Offensive Security & Exposure Management Platform 🎯 https://xitter.cf/t.co/57gODBq2WZ 👾 https://xitter.cf/t.co/ICc6RyhJTp 💡 https://xitter.cf/t.co/KNYxhkKuzt
World
Joined July 2012
- Tweets9.4K
- Following3.4K
- Followers43.4K
- Likes9K
Pinned Tweet
Claude Code, Codex or Gemini CLI for Bug Bounty? 🤔
We put all three through blind PortSwigger labs 🧪
These tests aren’t benchmarks, but the patterns observed say a lot about where each agent could fit in your workflow 👇
yeswehack.com/learn-bug-boun…
Cache poisoning gets a lot more interesting when the poison goes straight into the key 👀
@Brumens2's DEF CON talk explores cache key injection, scheme fragments and the unexpected bugs that can follow!
Read the full research below 👇
yeswehack.com/lab/research-c…
🔒 Precautionary Security Update
Following the recent disclosure of two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619, "PHP2Shell"), we have proactively placed our platform in maintenance mode.
To safeguard the data and security of our clients and users, access is temporarily blocked while our team applies the necessary patches across our infrastructure.
We will provide an update here as soon as maintenance is complete and platform access is restored. Thank you for your patience and understanding.
Want to sharpen your IDOR, stored XSS and information disclosure skills? 🧠 The hunters who topped our 2025 leaderboards for these bugs – @XelBounty, @Chackal__, @drak3hft7 – shared their best-practice tips 👇
yeswehack.com/learn-bug-boun…
🏁 #SPIRITCYBER26 has come to a close after weeks of persistence, creativity and pushing the limits.
Huge congratulations to the top five:
🥇nullIoT
🥈One Prompt to Pwn Them All
🥉Peenoise
🏆Hamtarou
🏆Undefined Behavior
👏 Big shoutout to all the team that took part in the qualifiers. Every valid report helped push the challenge further and strengthen the connected technologies supporting Singapore’s #SmartNation.
🤝 Proud to have joined forces again with @CSAsingapore for another round of hacking for a good cause.
Till next year!
⌛ Last chance to shake up the leaderboard.
The #SPIRITCYBER26 finalists know their targets well, but one overlooked detail or breakthrough could still change everything. ⚡Final day starts now!
#SICW2026 @CSAsingapore
💡 Behind every finding: trial and error, dead ends, and sometimes another hunter asking, “Have you tried this?”
That’s the power of the #BugBounty community. Different minds with a shared goal of making digital systems safer for all.
Leading the pack at #SPIRITCYBER26: @bytehx343 @0xakm, @mgthura404 from Team nullIoT🔥
Stay tuned for the final push tomorrow.
#SICW2026 @CSAsingapore
👀 #SPIRITCYBER26 so far: 10% typing, 90% staring intensely at the screen.
Our 5 finalist teams spent the day pulling apart these IoT devices and refining their exploits. Some findings come quickly, but the interesting ones usually don’t.
Back tomorrow for Day 2! 🔎
#SICW2026 @CSAsingapore
🇸🇬 Today, the #SPIRITCYBER26 IoT Bug Bounty finals officially begin at @SICWSG, in collaboration with @CSAsingapore!
☝️ 30 teams. 5 weeks of hacking. 5 finalists heading to Singapore:
🔹 nullIoT
🔹 Peenoise
🔹 One Prompt to Pwn Them All
🔹 Hamtarou
🔹 Undefined Behavior
Now the challenge continues with three days of live hacking to dig deeper, prove impact and help strengthen the security of critical #IoT systems.
Good luck to all and let the hacking begin 💥
#HackThePlanet
“Your main hacking tool should be your own knowledge and curiosity,” says @_Sn0rkY, a longstanding hunter on our Bug Bounty Programs 🧠
In a video just published on our blog, the hacker shares his backstory, hunting approach and perspective on AI 👇
yeswehack.com/community/inte…
Hacking complete. Leaderboard locked. 🔒
🥇 PyUs3r
🥈 bofill3
🥉 tonysec
🌈 Full Spectrum: @deb_security
💥 Biggest Impact: bofill3
Thanks @BancoGalicia, @BugBountyArg & @Ekoparty for a great round two! 🚀
✅ Final leaderboard: event.yeswehack.com/events/e…
Day two at @ekoparty: done ✅
Our LHE with @BancoGalicia and @BugBountyArg is heading into its final stretch. PyUs3r, tonysec and gpk21 are still leading 👀
Who will finish on top? 🏆
Leaderboard 👉 event.yeswehack.com/events/e…
The hunt is back on ⚡
Day 2 of our LHE with @BancoGalicia and @BugBountyArg has begun at @ekoparty! 🐛
PyUs3r, tonysec and gpk21 currently lead the leaderboard. Can anyone shake up the podium today? 👀
Follow the action 👉 event.yeswehack.com/events/e…
Round two. Let the hacking begin 🔥
Our Live Hacking Event with @BancoGalicia and @BugBountyArg is officially underway at @ekoparty!
Hackers, you know the target. Now you have until Friday, 10AM, to show us what you can find 👀
Happy hacking!
🔗 Leaderboard: event.yeswehack.com/events/e…
Not every AI agent needs to do the active hacking! 👀
Gemini CLI is fast, cheap and great at reviewing large amounts of HTTP traffic or source code.
We tested it on blind vulnerability labs to see what it could spot 🔎
Full test 👇
yeswehack.com/learn-bug-boun…
This week, the hunt goes live in Buenos Aires! 🔴
From Wednesday, 1PM to Friday, 10AM, @BancoGalicia, @YesWeHack and @BugBountyArg are back at @ekoparty for our second Live Hacking Event together.
If you’re attending, bring your laptop and come put your skills to work. 💻
What if one request could tell two different stories? 👀
This month’s Dojo is all about making the right thing appear in the wrong place. Can you fool the system and capture the flag? 🚩
Go hack it 👉 dojo-yeswehack.com/challenge…
