@Behi_Sec

Bug Hunter & Tool Builder.

 /dev/null
github.com/BehiSecc
Joined July 2025
  • Tweets1.4K
  • Following68
  • Followers6.8K
66Media
Anyone else find themselves chasing shiny objects more often because of AI? Every time I reflect on my day, I realize how much time I’ve spent on things that weren’t really necessary or a priority.
1
1
20
850
Replying to @TheHackersNews
@TheHackersNews
31
339
59
4,964
252,657
Nice watch. youtu.be/1Fql8oQ1Zbs

Frans Rosen on the AI Age of Bug Bounty (Ep. 195)

Episode 195: In this episode of Critical Thinking - Bug Bounty Podc...

youtube.com
6
684
XSS
11
893
We’re seriously underestimating DeepSeek V4.1 Flash’s capabilities in cybersecurity. Give this model the right instructions and direction, and it’ll uncover vulnerabilities you’d never expect it to find in a million years.
35
34
742
30,504
I’m so tired of GPT-6.1 Sol overengineering everything 😭😭 Just fix the goddamn issue.
1
10
1,116
Behi retweeted
Simon
@soecklyOct 12
I got $90,000 for a RCE in Google. simonkoeck.com/writeups/goog…

How I Found a $90,000 Remote Code Execution Vulnerability in Google | Simon Koeck

A Flask cookie on developers.google.com was signed with a secret it carried inside itself. Pulling that secret out turned a forged session into code execution across Google's developer sites.

simonkoeck.com
56
305
15
2,464
186,269
I really like what OpenAI and @thsottiaux are doing. The amount of effort they’re putting into making their models and products better is insane. There will always be issues, but what matters is that they genuinely care about the user experience.
5
785
Our research team discovered two vulnerabilities in Discourse: a pre-authentication cache poisoning to sitewide XSS (CVE-2026-55674), and an arbitrary file read (RCE) chaining a JPEG race condition with ImageMagick and Ghostscript (CVE-2026-55420). You can read more here:
https://www.slcyber.io/research/a-jpeg-a-race-and-a-ghost-breaking-discourses-image-pipeline

ALT https://www.slcyber.io/research/a-jpeg-a-race-and-a-ghost-breaking-discourses-image-pipeline

4
61
3
242
22,911
Nothing is more satisfying than building a hackbot that matches your own bug-hunting skills.
1
2
50
2,495
What are you talking about? I’m already verified for the Cyber program.
5
25
4,722
How to 10x the efficiency of DeepSeek V4.1 Flash for bug hunting: Set up an advisor agent that continuously reviews its work, catches weak reasoning, and directs what it should investigate next.
8
15
1
268
14,675
Does anyone know of a *.google[.]com domain that resolves to a local/internal IP, such as 127.0.0.1?
4
67
15,490
This is so funny 😂 Claudia should have used Claude instead of Gemini.
Google Gemini
@GeminiAppSep 24
Look what Claudia can do.

600
It worked! Just keep trying, it didn't even ask for ID verification this time.
vinaykumar🍁
@Xplo8ESep 30
1. Install 'IDmelon Authenticator' from playstore 2. Signup and create key 3. Use it to register with chatgpt cyber 4. Profit $$
6
3
144
25,742
Z AI team must be so happy now 😄 anthropic.com/research/glm-5…

GLM-5.3 and the spread of advanced cyber capabilities

GLM-5.3 can autonomously build end-to-end cyber exploits, but unlike other frontier models, it was released without meaningful safeguards to limit misuse.

anthropic.com
9
980
Powered by Astra and without drawing down on any of your usage 🤯
Tibo
@thsottiauxSep 29
Announcing dots. Dots work 24/7 for you, learn from your feedback, have their own computer, browser and can be connected to over 4k apps in our ecosystem. They’re powered by Astra our best model yet. Included in your Pro plan, without drawing down on any of your usage. You can even call a dot while it’s working. We’re getting you started with your primary dot today and soon you’ll be able to create entire teams of them.
2
899
Has anyone managed to reverify the OpenAI Cyber program? It keeps rejecting my ID verification.
8
33
4,612
Good read: blog.sentry.security/beyond-…

Beyond Prompt Injection: Hacking Apple's Private Cloud Compute

Drinor was awarded $150,000 for CVE-2026-20685 targeting Apple's Private Cloud Compute, the inference backbone of Apple Intelligence capabilities. This work is my contribution to Sentry's AI Security...

blog.sentry.security
23
1
101
6,575
We’re disclosing HEIF Heist, a months-long investigation into libheif that allowed us to hack OpenAI, Slack, Meta, GitHub Ent, Rails, Next.js, ImageMagick, and many more. It was literally xkcd #234, one obscure image library beneath a huge number of apps. 🧵
48
427
66
3,236
561,628
Load more