i make computer do bad 🧙 security researcher 📺 1M+ youtube Business: ed@lowlevel.tv Evo by Snyk: https://xitter.twitterapi.xyz/t.co/l4HGeh0IL8
Washington D.C.
Joined July 2021
- Tweets4K
- Following1.6K
- Followers58.7K
- Likes16.9K
this bug is truly unbelievable. how did no one catch this for 10 years
*sshole is out
if you run sshd on alpine, openwrt or any musl box with password auth on: update now
official writeup: sshhole.com
Writing secure + AI generated code is hard, but it doesn't have to be! Use Evo by Snyk to secure code as you write it. Link in bio! @snyksec #sponsored #AISecurity
open models are the future
haha, so apparently OpenAI are about to start training on your Daybreak Blue sessions, with no way to opt out.
Literally stealing people's private work, as they do it, is cartoonishly evil.
It also will presumably kill Daybreak usage by security researchers. Or at least, it should. The thing OAI have had to swear they are not doing to math researchers, they are now explicitly about to start doing to security researchers.
Yet another reminder of the importance of open models.
“Internet exposed management interfaces”
plz stop
🚨 Palo Alto Networks confirms active attacks exploiting PHP2Shell flaws in internet-exposed PAN-OS management interfaces.
The flaws allow unauthenticated remote code execution. Multiple PAN-OS versions are affected, with some fixes still pending.
Read ↓ thehackernews.com/2026/10/at…
ctf in 2014: run this program in a debugger
ctf in 2026: become a threat actor and exploit this 0day with no public poc
Congrats to @killa who solved stealmybitcoin.com hours ago but I screwed up which key went on the server (the flag was a root wallet WIF instead of the branch WIF).
Check out their awesome writeup here: github.com/KillaBoi/StealMyB…
Real talk I know he’s joking but I hope everyone’s doing okay.
This industry is rough sometimes.
Make sure you go and literally touch grass, look at the sun (not directly you know what I mean)
I think we've discovered another critical vulnerability:
CVE-2026-BURNOUT: AppSec Professional Exhaustion
Severity: Critical (CVSS 10.0)
Description: A vulnerability affecting security professionals exposed to a continuous stream of critical RCEs, zero-days, emergency patches, and Friday afternoon disclosures.
Impact: Sleep deprivation, excessive caffeine consumption, and an inability to enjoy weekends.
Attack vector: Reading security advisories.
Affected versions: All AppSec professionals, regardless of experience.
Mitigation: No known patch. Air-gapping may delay the inevitable. Total system collapse remains a possibility. 🔥
BRRRRRROTHER
Node.js Security Advisory: a high-severity RCE flaw in Node's Brotli decoder affects Node.js 22, 24, and 26.
Vercel WAF rules are live for every project and block known exploit patterns.
vercel.com/kb/bulletin/node-…
friend asks you to drive him to the airport on the same day your dog died
We are investigating reports of degraded performance for Actions, Pull Requests and Webhooks githubstatus.com/incidents/n…
