@udp_ctf

pwn @ Water Paddler / Blue Water

Joined March 2023
  • Tweets94
  • Following416
  • Followers323
8Media
So the challenge i wrote for @PotluckCTF introduced a new heap house (which I shamelessly dubbed "house of water" after my two teams), and a general technique I dubbed "safe link double protect". Both are now available here: github.com/shellphish/how2he… github.com/shellphish/how2he…
udp
@udp_ctf29 Dec 2023
Made a fun little heap challenge for #37C3 @PotluckCTF called Tamagoyaki. It features a fun way to bypass protect_ptr without a leak I discovered while exploiting a bug. It only got one solve during the CTF, so made a writeup: github.com/UDPctf/CTF-challe…
7
35
7,020
WE ARE DEF CON CTF CHAMPIONS! 🏆 What a run. What a team. After all the late nights, endless debugging, and insane battles, we finally made it. DEF CON CTF 2026 — CHAMPIONS. So proud of everyone who fought together. 💙
2
13
72
3,656
Or we just win
udp
@udp_ctfAug 5
Ready to get 2nd place in DEF CON CTF for the 4th year in a row 🫡
1
4
1
75
7,527
Time to find a new hobby to obsess about
105
Me happy with my black badge. Finally can call myself a DEFCON CTF winner now.
perfect blue@pb_ctfAug 12
We won DEF CON CTF! perfect blue first formed in 2018 for DEF CON quals. We went from not qualifying, to 6th, 5th, and 2nd place. Dreams do come true🥲 This was the last big CTF we wanted to win. It's bittersweet but a good end. Thanks for all the great memories over the years.
21
2
218
14,806
udp retweeted
kylebot@ky1ebotAug 11
I'm proud to be part of the team that trained GPT-5.6-Cyber! It is an honor to work with all the talented researchers!
OpenAI
@OpenAIAug 10
We’re expanding our cybersecurity initiative Daybreak and introducing GPT-5.6-Cyber, a new model for advanced, authorized cybersecurity work. As the threat landscape evolves, we’re putting frontier intelligence in the hands of trusted defenders before attackers can deploy offensive AI at scale.
5
3
182
20,368
udp retweeted
Zach Wade@zwad3Aug 10
Congratulations to all the DEF CON CTF players!! Particular congrats to 🎲SDCL, 🇰🇷0x4B52, and of course 🌊Blue Water for winning
1
14
3
86
76,711
Ready to get 2nd place in DEF CON CTF for the 4th year in a row 🫡
udp
@udp_ctf10 Aug 2025
Getting 2nd place in Defcon finals for the third year in a row has triggered the great depression for the team xd
1
28
8,813
udp retweeted
itszn@itszn13Jun 21
This was a fun v8 bug we caught before it got released to stable A new opt replaced ARM64 f64mod instruction L%R with a fast impl: L-trunc(L/R)*R However this has a bad edge case with f64 precision JIT range analysis uses correct mod -> range confusion -> range elimination
Security Bug Aggregator@BugsAggregatorJun 9
[488078904] Incorrect Float64Mod Fast-Path Producing Range Confusion in Optimizing Compilers crbug.com/488078904
4
17
126
19,786
udp retweeted
kqx@kqx_ioMay 24
DEF CON patched our QEMU nday, what about a 0day? kqx.io/post/qemu-0day
49
3
235
26,391
Defcon CTF sponsored by Anthropic and OpenAI 👀
1
39
3,888
Obligatory "I'm at offensivecon, come say hi" tweet
5
361
>This update includes 127 security fixes. 🫠
Chrome Releases Blog@_ChromeReleasesMay 5
Google Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.co…

Stable Channel Update for Desktop

The Chrome team is delighted to announce the promotion of Chrome 148 to the stable channel for Windows, Mac and Linux. This will roll out ov...

chromereleases.googleblog.com
9
1,384
udp retweeted
Bruno@bkth_May 1
dfsec.com/careers/
Google VRP (Google Bug Hunters)
@GoogleVRPApr 30
📣📢 Calling all Android and Chrome bug hunters 🧑‍💻🔎! We're updating our Android & Chrome VRP programs to ensure we can continue to reward the most challenging and impactful vulnerabilities researchers find in our products. For details, 👇 bughunters.google.com/blog/e…

Blog: Evolving the Android & Chrome VRPs for the AI Era

We are announcing changes to the Chrome & Android Vulnerability Reward Programs (VRP) which take effect immediately and are focused on adjusting our reward amounts and bonuses to reflect the types of...

bughunters.google.com
1
9
1
94
13,333
Super proud of my team and everyone in the org that came together for this! This is probably one of the craziest things we’ve pulled off in my 3+ years here. And this is just the start -- we have a lot more planned in the next several months!
Anthropic
@AnthropicAIApr 7
Introducing Project Glasswing: an urgent initiative to help secure the world’s most critical software. It’s powered by our newest frontier model, Claude Mythos Preview, which can find software vulnerabilities better than all but the most skilled humans. anthropic.com/glasswing

Project Glasswing: Securing critical software for the AI era

A new initiative to secure the world’s most critical software and give defenders a durable advantage in the coming AI-driven era of cybersecurity.

anthropic.com
5
4
24
1,307
The glibc cycle continues lol.. Unsafe -> implement safety features -> safety features slow -> circumvent safety features in order to get speed -> unsafe github.com/shellphish/how2he…

how2heap/glibc_2.42/tcache_metadata_hijacking.c at master · shellphish/how2heap

A repository for learning various heap exploitation techniques. - shellphish/how2heap

github.com
25
2
162
9,385
udp retweeted
Bruno@bkth_Feb 13
We're hiring browser researchers, our team has combined decades of experience so if you're looking to work with and learn from some very bright people and have a track record in the field, shoot me a DM or apply through our website dfsec.com/careers/
3
6
88
7,865
udp retweeted
Jack Ren@bjrjkFeb 6
A collection of my JavaScript engine vulnerability analyses. github.com/bjrjk/js-vuln-stu…

GitHub - bjrjk/js-vuln-studies: A collection of in-depth studies authored by me on JavaScript...

A collection of in-depth studies authored by me on JavaScript engine vulnerabilities. - bjrjk/js-vuln-studies

github.com
1
40
235
11,306
Crazy…Apple is now using my SSA graph viewer tool for JSC. I’m baffled that this works so well for other compilers besides SpiderMonkey. I guess “good compiler graphs” was lower-hanging fruit than I thought. github.com/WebKit/WebKit/tre…
7
33
2
344
32,429
udp retweeted
kylebot@ky1ebotJan 7
angrop just received the biggest update ever. In some cases, it is even more capable than humans. Check it out! github.com/angr/angrop
1
21
130
9,375
[446722008][reward: $100000] heap-use-after-free in content::indexed_db::Database::connections_ when force_closing_ is true crbug.com/446722008
2
44
7
293
175,342
Load more