segfaulting through life & learning security 📉. I also like websec, softwaresec and static analysis, prev: @snyksec,@mwrinfosecurity, @notsosecure
@gitlab
Joined January 2013
- Tweets2.3K
- Following664
- Followers612
- Likes5.3K
Sam Sanoop retweeted
Today @_rybaz and I are publicly releasing all the materials for our Introduction to Harness Engineering for Vulnerability Research training we gave at @unpromptedconf last week.
Our goal was to teach the concepts we've been using to do much deeper security research and make both vulnerability analysis and red team engagements far more impactful.
The workshop can be found here: grahamhelton.github.io/harne…
The slides can be found here: grahamhelton.com/talks/2026-…
Sam Sanoop retweeted
*sshole is out
if you run sshd on alpine, openwrt or any musl box with password auth on: update now
official writeup: sshhole.com
Sam Sanoop retweeted
Better late than never. I published my writeup on Pwn2Own Berlin May 2026 on LMStudio RCE chain (fixed long time ago) blog.drstra.in/posts/a-misse… 👀👀👀
Sam Sanoop retweeted
We built a vulnerability research pipeline, using an upcoming cyber model, to analyze the security of the Linux kernel. Besides finding and exploiting the found vulnerabilities, the agents discovered at least 10 new exploitation techniques that were new to us and some external kernel exploit experts we checked with.
More on the design and what we learned: openai.com/index/a-thousand-…
Sam Sanoop retweeted
my granny couldn't work out if she was affected by the eMudhra vulnerability, so I had the clanker build her a website
fixemudhra.com/
thought it might be useful for other people as well so sharing it here
Built on @Dennis__Jackson's work with just a tiny bit nicer UI
Sam Sanoop retweeted
With @hash_kitten, we've been looking into Cloudflare's /cdn-cgi/image endpoint and managed to get an XSS :D
To achieve this, we used what I believe to be a new CSP bypass involving the Cache-Control response header, combined with a sanitizer bypass!
I hope you'll enjoy it! 👇
Our security research team discovered a cross-site scripting vulnerability in Cloudflare's /cdn-cgi/image/ endpoint by chaining an SVG sanitizer bypass with a new Cache-Control header trick to bypass the CSP. The issue was reported to Cloudflare and has since been fixed.
You can read more here:
slcyber.io/research/cache-me…
Sam Sanoop retweeted
Brotli CVE-2026-111497 goes well beyond Node.js.
Quick search shows unpatched Brotli decoders in Java HTTP stacks, WOFF2 libs, CF workerd.
TLS certificate compression (RFC 8879) is another attack surface worth investigating.
Check statically linked Brotli copies.
Sam Sanoop retweeted
To teach a lesson,
After Wiz rushed to buy php2shell domain and use its marketing machine to steal the spotlight, I spotted "phpbleed" in a recent Calif tweet and bought phpbleed.com before wiz could pull the same stunt again.
A big budget can buy a domain. It shouldn't buy someone else's research credit.
If you have contacts at CISA or in the press, do the right thing: make sure the researchers who actually did the work get the recognition they deserve.
Hack the planet. Credit the researchers.
Sam Sanoop retweeted
The write-up from @moyix is finally out! It covers how we discovered three Chrome vulnerabilities: a V8 memory corruption bug and two sandbox escapes (one from V8 and another from the renderer), and chained them together into a full Chrome exploit that earned a $250K bounty!
xbow.com/labs/research/zero-…
Sam Sanoop retweeted
How Anthropic's new engineering post would read without the PR:
Seven engineers, assisted by Claude, built and migrated to a new source control system in five months, handling 30,000 merges a day and reducing infrastructure CPU and memory requirements by 200x.
The system builds on architectures pioneered by Google's Piper and Meta's Sapling/Mononoke, and uses Google Spanner for distributed metadata storage and cloud storage for file contents. So the team didn't have to build the distributed database, replication, consistency, or fault-tolerance infrastructure from scratch.
The implementation and migration are genuinely impressive. But much of the difficult underlying infrastructure already existed, and the architectural ideas have been used at scale for years.
There's also the question of what the numbers mean. Going from 2,500 to 30,000 merges per day measures how much code gets merged, not how much useful software gets produced.
So the valid claim is that Claude helped a small team rapidly implement and deploy a specialized source control system, using mature infrastructure and well-established architectural ideas.
Instead, we got this announcement: "At Anthropic, coding is no longer the bottleneck to building systems or doing research."
New on our Engineering blog: Creating in-house source control.
In May, we merged around 2,500 code changes per day. In September, we merged more than 30,000 per day. As a result, we became bottlenecked by developer infrastructure built for human (rather than agent) scale.
Here, we share how we built a new version control system—and fully migrated our monorepo from git—in five months: anthropic.com/engineering/re…
Sam Sanoop retweeted
I've finally published the write up on my Pwn2Own exploit!!!
github.com/newbe3e/Pwn2Own-A…
(image unrelated)
Sam Sanoop retweeted
Series on Compiler and LLVM internals
P1: sh4dy.com/2024/06/29/learnin…
P2: sh4dy.com/2024/07/06/learnin…
P3: sh4dy.com/2024/11/24/learnin…
P4: sh4dy.com/2026/10/04/learnin…
#infosec
Sam Sanoop retweeted
Introducing PageBreak, an agentic vulnerability discovery tool using deterministic validation to achieve a near-zero false positive rate.
How it works: blog.google/security/agentic…
For real-world vulnerabilities PageBreak has discovered 👇
bughunters.google.com/blog/p…
Sam Sanoop retweeted
‼️ just got a pretty smart github OAuth phishing/ATO attempt on my personal account.
attacker created a repo named after my github username, opened an issue mentioning me with a fake account-access alert, which triggered a real email from [email protected].
“This wasn’t me” → attacker-controlled GitHub Pages → real github.com OAuth consent page for an app called “profile security settings”, asking for public/private repo access + permission to update GitHub Actions workflow files.
no fake github login page. the email is github, the auth page is github. the malicious part is the OAuth app + redirect flow.
the page is just an obfuscated redirector, while the OAuth callback forwards the returned code/state to the same backend: github.com/api6268/code-839c…
also caught two other username-specific phishing issues from the same github account before they disappeared.
some indicators:
issue account: 6119f4f
OAuth app: profile security settings
consent: Authorize request-6286
landing: api6268[.]github[.]io/code-839c74ee/
related landing: api25cd[.]github[.]io/account-13e95c92/
callback: request-6286[.]github[.]io
backend: gitmain[.]serveblog[.]net
route ID: 9e52a992
Sam Sanoop retweeted
Hacktron pwned OpenAI through a libheif bug, ok fine.
A few days later (back from the Oktoberfest) I found a *newer* libheif 1.23.x behind an image API during one of my own engagements, so I went digging.
I ended up finding an undocumented remote iref/dimg heap-grooming primitive:
controlled reference graphs produce repeatable malloc(16) allocations in glibc’s 0x20 class, with controlled lifetime, attacker data and predictable reuse.
And guess what?
Then a fresh libheif 1-day dropped with no public PoC, so I took it from source diff to
TAI UAF -> reclaim -> stale free -> safe-linked tcache poison -> _ZdlPvm@GOT -> system() -> RCE
(github.com/strukturag/libhei… - I do not share the POC as well but in 2026 it's not a big challenge anymore right ?)
> 1 primitive gives remote heap shaping, the other shows what a compatible corruption bug can become.
And all of this came from an API testing... less OWASP testing, more PWN ! <3
Full write-up:
boffsec-services.com/posts/l…
Sam Sanoop retweeted
$148,337 from two Google Cloud RCE chains. đź’°
crazy payout, but the part i liked more:
the researcher stopped mid-chain and asked Google for permission before going further. đź‘Ź
a few takeaways:
→ a fix isn't a fix if another backend is still vulnerable.
→ auth ≠authorization. knowing the project ≠checking ownership.
→ debug/test endpoints in prod can become a nasty attack surface real quick. 👀
Full writeup:
brutecat.com/articles/google…
Sam Sanoop retweeted
I really don't think people are understanding the @HacktronAI HEIF Heist moment properly.
Before AI, what class of attacker do you think would be capable of discovering a silently fixed upstream image parser vulnerability w/o a CVE assigned nor patched in distro packages, exploiting against modern Linux w/ ASLR, and then using it to pop top-tier tech companies w/o them noticing?
I have *never* seen bug bounty researchers land something like that. Have you?
Sam Sanoop retweeted
There's still some novel attack vectors that are only being operationalised now. @justinsteven is presenting on his research on timing attacks at @BSidesCbr today, and has released tturl as open source! github.com/tantosec/tturl - Justin/Tanto have put a lot of work into this.
