Security - https://teapaw.org/t.co/4UtTZDCbYe
Joined July 2021
- Tweets1.2K
- Following1.1K
- Followers2.1K
- Likes11.1K
One month later, still waiting on Red Team access from @AnthropicAI , but at least it's in review. @OpenAI limits Daybreak Red to companies that clear some arbitrary bar (blogging and boasting, I'd guess). Until then, neither company is getting my cyber work. Just random dev stuff. Team plans are too pricey with no return, and my returns come from offensive security deliverables.
PHYR3WALL 🇺🇲 retweeted
We participated in a live hacking event this week and became completely unable to use US AI models. Nearly every attempt at authorized security research or exploitation was blocked by Daybreak/CVP.
Used a ton of DeepSeek and GLM 5.3 tokens instead - the only choice now
Neither @Grok or @claudeai will root devices anymore.
"Grok will identify an Echo Show and point at the public unlock thread, but it will not download or run the root package. It treats the bootloader unlock as an exploit it will not execute, even on a device you own, because a failed flash can hard-brick it."
PHYR3WALL 🇺🇲 retweeted
Seeing people who work in tech still resisting AI adoption is shocking.
At some point there will be a rude awakening. You must adapt.
PHYR3WALL 🇺🇲 retweeted
Most of the top exploit devs and bug bounty hunters I know are using Chinese models because they don’t refuse to do cyber tasks.
Which means that Chinese AI labs are sitting on 0days and critical vulnerabilities for all the big US companies.
That’s not great.
PHYR3WALL 🇺🇲 retweeted
I'm starting to sense a divide in the tech industry:
- People thriving on autonomy who are reinventing how they work and what tools they use with AI: LOTS of work, but they're enjoying it and getting very efficient
- People used to being mentored / trained / or simply told what to do and how. Frustrated with the lack of guidance from management on what to do with AI; also frustrated by seeing some of their peers thriving; increasingly bitter about AI and the state of the industry, as a whole
Neither group seems to be aware that there's another group, or have empathy for the other group
I've never seen "php -s" running in production BTW.
stealmybitcoin was just solved by @killa. Or rather solved a few hours ago. He was confused because the wallet address was wrong. Turns out the server didn't have the right wallet :P
PHYR3WALL 🇺🇲 retweeted
We’ve seen plenty of people try to vibe code the php exploit who have no experience in the domain. Failure. Over and over. Then people who know what they are doing in exploit dev, marginal success.
People would say anyone with a frontier LLM can just say “hack this site, make no mistakes” and I won’t argue, some shallow bugs will fall out this way for a while. But the most successful applications of LLMs are coming from experts who at least know how to dissect the problem, change the models thought direction, and have put engineering into harnesses and skills. I’ve seen this across several sub sections of cyber. And that requirement will only get more mandatory as all the shallow bugs shake out. Just my 2c and observation.
🫶
(Also beware of influencers trolling with opinions on this topic. It’s often just for fake clout and clicks)
Honestly this isn't easy. So many (99.9%) PoCs on X and GH are not actually viable. I leveraged a ton of prior knowledge and research... And used quite a few hints from other researchers to drop as context for my agent. Started as slop but turning into something useful... ish...but still slop
Same same
Update: Our PHP exploit is now production-grade.
* stock php.ini-production, display_errors=off, normal memory_limit, multi-worker, ASLR, under load
* ARM64 + x86-64 targets
* MediaWiki, WordPress, phpBB, Laravel
* Apache/mod_php and nginx/php-fpm -> root
teapaw.org/dguido/status/21131291…
Chances are you don't actually have a working php2shell heap PoC. You likely have a deserialization PoC that requires a gadget or you have display_errors=On.
PHYR3WALL 🇺🇲 retweeted
Quick tweet. Cybersecurity on the offense side, even with what Anthropic released today will be still a heavily restricted models and never the best.
For offense, your only choice is open weight models. I would not rely on frontier models for offensive research.
Invest in hardware or solutions that allow you to use hardware infrastructure as a service.
It will pay dividends.
In stating that, if you can get access to special programs as an organization/company - this is also an incredible option if approved through.
Same same, but different.
@BenAffleck, any interest in working with and investing in a ridiculously talented team of cybersecurity professionals doing some cutting-edge, impactful work at the intersection of AI and cybersecurity?
We're currently in stealth, but building something pretty exciting.
An update to this. A very understanding person from Anthropic's safeguards team DMd me on X asking for my reference number. I gave it to them and they reinstated my account. I reapplied for CVP and was approved instantly for Defensive. Now awaiting approval for Red Team Access.
