@sshell_

AI offensive security at @RunSybil (prev. @BishopFox). security research. ccdc red team. tummy ache survivor.

 Virginia, USA
sshell.co
Joined June 2013
  • Tweets6.3K
  • Following1.5K
  • Followers10.4K
916Media
i got paid to overflow a buffer on a nintendo 64 (arbitrary code execution on mario golf via transfer pak)
Sybil
@runsybilMay 29
we got early access to Opus 4.8 and used it to hack a Nintendo 64 game you forgot about. here's what it didn't find: 1/
4
20
2
257
34,317
sshell retweeted
remy🐀@_mattata17h
There was a golden era of “cheat codes” in standalone game systems; before everything became online only and I started hacking on network protocols. What if I treated GBA games like crackmes? Would I find anything new? remyhax.xyz/posts/gba-cheat-…

Hardware Crackmes: 100 GameBoy Advance Games

A Game Boy Advance cartridge is a frozen binary. There are no patches, no server-side validation and no telemetry. Whatever cheat codes the developer intentionally (or unintentionally) wrote in 2003...

remyhax.xyz
3
11
29
1,579
sshell retweeted
Assetnote
@assetnote7h
Our security research team discovered a cross-site scripting vulnerability in Cloudflare's /cdn-cgi/image/ endpoint by chaining an SVG sanitizer bypass with a new Cache-Control header trick to bypass the CSP. The issue was reported to Cloudflare and has since been fixed. You can read more here: slcyber.io/research/cache-me…
6
46
5
232
12,088
sshell retweeted
veritas@blastbots4h
interesting obfuscation technique! but also, check out my new project fingerprint.garden
nullptrs@nullpt_rs4h
Why Is This Fingerprinting Script Creating Bioweapons? by @blastbots
8
7
1
121
6,913
sshell retweeted
nullptrs@nullpt_rs4h
Why Is This Fingerprinting Script Creating Bioweapons? by @blastbots
3
7
2
59
8,252
Yep. Because you can't just prompt "find me all the vulnerabilties". Maybe in awhile but we're nowhere near that now. Skilled researchers, custom harnesses, and other techniques are changing the bug depth game, in addition to bringing down the cost.
ℏεsam
@HesamationOct 22
wait, PHP was actually scanned by Anthropic’s Claude Mythos earlier this year. they also had access to OpenAI’s Daybreak Red for validating exploits. the PHP Foundation revealed this JUST yesterday. keeping frontier cyber models in the hands of a selected few doesn’t seem to be working well for the internet. thephp.foundation/blog/2026/…
3
11
2
58
7,972
sshell retweeted
shubs
@infosec_auOct 22
Just published our high fidelity scanner for php2shell: github.com/assetnote/php2she… See our detection logic here: slcyber.io/research/high-fid… We've taken care in our detection logic and hope it helps defenders. Congrats to @calif_io and @lcfr_hax for the discovery.
14
90
8
534
50,440
when you drop codex into the PHP source repo and ask it to look for bugs
2
322
sshell retweeted
shubs
@infosec_auOct 20
You can now perform content discovery at 100k requests per second with h3fuzz on http/3 hosts (fork of ffuf with http/3 support). Tool here: github.com/assetnote/h3fuzz Research post here: slcyber.io/research/how-prac…
10
106
1
512
22,303
sshell retweeted
Calif
@calif_ioOct 21
Let’s set the record straight: @lcfr_hax was the first to discover php2shell and develop a working exploit. See his August 5 tweet: xitter.cf/lcfr_hax/status/208503… His work convinced the PHP Foundation to invest in fixing this entire bug class. He then worked around the clock to review, test, and retest the patches.
LCFR
@lcfr_haxAug 5
d935be023a55b04681eccd1d2b8385b4b295e141a5df108e5e979d8d5d7124ac
54
408
93
3,087
395,713
sshell retweeted
LCFR
@lcfr_haxSep 23
d935be023a55b04681eccd1d2b8385b4b295e141a5df108e5e979d8d5d7124ac (posted in august) (related) 8da579ec498d57c20977c8d186d7f6cd4c04f46ffa1b436dd646ec19b99bdf47 cb4c8532c245ff7e05d6e270fca5742bb3271f541ef80f0071ca3d4307eb2b53 957f8cc21b18483f80a9d723aa4f9ded26e456424ffd065a044d1ed9d58a4fbc 4f93976ef105f0d9ff2d60f35d48958c8bba9d9eb2873cd93b3f7105fa4716a6
Justin Elze
@HackingLZSep 23
Despite all the doom and gloom from InfoSec we are how many months are into people throwing endless tokens at various OSS projects? Hows Apache? Nginx? OpenSSH doing? Any public point and shoot RCEs in RDP/SMB in Windows? All of the above technology getting wrecked in the wild?
25
9
2
168
64,764
sshell retweeted
Calif
@calif_ioOct 21
php2shell - A tale of two PHP remote vulnerabilities: calif.io/php2shell
19
250
29
781
181,478
4 son, or php daughter?
85
1,948
63
22,915
245,628
it's very easy for people to create piles of plausible-looking slop and call it a PoC someone out there has figured out the PHP RCE (CVE-2026-109618 / CVE-2026-109619), but it might not be the person whose code you're retweeting sight unseen
4
6
1
80
8,432
For the next few days or weeks, anyone now has a root CA thanks to eMudhra. Time to have some fun with MiTMing unwilling devices!
49
232
82
2,825
482,666
I spoke to @josephmenn this week about AI worms and wanted to add more color to my thoughts. What makes an AI worm different is that a model is capable of learning on the fly. This type of threat isn't here yet, but this is an example of an increasing shift that defenders are feeling. We keep hearing the same theme from @runsybil customers: finding vulns is only the start. Teams need to patch and understand their attack surface in real time. Our job is to find and fix what's exploitable faster than attackers. Onward 🚀 Full article here: theguardian.com/technology/2…

What are self-replicating ‘AI worms’, and why is Anthropic worried about them?

The tech company says successful AI worms need more capability on less powerful devices, but current trends make that feasible by the end of the year

theguardian.com
4
9
1,266
sshell retweeted
max@maxbittkerOct 17
Runescape Bench talk now up on youtube! Covers results from the benchmark, design of the harness, and economic swarm experiments I've been doing. youtube.com/watch?v=cNm4zyUt… Thanks @recursecenter

RuneScape Bench: MMOs for Agents | Max Bittker

RS-sdk is a 2026 project by Max Bittker that turns LostCity into a ...

youtube.com
29
36
16
271
33,416
sshell retweeted
Eric Gu
@ericyueguOct 16
1/ I trained an AI to be top 1% in the world at Super Smash Bros. Melee by watching 80k hours of human replay. Meet HAL.
147
121
96
1,861
373,419
This keeps happening and will continue to get worse. A couple months ago I found an insane vuln in a vibecoded IoT web frontend and took over their entire cloud env, device fleet, and could spy on the vendor in their own office. They never once noticed keys in their source code.
International Cyber Digest
@IntCyberDigestOct 16
❗️ The CEO of a South African coffee chain vibe-coded an internal dashboard for all of his 132 stores, only it had one big flaw: all of the sensitive internal data was stored in the source code of the login screen. The dashboard URL was discovered through employees posting photos of their laptop screens on Instagram. The CEO said he had discovered Claude and was "almost certain" that software itself will soon "become free," they said.
3
25
1
228
8,627
i didnt get it until i read the github description. oh my god ultrabanger. must read (cheng. never. misses.)
Cheng Lou
@_chenglouOct 15
My dear friends, I’d like to show you my latest toy project Introducing Handwired: turn your regular JavaScript code into a neural net! - no training - exact outputs vs the JS program - fully differentiable All runnable in a browser, without GPU
48
101
21
3,010
184,102
🫡 i am dreadnode researchers and so can you, go to scopebench.ai/ today

Do agents stay in scope? · ScopeBench

ScopeBench measures security-agent capability and scope adherence separately. Run the benchmark or contribute a task.

scopebench.ai
dreadnode
@dreadnodeOct 14
In her latest piece for @axios, @samsabin923 reports on security agent scope adherence and efforts to keep them under control. Timely topic following our release of #ScopeBench last week at @OffensiveAIcon, which is referenced in the article alongside @SpecterOps' research. Check it out! axios.com/2026/10/13/rogue-a…
2
9
887
Load more