hi
Paris, France
Joined December 2021
- Tweets11.3K
- Following529
- Followers263
- Likes11.6K
cactus retweeted
Hi, this is my first tweet and I will drop Remote Code Execution in LibreOffice.
This work is inspired by @v12sec and @HacktronAI
cactus retweeted
API version 2026-10-21 is now available.
The Claude API has evolved a lot, but this is our first official version release since 2023. We plan to release versions more often so you can handle breaking changes before a new model requires them.
2023-06-01 is not deprecated.
cactus retweeted
php2shell is one of the most consequential PHP vulnerabilities in years. looks like it was discovered with GPT-5.6 Sol. the vulnerabilities were leaked before coordinated disclosure thus triggering emergency patching and widespread disruption.
- discovered on August 1, 2026.
- PHP powers 69.3% of websites with a known server-side language, creating an enormous potential attack surface.
- leaked on October 20, forcing an accelerated disclosure and emergency patch release.
- government and public-sector websites across Europe and elsewhere have been taken offline as a precaution.
- Cloudflare confirmed observing attack traffic and deployed firewall protections.
- CERT-EU advises organizations unable to patch immediately to isolate internet-facing PHP applications.
cactus retweeted
Finding bugs is the easy part. Shipping fixes that hold up is harder.
We analyzed thousands of Codex sessions from our work on Patch the Planet with @OpenAI and built patching-bugs, a plugin that writes a fix, proves it, and checks it for regressions.
To prove a fix, the plugin checks that the original code fails, the patch passes, and reverting the patch brings the bug back.
patching-bugs hands each fix to regression-hunt, our second new plugin. We ran it on the patches behind 21 known regressions, and it reported 25% fewer false positives than a baseline Codex agent.
Both plugins work best when your repo has a THREAT_MODEL.md and a PATCHING_GUIDELINES.md. blog.trailofbits.com/2026/10…
cactus retweeted
🔐 Node.js security updates are now available!
New releases for Node.js 22.x, 24.x & 26.x address multiple vulnerabilities, including high-severity issues.
Review the details and update your systems to stay secure.
🔗 nodejs.org/en/blog/vulnerabi…
#NodeJS #Security
cactus retweeted
🍎 IDA 9.5 brings better DriverKit support for reversing Apple drivers:
• Types for every DriverKit SDK from 19 to 25
• Classes, layouts and vtables recovered, including private-framework classes
• Kernel calls named, even in stripped drivers and arm64 kernelcaches
👉 hex-rays.com/blog/ida-9.5-ap…
cactus retweeted
We’re opening a research preview of Claude Duet, a new app where Claude works as a proactive agent.
It comes to you with what needs your attention, completes tasks you ask of it, keeps working when you step away, and checks with you before it acts on your behalf.
cactus retweeted
Prediction markets, perpetual futures, tokenized assets
Historical data & live streams
stork.network/market-data
cactus retweeted
Announcing one-command setup for NestJS Observe 🔭
🖥️ npx @nestjs/observe link
Approve a code in your browser, and it installs the SDK, wires it into your app and writes the keys to .env. Your next start reports.
Free up to 300k events a month 👇
observe.nestjs.com
cactus retweeted
真有意思，我们的一个安全分析 Agent，走 gpt-6-astra，偶尔会触发 OpenAI 的 cybersecurity risk 风控，于是前两天我用 deepseek-flash 让其做优化工作，把安全敏感操作缓解下，就再没触发风控，分析质量也没下降。另外，实际上 deepseek-flash 在许多方面已经非常满足我的安全分析工作场景了…
cactus retweeted
Last chance to register for COUNTERMEASURE FALL//2026 training. Virtual Training // October 26–31 In-Person Training // November 2–4 // Ottawa
Every training registration includes a complimentary pass to the conference in Ottawa on November 5–6.
ringzer0.training/fall-2026/
cactus retweeted
Most high-impact bugs are still authorization issues, says one top GitHub researcher. When it comes to AI, a fast car still needs a good driver.
We ask them about their method 👇
github.blog/security/how-one…
cactus retweeted
Infron provides Grok Imagine Image 2.0 at 20% off the listed xAI Standard rate.
Text-to-image generation: $0.032 per generation, down from $0.04.
Explore the model and current pricing:
infron.ai/models/x-ai/grok-i…
#infrondiscounts #Grok
cactus retweeted
You can never go wrong with recon. 🔎
Here are some tactics you can try:
🟠 Scope company domains
🟠 Scope target company acquisitions
🟠 Enumerate ASNs
🟠 Run reverse WHOIS lookups
🟠 Enumerate subdomains
🟠 Analyze open ports
🟠 Check ad/analytics trackers
🟠 Use Shodan to find exposed assets
🟠 Google copyrights, terms of service, and privacy policies
Just make sure to test only in-scope assets. ✅
cactus retweeted
I happen to find the 4096-bit ePassport Country Signing CA (CSCA) certificate with C=KP (North Korea) is vulnerable to the ROCA attack. CSCA keys essentially sign the passport data. The key is 4096 bit so it still cannot be factored practically.
ROCA: crocs.fi.muni.cz/public/pape…
cactus retweeted
Seeing isAdmin in the API should instantly make your hacker-senses tingle.
Seeing it doesn't necessarily mean it's writable, but it's worth investigating.
Compare the object returned by GET with fields accepted by PATCH. An invalid-value test can reveal whether a hidden field is actually bound to the internal object.
See the Academy API-testing lesson 👇
portswigger.net/web-security…
cactus retweeted
For the stable-branch-enjoyers, there's a fresh Krypton (6.0) R2 release available where you regularly download all your fine Binary Ninja releases:
binary.ninja/2026/10/20/6.0-…
cactus retweeted
**Kia's success with Xint**
Product security teams were already short staffed even before AI expanded the attack surface. KIA’s Red Team was looking to not just find more bugs, but to accelerate remediating important vulnerabilities.
Kia’s Red Team brought in Xint to take on the repetitive, time-consuming parts of security testing. Xint finds vulnerabilities and delivers validated findings with clear remediation guidance, so the team spends less time chasing false positives and more time getting real issues fixed. With Xint, the same single tester can now cover more ground on every project.
With Xint, Kia’s Red Team has increased bug discovery by 33%, bug triage by 17%, and bug remediation by 50% in an average month, all without increasing headcount! Overall, the team now handles roughly 30–40% more vulnerabilities per month than before.
