza parlamentare firmata dall'onorevole @NFratoianni (che ringrazio per l'attenzione) irpimedia.irpi.eu/dataflow-c…
4
18
3
61
3,982