edoardottt🐘 retweeted
Bonus: I've also flipped the chain and popped MS Edge from calc.exe 😆
youtube.com/watch?v=Bh1zglq4…
edoardottt🐘 retweeted
Still blows my mind someone at Google would of came up with the idea of Google Maps / Google Earth
Then suggested that they drive down every road on the planet and take pictures of it
And then they actually went and did it
edoardottt🐘 retweeted
Our security research team discovered a cross-site scripting vulnerability in Cloudflare's /cdn-cgi/image/ endpoint by chaining an SVG sanitizer bypass with a new Cache-Control header trick to bypass the CSP. The issue was reported to Cloudflare and has since been fixed.
You can read more here:
slcyber.io/research/cache-me…
edoardottt🐘 retweeted
Just dropped a new blog post! 🔥
blog.orange.tw/posts/2026-10…
This is incredible lol, Orange Tsai popped browser from calc
Don't worry @orange_8361, there are still people reading blog posts and articles from start to finish 😄 that was a beautiful exploit chain!
blog.orange.tw/posts/2026-10…
edoardottt🐘 retweeted
Since the @Apple Bug Bounty Program is by far the worst program I've ever hacked on, I am going to be dumping all of the data/POCs/report write ups etc for everything found during the 4 months of hacking them. This will include POCs for vulns that didnt meet their bar for a bounty so wasnt reported to them, so you may be able to find ways to escalate some of them. Ill be uploading the data all this weekend.
edoardottt🐘 retweeted
“Microsoft And Epic Games Suddenly Agree That AI Is Theft”
Microsoft And Epic Games Suddenly Agree That AI Is Theft kotaku.com/now-that-the-shoe… kotaku.com/now-that-the-shoe…
edoardottt🐘 retweeted
A cybersecurity researcher says his Samsung TV was collecting far more data than he expected.
The researcher, known as “log4j”, reverse-engineered a 2025 Samsung TV and found systems for collecting viewing data, screenshots and audio-related information.
He also says the TV has AI components that can analyze what you watch, how long you watch it, which ads you skip and how far you get through videos.
But the story gets even stranger.
Log4j says OpenAI banned his account while he was working on the investigation. He posted an email saying his account had been deactivated for violating its terms regarding “Cyber Abuse.”
He claims he never used OpenAI to exploit or find vulnerabilities, only for local reverse-engineering work on his own devices.
He says the ban cost him around $500 and reset several of his accounts, but apparently motivated him to build a larger machine cluster for the investigation.
i own a relatively new (2025) samsung tv.
i kept getting weirdly targeted ads.
i tried reversing the firmware but it was aes encrypted and no keys unless tear it apart and do uart/jtag magic.
zero days it is. root shell on new samsung TVs!
discovered PRIVACY HORROR. write up?
edoardottt🐘 retweeted
Never seen a more flagrant and violent breach of privacy in my life, and probably never will. Doubtful that a privacy violation will ever even be able to compare to the scale of this evil and deliberate attack.
Samsung should be eviscerated for this. Criminal charges please
edoardottt🐘 retweeted
Evolving threat 🚨 CVE-2026-111497, previously known to affect Node.js (node2shell) and Python has evolved into “HTTP2Shell.”
A significant blast radius.
This vulnerability leaves many libraries and applications using HTTP vulnerable to pre-auth RCE via Brotli decompression.
Please be aware. Fixes not yet available for all affected services. Look for Brotli (1.2.1) dependency upgrades when they become available.
edoardottt🐘 retweeted
Python2Shell is also a thing now.
Advisory: github.com/advisories/GHSA-9…
edoardottt🐘 retweeted
Ruby’s turn 😅
Remember the GitLab bug? Well now it moved upstream into Ruby.
Multiple 10.0 CRITICAL exploits.
Patch now 🚨
Happy Friday 🤠
ruby-lang.org/en/news/2026/1…
edoardottt🐘 retweeted
BREAKING: eMudhra exits SSL/TLS certificate business, blames social media instead of incompetence for the same
edoardottt🐘 retweeted
👀 L'inchiesta su Dataflow - l'eccellenza italiana che sviluppa codici per penetrare smartphone e computer con stretti legami con l'intelligence israeliana - pubblicata su @IrpiMedia (@faffa42) è oggi oggetto di un'interpellanza parlamentare firmata dall'onorevole @NFratoianni (che ringrazio per l'attenzione)
irpimedia.irpi.eu/dataflow-c…










































