Q5Ca (@_q5ca) header
Q5Ca (@_q5ca) profile picture

Q5Ca

@_q5ca

Đoàn Phan Tùng Dương @ https://teapaw.org/t.co/DxGrO0nE57

 Vietnam
duongq5ca.substack.com/
Joined November 2017
  • Tweets255
  • Following426
  • Followers969
18Media
Photo by Q5Ca (@_q5ca)Photo by Q5Ca (@_q5ca)Photo by Q5Ca (@_q5ca)Photo by Q5Ca (@_q5ca)Photo by Q5Ca (@_q5ca)Photo by Q5Ca (@_q5ca)Photo by Q5Ca (@_q5ca)Photo by Q5Ca (@_q5ca)Photo by Q5Ca (@_q5ca)
Q5Ca retweeted
Khoa Dinh (@_l0gg) profile picture
Khoa Dinh@_l0ggAug 17
@msftsecresponse please check this case, this is not Spoofing!!!
1
6
684
guys you do know you can just disable thinking, and instead give it a "deep_think" tool, and it will call it with internal CoT reasoning format right? gl fixing that
Image from Can Bölük (@can1357)
Alexander Panfilov (@kotekjedi_ml) profile pictureAlexander Panfilov
@kotekjedi_mlAug 11
We can finally talk about it: We found a way to extract hidden reasoning of frontier models using a vulnerability in the APIs of every frontier AI company. We verified that our reasoning token count matches billed API thinking tokens 1:1 for most of the prompts we queried.
Image from Alexander Panfilov (@kotekjedi_ml)
154
449
139
6,378
957,580
We can finally talk about it: We found a way to extract hidden reasoning of frontier models using a vulnerability in the APIs of every frontier AI company. We verified that our reasoning token count matches billed API thinking tokens 1:1 for most of the prompts we queried.
Image from Alexander Panfilov (@kotekjedi_ml)
380
1,959
620
13,502
3,544,471
Q5Ca retweeted
Khoa Dinh (@_l0gg) profile picture
Khoa Dinh@_l0ggAug 12
Blog for CVE-2026-55040, SharePoint Server Subscription Edition improper JWT validation lead to Arbitrary Account Login: blog.viettelcybersecurity.co… !POC is in blog! no need to find SID
Image from Khoa Dinh (@_l0gg)
1
33
1
159
12,608
Seems that wp2shell PoCs are now floating around the internet, so we've published our blog post including our research methodology for finding the bug as well as a deep dive into the chain itself - slcyber.io/research-center/e…

Exploit brokers pay $500,000 for a WordPress RCE. I found one with GPT5.6 Sol Ultra and $25

Adam Kues used a $200 GPT5.6 Sol Ultra subscription to discover a pre-authentication SQL injection and full RCE exploit chain in WordPress Core – a chain that chains a batch API desync, cache...

slcyber.io
16
201
24
715
80,311
Image from splitline 👁️🐈‍⬛ (@_splitline_)
TrendAI Zero Day Initiative (@thezdi) profile pictureTrendAI Zero Day Initiative
@thezdiMay 16
Booyah it's been confirmed! 🎉 splitline (@_splitline_) of DEVCORE Research Team chained 2 bugs to exploit Microsoft SharePoint, earning $100,000 and 10 Master of Pwn points. Massive aura farming this year at #P2OBerlin. Full win! #Pwn2Own
Image from TrendAI Zero Day Initiative (@thezdi)
Image from TrendAI Zero Day Initiative (@thezdi)
Image from TrendAI Zero Day Initiative (@thezdi)
4
13
173
17,262
And this one is human insight w/ LLM-assisted research. Took about one week to finish everything. The AI really rescued me from a lot of tedious work — excluding the part where it changed the Domain Admin password, locked me out, and claimed it got RCE 🤦
TrendAI Zero Day Initiative (@thezdi) profile pictureTrendAI Zero Day Initiative
@thezdiMay 15
Aaaand it's official! Orange Tsai (@orange_8361) of DEVCORE Research Team chained 3 bugs to achieve Remote Code Execution as SYSTEM on Microsoft Exchange, earning a whooping $200,000 and 20 Master of Pwn points. Full win! #Pwn2Own #P2OBerlin
Image from TrendAI Zero Day Initiative (@thezdi)
46
152
22
1,676
132,641
Locked in! Le Duc Anh Vu (@vulda17) of Viettel Cyber Security (@vcslab) exploited Cursor, earning $30,000 and 3 Master of Pwn points. Full win! #Pwn2Own #P2OBerlin
Image from TrendAI Zero Day Initiative (@thezdi)
1
12
119
7,645
Aaaand it's official! Orange Tsai (@orange_8361) of DEVCORE Research Team chained 3 bugs to achieve Remote Code Execution as SYSTEM on Microsoft Exchange, earning a whooping $200,000 and 20 Master of Pwn points. Full win! #Pwn2Own #P2OBerlin
Image from TrendAI Zero Day Initiative (@thezdi)
26
174
60
1,542
287,050
There it is! Orange Tsai (@orange_8361) of DEVCORE Research Team was able to exploit Microsoft Exchange! If confirmed, they win a whooping $200,000 and 20 Master of Pwn points. Off to the disclosure room to explain how they did it and seal the deal. #Pwn2Own #P2OBerlin
15
63
18
520
68,832
Boom! @rewhiles of Viettel Cyber Security was able to exploit Anthropic Claude Code! If confirmed, they win $40,000 and 4 Master of Pwn points. They're off to the disclosure room to explain how they did it. #Pwn2Own #P2OBerlin
1
6
1
55
6,505
That's my chain — a full chain w/ logic bugs only! No memory corruption, no AI, and of course no collisions at all 😉
TrendAI Zero Day Initiative (@thezdi) profile pictureTrendAI Zero Day Initiative
@thezdiMay 14
Confirmed! Orange Tsai (@orange_8361) of DEVCORE Research Team (@d3vc0r3) chained 4 logic bugs to achieve a sandbox escape on Microsoft Edge, earning $175,000 and 17.5 Master of Pwn points. Full win! #Pwn2Own #P2OBerlin
Image from TrendAI Zero Day Initiative (@thezdi)
108
362
41
2,580
224,864
That's a wrap on #Pwn2Own Toronto 2023! We awarded $1,038,250 for 58 unique 0-days during the event. Congratulations to Team Viettel (@vcslab) for winning Master of Pwn with $180K and 30 points. We'll see you at Pwn2Own Automotive in Tokyo next January.
Image from TrendAI Zero Day Initiative (@thezdi)
8
39
12
191
73,503
Nice play. #Pwn2Own #Xiaomi13Pro
Image from Công Thành Nguyễn (@ExLuck99)
2
10
3,085
* People ask LLMs to write code * LLMs recommend imports that don't actually exist * Attackers work out what these imports' names are, and create & upload them with malicious payloads * People using LLM-written code then auto-add malware themselves vulcan.io/blog/ai-hallucinat…

Cybersecurity Snapshot: New Guide Details How To Use AI Securely, as CERT Honcho Tells CISOs To...

Cyber agencies from multiple countries published a joint guide on using artificial intelligence safely. Meanwhile, CERT’s director says AI is the top skill for CISOs to have in 2024. Plus, the UK’s...

tenable.com
76
1,990
499
7,258
1,794,819
Q5Ca retweeted
Bythos (@bbbb) profile picture
Bythos@bbbb29 Mar 2023
Replying to @bbbb @PeckShieldAlert @peckshield @SlowMist_Team @BlockSecTeam @cz_binance
and @0xblvck_ pointed out the exploit block 26864890 has only one transaction. We need some explanation from @ankr ?
Image from Bythos (@bbbb)
2
9
2,251
Success! dungdm (@_piers2) of Team Viettel (@vcslab) used an uninitialized variable and a UAF bug to exploit Oracle VirtualBox. They earn $40,000 and 4 Master of Pwn points. #Pwn2Own #P2OVancouver
Image from TrendAI Zero Day Initiative (@thezdi)
Image from TrendAI Zero Day Initiative (@thezdi)
10
2
67
15,469
Success! @hoangnx99, @rskvp93, and @_q5ca from Team Viettel (@vcslab) used a 2-bug chain in their attempt against Microsoft Teams. They earn $75,000 and 8 Master of Pwn points.
Image from TrendAI Zero Day Initiative (@thezdi)
11
58
10,759
Success! @testanull of @starlabs_sg was able to execute a 2-bug chain on Microsoft SharePoint. They earn $100,000 and 10 Master of Pwn points. #Pwn2Own #P2OVancouver
Image from TrendAI Zero Day Initiative (@thezdi)
Image from TrendAI Zero Day Initiative (@thezdi)
5
47
9
258
61,080
Now we are back with 2 entries. Come on! zerodayinitiative.com/blog/2…
Image from VCSLab (@vcslab)
7
2
28
11,196
Load more