26 • breaking @valvesoftware, @riotgames, @g2esports, @ESL @FACEIT Group + absolutely everything else. not really active on here. contact: [email protected]

Leicester, United Kingdom
Joined December 2014
spot the odd one out @CounterStrike
5
27
31,745
The way frontier labs have restricted access to cyber capabilities makes no sense. If you're considered a "defender" you're not allowed access to the "offensive" versions of the models (the ones that can do development/validation of malware and exploits). So for example, if you want to build some sample malware to test a detection system, nope. Or if there's a major crisis due to a critical vulnerability in PHP and you need to rapidly triage fake exploits to see if there are any real ones floating around so you can warn people, nope. Want to build a remote code exploit to make sure the detection rules you plan on proposing to the clients actually work? Hard nope. You gotta call your red team friend and wait for them to do your job for you, because "defender" are only allowed to play in the sandbox with the children. Not an expert, but I think that the ability to triage in-the-wild exploits during a major crisis affecting 40 million systems is possible maybe important. And then they want to ban abliterated open weight models, which half of the people are only using because frontier labs will only give them access to lobotomized models.
13
24
4
152
9,401
wtf
honestly insane if you read @killa GitHub report on how he did it also… there are some fees to claim on @Pumpfun for you 🫡
1
8
2
117
20,115
i guess i bought some, idk how any of this pumpfun works but thanks? also donated some of the btc and the pump fund stuff i got to the lupus research alliance cuz fuck lupus.
8
3
167
14,884
Someone has created a vulnerable PHP website, loaded it with a Bitcoin wallet, and challenged the Internet to hack into it and they can keep the Bitcoin. It has a running timer to show if the PHP exploitability was over-hyped. stealmybitcoin.com/
164
431
134
6,202
2,190,346
Replying to @JamesPavur @killa
Tested the POC on the server (which will be back online for people to play around with soon) and it works like a charm:
2
2
1
47
13,196
Congrats to @killa who solved stealmybitcoin.com hours ago but I screwed up which key went on the server (the flag was a root wallet WIF instead of the branch WIF). Check out their awesome writeup here: github.com/KillaBoi/StealMyB…
32
189
34
1,696
319,241
stealmybitcoin was just solved by @killa. Or rather solved a few hours ago. He was confused because the wallet address was wrong. Turns out the server didn't have the right wallet :P
I took a closer look at the stealmybitcoin.com CTF, which aims to demonstrate that PHP2SHELL is not realistically exploitable. So I gave it a try. Note: My analysis could be wrong, and I'm more than happy to be proven otherwise. Here’s what I found: • The server responds with Server: nginx and X-Powered-By: PHP/8.4.26. • My differential fingerprinting scanner independently confirmed at least PHP 8.2+ • Hypotheses: I considered two possible setups: ◦ nginx → PHP-FPM ◦ nginx → Apache → PHP-FPM/mod_php • After comparing the server's behavior against local test environments, the closest match appears to be nginx → PHP cli-server. Plot twist: the response behavior is consistent with the PHP cli-server serving a static index.html rather than an index.php. If that's indeed the case, the challenge appears to be intentionally made unexploitable. My conclusion (for now) is that I'm questioning whether this is a good-faith challenge. Happy to be corrected if I've missed something!
41
45
18
689
107,654
Set session.upload_progress.enabled=0 till next PHP release to block an unlikely RCE vector (CVE-2026-115560). Already recommended for CVE-2026-109619 Wed, keep disabled. Only apps with non-default serialize_handler switching it to "php" at runtime can be affected. #php #phpc
49
903
151
2,843
403,307
again
The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2. PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.
31
1,189
17
17,034
243,417
killa retweeted
PHP 8.5.12 released - 90 fixes in 29 components, including security fixes (CVE-2026-109618, CVE-2026-109619). Changelog + downloads: php-net.pro/news/php-8-5-12-…
42
2,497
214
5,382
721,685
PHP sites behind Cloudflare already have an initial set of WAF rules deployed for the known exploit vectors in these vulnerabilities. The rules are available to all customers, including free. We are seeing early attacks emerging and are updating mitigations as new vectors show up. This is a STOPGAP only. Patch as soon as @ThePHPF releases the update at 14:00 UTC today.
The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2. PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.
87
876
193
5,391
753,985
🧠 How Secure Boot & TPM 2.0 Power Anti-Cheat This guіdе еxplains exactly why Secure Boot and TPM are mandatory, breaking down remote attestation and the hardware-level trust anti-cheats use to stop cheaters. 👉 guidedhacking.com/threads/th…
8
60
2,590
killa retweeted
Turns out the future does have flying cars
48,034
100,046
32,742
834,244
79,199,084
📱 Frida for Android: Bypassing Root Detection 🔑 Learn the common root detection methods (SU binary, package checks) and how to defeat them at runtime by creating custom Frida scripts that modify function return values 👉 guidedhacking.com/threads/fr…
4
30
2,024
killa retweeted
Today is Global Cat Day.
1,430
29,619
20,492
190,494
10,744,168
Watch the Grand Theft Auto VI Launch Trailer, featuring the debut of “Flower in a Hurricane" from original score composers Justice feat. Tame Impala, SZA, and King Gizzard & The Lizard Wizard. Grand Theft Auto VI arrives November 19: rockstargames.com/VI/ps5
8,988
65,195
16,056
461,073
62,284,456
The people who blame the anticheat when they get banned for hacking games, are the same people who blame us when they get banned for trying to hack our website.
1
29
2,105
🧠 How To Dump Virtualized Anti-Cheat Drivers When an anti-cheat driver blocks debuggers, standard dumping methods fail. Learn how to configure your system and extract the protected driver for offline analysis. 👉 guidedhacking.com/threads/ho…
14
1
159
5,400