Joined May 2016
- Tweets 8,068
- Following 228
- Followers 8,787
- Likes 86,500
1,060 Photos and videos
Pinned Tweet
6 Aug 2023
Want to become an ethical hacker? 🥷 Here's a list of my favourite [mostly practical] resources 📚
They are all free (or have a free option) and there's more high quality material here than anybody realistically has the time to complete ⏳
ALT Ethical hacking resources
28
328
1,267
130,565
CryptoCat retweeted
Literally the worst cable management I've ever seen in my life
96
344
4,362
93,861
CryptoCat retweeted
Jun 12
Happy Friday!
We're back with our analysis of Check Point's friendly CVE-2026-50751, an Authentication Bypass in their.. security-boundary-enforced-by-authentication SSL VPN products...
Enjoy!
labs.watchtowr.com/marking-y…
1
39
118
27,787
Jun 12
Here's the writeup for CVE-2026-53943, a cache poisoning -> XSS vuln I found in Ghost CMS 👻
cryptocat.me/blog/research/a…
4
26
933
Hacking Google with A.I. for $500,000
brutecat.com/r/hacking-googl…
59
499
2,452
319,956
CryptoCat retweeted
We find high/crits everytime we scan OSS, web applications are "easy" targets for LLMs by now.
This one is a simple account takeover leading to unauth RCE on latest version.
Went 10 years unnoticed.
Public prices for 0day brokers: $50k, costed us $800
aikido.dev/blog/phpbb-authen…
2
11
69
3,635
CryptoCat retweeted
Jun 9
Notably, those approved by the current Cyber Verification Program aren’t included in this group. Bummer, I have some cool experiments to test it 😔
For a small group of cyber defenders and critical infrastructure providers, we are also launching Claude Mythos 5.
Mythos 5 shares the same underlying model as Fable 5, but with the safeguards lifted in some areas.
10
14
192
24,920
Jun 9
Measuring LLMs impact on N-day exploits - @AnthropicAI
red.anthropic.com/2026/n-day…
ALT Measuring LLMs impact on N-day exploits
1
8
602
CryptoCat retweeted
In the latest Hacktics and Telemetry's Mitigation Minute, @_CryptoCat dives into his recent zero-day Gogs exploit and Metasploit module as he discusses what to do when there is no patch youtube.com/watch?v=EPioibHR…
1
2
10
3,103
Jun 6
An SQLi I found in Photo Gallery by 10Web was disclosed this week!
cryptocat.me/blog/research/a…
1
2
24
1,024
CryptoCat retweeted
Jun 4
We helped FFmpeg find and fix 21 security vulnerabilities.
In a 1.5M-line codebase, we spent just $1K in API costs. Some of these bugs had been hiding for decades.
We also developed a PoC demonstrating an RCE primitive when FFmpeg processes RTSP streams.
Full write-up: depthfirst.com/research/21-z…
5
67
373
338,363
CryptoCat retweeted
Not even Google is safe from RCEs, and we brought @brutecat on the pod to talk about his hacking journey on Google!
youtu.be/ZpEeWsqPy6g
1
12
95
10,217
CryptoCat retweeted
May 29
New @rapid7 observed exploitation of PAN-OS GlobalProtect auth bypass vulnerability CVE-2026-0257 which allows authentication bypass cookies to be forged for VPN access. Full details, technical analysis, PoC , IOCs and remediation guidance in the blog: rapid7.com/blog/post/etr-rap…
1
25
94
10,128
CryptoCat retweeted
May 29
4 RCE chains across 4 LiteLLM versions, each patched within days of working.
What started as #Pwn2Own Berlin prep turned into a race against the vendor’s commit log.
starlabs.sg/blog/2026/05-rac…
By @bestswngs & @bruce30262
1
26
132
15,165
May 29
Let's go! 🔥
4
362
CryptoCat retweeted
May 28
This is required reading today.
@caseyjohnellis didn't even write this today about MSRC - but it nails it.
Full disclosure IS the agreed upon path forward to keep a vendor in check who stonewalls, threatens, or otherwise is shit to work with for security researchers.
7
61
209
13,968
May 28
Found an unpatched RCE in Gogs 👀 Any authenticated user can get code execution on the server through argument injection into git rebase. Full @rapid7 writeup @metasploit module available now!
🔗rapid7.com/blog/post/ve-auth…
ALT RCE via argument injection in Gogs
1
32
171
15,366