Caitlin Condon (@catc0n) header
Caitlin Condon (@catc0n) profile picture

Caitlin Condon

@catc0n

Adventurer. Takes a lot of photos, calls many places home. Research VP @VulnCheckAI. Previously @Rapid7 / @metasploit. Opinions mine. She/her.

 Boston, MA
caitlincondon.com
Joined October 2010
  • Tweets16.6K
  • Following2.9K
  • Followers3.7K
Announcing Initial Access community edition: A free, open-source repo of @VulnCheckAI-authored initial access exploits, each of which comes with a PCAP, target Docker container, and Snort/Suricata rules. New additions every Monday, contributions welcome: vulncheck.com/blog/initial-a…
VulnCheck Opens Initial Access Community Edition to the Public | Blog | VulnCheck

VulnCheck Opens Initial Access Community Edition to the Public | Blog | VulnCheck

VulnCheck releases free, open community edition of initial access exploits and detections.

vulncheck.com
2
12
1
33
2,812
Caitlin Condon retweeted
Jeremiah Grossman (@jeremiahg) profile picture
Jeremiah Grossman
@jeremiahg8h
Project Glasswing: * 37,966 findings. * 2 exploited in the wild. vulncheck.com/blog/anthropic…
After 7-months, Glasswing Overwelms Maintainers with Underwhelming Findings | Blog | VulnCheck

After 7-months, Glasswing Overwelms Maintainers with Underwhelming Findings | Blog | VulnCheck

Seven months into Project Glasswing, VulnCheck has tracked 442 CVEs attributable to Anthropic, roughly 0.5% of all CVEs published this year, with only two identified as exploited in the wild. Of...

vulncheck.com
13
36
20
184
37,480
Caitlin Condon retweeted
Dennis (@DennisF) profile picture
Dennis@DennisFNov 10
HONEYTRAP = Person pretending to like you in an intelligence operation HONEYPOT = Computer pretending to like your PHP2Shell exploit
3
11
30
1,160
New exploits in the @VulnCheckAI Initial Access community repo: Atlassian Data Center unauth cred leak (CVE-2026-21589), GitLab unauth RCE (CVE-2026-97229), and a Collabora Online RCE used in ransomware attacks (CVE-2026-110447). Detections + queries, too: github.com/vulncheck-oss/ini…
GitHub - vulncheck-oss/initial-access-community: Initial Access Exploits and Associated Artifacts

GitHub - vulncheck-oss/initial-access-community: Initial Access Exploits and Associated Artifacts

Initial Access Exploits and Associated Artifacts. Contribute to vulncheck-oss/initial-access-community development by creating an account on GitHub.

github.com
3
10
1
35
1,976
WHO DID THIS terminal2shell.com/
Terminal2Shell: Critical flaw grants instant shell access on every major OS

Terminal2Shell: Critical flaw grants instant shell access on every major OS

Researchers disclose a 55-year-old vulnerability affecting macOS, Windows and Linux. Exploitation is trivial and requires no special tools. No patch exists.

terminal2shell.com
1
5
386
Caitlin Condon retweeted
rekdt (@rekdt) profile picture
rekdt
@rekdtNov 5
cve-2026-83844: paint me like one of your french language packs
2
12
65
1,946
"If I jumped out of a plane and you threw me a parachute, I would have a better chance of nabbing that parachute than of exploiting this vulnerability." - Quote from the team exploit mines 2026-11-05T16:51:00Z I'll give ya two guesses on the vuln, but you'll only need one 🙄
2
2
17
2,331
Caitlin Condon retweeted
Natalie Silvanovich (@natashenka) profile picture
Natalie Silvanovich@natashenkaNov 2
GUESS WHAT?!?!
Natalie Silvanovich (@natashenka) profile pictureNatalie Silvanovich@natashenkaMar 31
Just put a reminder in my calendar for November 1, 2026 to check whether we still have bugs
7
13
1
158
8,823
"Your industrial IoT gateway isn't exposed to the internet, right? RIGHT?!" Our Canaries caught exploitation of CVE-2026-58115, a max-severity missing auth bug in Node-RED, which is commonly used in ICS and OT environments. On-point lede from @ElReg: theregister.com/security/202…
1
1
7
558
Neither of these has been observed in the wild yet, but we expect it's only a matter of time. There are tens of thousands of instances of each of these products exposed to the public internet, and both have been targeted before.
Jacob Baines (@Junior_Baines) profile pictureJacob Baines@Junior_BainesNov 2
Initial Access Community Monday release! Two new exploits: CVE-2026-92122, a Jenkins Groovy sandbox escape, and CVE-2026-8857, a MediaWiki command injection. Both include Docker labs, PCAPs, detection rules, and ASM queries. github.com/vulncheck-oss/ini…
GitHub - vulncheck-oss/initial-access-community: Initial Access Exploits and Associated Artifacts

GitHub - vulncheck-oss/initial-access-community: Initial Access Exploits and Associated Artifacts

Initial Access Exploits and Associated Artifacts. Contribute to vulncheck-oss/initial-access-community development by creating an account on GitHub.

github.com
242
Caitlin Condon retweeted
Wes (@phishfinding) profile picture
Wes@phishfindingOct 29
Working in cybersecurity during Cybersecurity Awareness Month
Image from Wes (@phishfinding)
8
121
13
1,259
21,670
Caitlin Condon retweeted
klöss (@kloss_xyz) profile picture
klöss
@kloss_xyzOct 28
my AI agents after I give them full access and tell them to be careful
279
1,976
218
18,337
954,422
Caitlin Condon retweeted
VulnCheck (@VulnCheckAI) profile picture
VulnCheck@VulnCheckAIOct 27
AI is making vulnerabilities easier to find. Who’s going to fix them? VulnCheck’s Josh Bressers joined @CyberScoop’s Safe Mode podcast to discuss AI-generated reports, the pressure on open-source maintainers and the human work behind fixes. Listen: cyberscoop.com/radio/how-vul…
The messy middle of AI-powered bug disclosure

The messy middle of AI-powered bug disclosure

On this episode, Greg Otto talks with Josh Bressers, VulnCheck’s director of coordinated vulnerability disclosure about the growing flood of AI-generated security reports.

cyberscoop.com
1
1
156
Caitlin Condon retweeted
VulnCheck (@VulnCheckAI) profile picture
VulnCheck@VulnCheckAIOct 29
VulnCheck Initial Access Intelligence has surpassed 1,000 exploits. To mark the milestone, we’re opening Initial Access Community with 40 free exploits, detection rules and testing artifacts. New additions every Monday. Learn more: vulncheck.com/blog/initial-a…
Image from VulnCheck (@VulnCheckAI)
2
4
214
Caitlin Condon retweeted
Mehmet INCE (@mdisec) profile picture
Mehmet INCE
@mdisecOct 29
again vulncheck setting the bar up in the sky!! this is something I believe the industry needed for a long time. that is shouldn't be lost in the timeline 🔥🔥🔥
Caitlin Condon (@catc0n) profile pictureCaitlin Condon@catc0nOct 29
Announcing Initial Access community edition: A free, open-source repo of @VulnCheckAI-authored initial access exploits, each of which comes with a PCAP, target Docker container, and Snort/Suricata rules. New additions every Monday, contributions welcome: vulncheck.com/blog/initial-a…
VulnCheck Opens Initial Access Community Edition to the Public | Blog | VulnCheck

VulnCheck Opens Initial Access Community Edition to the Public | Blog | VulnCheck

VulnCheck releases free, open community edition of initial access exploits and detections.

vulncheck.com
1
6
1,533
Caitlin Condon retweeted
Jacob Baines (@Junior_Baines) profile picture
Jacob Baines@Junior_BainesOct 29
One thing we do well at @VulnCheckAI is develop exploits and associated detections. We’ve wanted to share more of this work with the security community for a long time, and we’re finally making it happen. New exploits every Monday. Pull requests welcome! github.com/vulncheck-oss/ini…
GitHub - vulncheck-oss/initial-access-community: Initial Access Exploits and Associated Artifacts

GitHub - vulncheck-oss/initial-access-community: Initial Access Exploits and Associated Artifacts

Initial Access Exploits and Associated Artifacts. Contribute to vulncheck-oss/initial-access-community development by creating an account on GitHub.

github.com
1
5
1
17
1,462
github.com/vulncheck-oss/ini…
GitHub - vulncheck-oss/initial-access-community: Initial Access Exploits and Associated Artifacts

GitHub - vulncheck-oss/initial-access-community: Initial Access Exploits and Associated Artifacts

Initial Access Exploits and Associated Artifacts. Contribute to vulncheck-oss/initial-access-community development by creating an account on GitHub.

github.com
2
2
213
If you’re headed to #BSidesNOVA this weekend, @Junior_Baines is talking about Chinese implants in the supply chain on 10/31! Jake computers real good, you won’t wanna miss it 🎉 bsidesnova-2026.sessionize.c…
Chinese Implants in the Supply Chain

Chinese Implants in the Supply Chain

Over the course of several months, VulnCheck researchers uncovered three separate implants embedded in firmware for routers manufactured by China-based ZBT and sold around the world under a variety...

bsidesnova-2026.sessionize.com
1
9
468
Caitlin Condon retweeted
Matt Zorich (@reprise_99) profile picture
Matt Zorich
@reprise_99Oct 25
Image from Matt Zorich (@reprise_99)
8
71
13
388
25,350
Caitlin Condon retweeted
Jacob Baines (@Junior_Baines) profile picture
Jacob Baines@Junior_BainesOct 26
I had a minute over the weekend to look at dropped binaries in Canary Intelligence. There were a bunch of neat ones, but I picked just one to write up. An attacker originating from Japan went after one of our canaries affected by CVE-2026-42589. vulncheck.com/blog/cache-me-…
Cache Me If You Can: Unpacking a Go Implant and Its Toolkit | Blog | VulnCheck

Cache Me If You Can: Unpacking a Go Implant and Its Toolkit | Blog | VulnCheck

An investigation into Gotenberg CVE-2026-42589 exploitation in VulnCheck Canary Intelligence led us to cache_base, a custom Go reverse shell, and a much larger multi-platform toolkit.

vulncheck.com
4
7
806
Load more