I asked AI to secure OSS analytics software and it found an RCE. The story of CVE-2025-59304: I tested our Security AI agents on Swetrix, a modern, lightweight, open-source, cookie-free, quick setup, and generally pretty cool web-analytics project. The platform (and their cloud

Me using @conductor_build

🥳🥳🥳

1 away from 3,000!

found & fixed a bug in esbuild which is downloaded 70 Million times a week on npm! using escapeForHTML() caused quotes to be unescaped, which could be exploited for XSS (poc in PR). The fix is using the escapeForAttribute() function instead. credit to @depthfirstlabs this is

os: we have KASLR also os: static addresses in kernel space this reminds me when win7 launched kaslr with a rwx page at 0xffdf0000

open source maintainers love @depthfirstlabs and the RCEs we find & fix for them

Captured last night- probably the coolest comet shot I've ever gotten. I've never seen such a dynamic tail on a come. Incredible active, and moving quickly, which makes photographing it a challenge. See how it moves in the reply.

🚨my AI coworker found a zero-day in Netty yes, that Netty used by Meta, Apple, Google and half the internet. the bug lets attackers send fake emails that look perfectly legit. the exploit fully bypasses email defenses. here’s the story 🧵[1/6]

Honestly I'm so proud of @depthfirstlabs finding zero-days in critical open source like Netty. This is not a random Github project, it's a core libraries used by companies like Apple, Netflix, Twitter, etc

If you use Netty, patch. If you care about security, read my linked blog post If you enjoy chaos, imagine AI finding the next zero-day in your codebase https://t.co/FzMrJ58zwM [6/6]

yes, AI found a zero-day in a critical internet library; and it fixed it too. It literally wrote the patch that was merged. The future of cyber security is already here. [5/6]

Email security defenses: SPF: ✓ passed DKIM: ✓passed DMARC: ✓ passed Reality: hacked Your email defenses just broke from `\r\n` [4/6]

By injecting extra email commands via Netty. Tl;dr: Email is sent over SMTP, where `\r\n` separate email commands. The bug in Netty lets an attacker stuff in extra `\r\n` to add commands and hijack the email!

Quick refresher: the email bodyguards are SPF, DKIM, and DMARC security checks. They stop fake emails pretending to be ceo@company.com This bug passes these defenses nonchalantly whistling. How? I worried you’d never ask! [2/6]

🚨my AI coworker found a zero-day in Netty yes, that Netty used by Meta, Apple, Google and half the internet. the bug lets attackers send fake emails that look perfectly legit. the exploit fully bypasses email defenses. here’s the story 🧵[1/6]

SF publicly discriminates against cool people

pwndbg makes hacking look the way I imagined it as a kid 💚

To filter out LLM slop reports ezpz