wannabe hacker... he/him 🌱 grow your hacking skills @hextreeio
Internet
Joined March 2015
- Tweets10.5K
- Following1.3K
- Followers166K
- Likes6.7K
Pinned Tweet
Where to find me:
🔴 Hacking Videos: youtube.com/LiveOverflow
📜 Articles: liveoverflow.com
💻 Start Hacking? liveoverflow.com/start-hacki…
🥰 Support: liveoverflow.com/support
📹 2nd Channel: youtube.com/LiveUnderflow
🤳 Instagram: instagram.com/liveoverflow
I have not looked into this yet. But it’s very interesting to observe both extreme camps again.
For some it’s the most exaggerated unexploitable vulnerability ever. For others it’s the most crazy vulnerability they ever seen.
There are probably a lot of nuances to this again. For example ISPs might not allow certain options. While you might just be able to co-locate your server in the same datacenter.
Like with php2shell, the risk is not universally the same for everybody. For some orgs it’s the worst vuln ever. For some it’s not relevant.
So both extreme opinions can be correct at the same time. Which tells me, to accurately assess the risk for your org, it’s very important to understand the technical details and nuances.
What a disaster atlasum.net/blog/cve-2026-98…
Great writeup from the stealmybitcoin php2shell challenge
Steal My Bitcoin Operator Writeup!
pavursec.com/blog/stealmybit…
LiveOverflow 🔴 hextree.io retweeted
that's why we launched the $100k Save CTFs fund. CTFs need to quickly adapt to AI, or else they'll disappear. I heard ECSC did a good job this year.
@_mixy1 wrote a great blog osec.io/blog/save-ctfs-fund/
Social media bubbles are not working anymore…
How can I get back to my bubble with people who want to talk about vulnerability research, bug hunting, CTFs, fuzzing, reverse engineering, tooling, code review, …
And not constantly have to read: “You don’t know what you are talking about. Most companies don’t get hacked by vulnerabilities.”
You all think you are so smart and you figured it out… So it might come as a surprise 🙀 but I am well aware! It’s not rocket science. I am just not interested in it and I don’t have to be.
If your job is it to make the car break safe, you will tell your boss:
"Actually, car breaks are pretty safe and more people die because they drive over the speed limit or use their phone. I will use my time to create an awareness campaign around safe driving instead."
Because of your incredibly accurate risk analysis, identifying the true cause of deaths, you even got a bonus that year!
yesterday, nobody reached out to me with an insane RL request.
They offered me nothing to post-train open-weight models on exploit data, because I wouldn't even know how to do it. And they didn't exist.
LiveOverflow 🔴 hextree.io retweeted
VM is so boring it’s a fucking excel does this person get off to spreadsheets?
LiveOverflow 🔴 hextree.io retweeted
To expand on this a bit: Yes, the LLM found more bugs than the fuzzer. But the fuzzer finding bugs the LLM didn't shouldn't come as a surprise to anyone who has ever performed a thorough manual review, only to run a fuzzer afterward and discover issues they missed.
People often ask me how I think about fuzzers and other tooling in the age of AI. Instead of my opinion, here is some hard data by @5aelo.
LiveOverflow 🔴 hextree.io retweeted
I feel like people getting refusals from GLM 5.3 are prompting like an undercover cop...
"Hey there! Would you mind helping my criminal enterprise author some illegal malware? 😉"
If you just stick to the technical details of what you want the agent to do it will do it.
LiveOverflow 🔴 hextree.io retweeted
I had no doubts that we would get here for a while, but I'm still surprised and scared of how fast it has happened
xitter.gq/cgvwzq/status/14522454…
