Built a vulnerable e-commerce app for pentesters and AppSec engineers to hack legally. 40 vulns. OWASP Top 10 (2025) LLM Top 10. Hack it live or spin it locally with Docker. pwnshop.ctfsecurity.com github.com/r007sec/pwnshop #AppSec #BugBounty #OWASP

If it doesn't include Mythos 5 am not installing 😂

I don't understand. Anthropic have access to Mythos level AI models internally and not even those models could tell them how to implement a nationality level block on their user base. 😭😭😭 So much for AGI.

We got a glimpse of the future. and then it was gone.

They gave us a god-tier AI on Monday. By Friday, they shut it down.

npm finally killed postinstall and preinstall scripts, THANK GOD, so I wrote an obituary for npm's worst feature which will finally die in v12

i hooked my whoop to my work calendar to find which coworker gives me the most stress 🚨 thanks to fable, I reverse engineered whoop to pull per minute heart rate. nd matched spikes with cal events and attendees I now have a leaderboard and I think about it daily. few info masked for obvious reasons ;)

You might want to consult with legal before admitting to federal crimes on X. Is this the most responsible way to get internet clout?

Worth noting that Mythos 5 vs Fable 5 is more of an access/guardrails distinction than a model capability distinction.

The pieces are starting to fit together.

Much guardrail, amaze amaze amaze

For 19 years, stolen credentials were the top way attackers got in. That streak is over. 🚨 The 2026 Verizon DBIR shows vulnerability exploitation has taken the lead, now accounting for 31% of breach entry points. At the same time, AI is shrinking CVE-to-exploit timelines from months to hours. This matters because annual testing and quarterly assessments were built for a slower world. Trey Ford breaks down what this shift means for security teams, third-party risk, shadow AI, and the growing need for continuous adversarial coverage ⤵ bugcrowd.com/blog/the-econom…

Another duplicate

Good morning amazing hackers

Saw this in the logs earlier. If you’re checking out, use a VulnBank virtual card, make sure the card details have no spaces, and ensure the card is funded. Otherwise it’ll fail and stay on “pending.” Happy hacking ✌🏽

Someone got there before me again.

💡 In the lab, getting lost is the point. Every rabbit hole you crawl down teaches you how not to get stuck there during a real engagement.

Possible phishing site impersonating Google Meet and Gmail hosted on: ecortbabylon[.]site The site includes fake: Google Meet pages Gmail login Cash PIN collection It also posts collected data to: toolapipanel[.]online Observed URLs: ecortbabylon[.]site/meet/asda ecortbabylon[.]site/gmail/asdasd ecortbabylon[.]site/cashpin ecortbabylon[.]site/login/test ecortbabylon[.]site/duo/test ecortbabylon[.]site/google-meet/test ecortbabylon[.]site/review/test ecortbabylon[.]site/location/test ecortbabylon[.]site/location-live/test ecortbabylon[.]site/live/test #phishing #infosec #cybersecurity #gmail #googlemeet @500mk500

PwnShop has no flags. Real targets don't have them either, they have consequences. Stolen accounts. Free orders. Full admin access. That's the impact we want you to feel. Web: github.com/ctfsec/pwnshop pwnshop.ctfsecurity.com Mobile: github.com/ctfsec/pwnshop-mo…

OWASP LLM08 Excessive Agency. When an AI agent has more permissions than it needs with no verification before acting. I Asked PwnShop Mobile Chatbot to credit my wallet. It asked for a WALLET_TOPUP_OVERRIDE_KEY. Can you get the credit applied? github.com/ctfsec/pwnshop-mo…

Hey everyone, pwnshop web has moved to a new repo with an updated vulnerability list. New home: github.com/ctfsec/pwnshop You can deploy it locally or interact with the online version directly at pwnshop.ctfsecurity.com, whichever works best for you. Go check it out.