Just a random guy, tweeting in front of the world. Sr. Application Security Engineer (API, Mobile, Web, Cloud, AI/ML) 💼. Creator (@vulnbank & xjwt.io)
…in your infra
- Tweets 34,227
- Following 3,795
- Followers 14,836
- Likes 49,538
Pinned Tweet
I built an intentionally vulnerable banking application for security engineers/interns, developers, & QA analysts to learn, practice secure code reviews, and test their application security knowledge in areas such as SQLi, XSS, CSRF, race conditions, API vulnerabilities, & more.
Where are the hackers/code reviewers? How many vulnerabilities can you spot in this code?
Apart from the hints, are there other places you can exploit?
Can you chain the vulnerabilities?
24
146
805
211,804
Isn’t this the same Mythos that the PHP guys used to audit their codebase, yet it failed to find the pre-auth RCE bug?
But when all the Mythos aura-farming marketing lamba started a few months ago, we all thought the world was going to end.
These US frontier labs would say anything to get their politicians to restrict access to competing models, both for their own citizens and the rest of the world, so they can have the entire market to themselves.
Thanks to the Chinese labs for showing the world just how much these folks overestimate the importance of their models to justify their unreasonable token costs.
This is literally one of the first things you learn to do in steganography. Y’all should stop with this unnecessary fearmongering about Anthropic’s models.
4
4
34
1,948
This is literally one of the first things you learn to do in steganography. Y’all should stop with this unnecessary fearmongering about Anthropic’s models.
9
10
88
4,786
Ghost St Badmus retweeted
Interesting read…
@commando_skiipz what do you think?
‼️ A single HTTP/3 connection can crash vulnerable web servers. No login required.
Newly disclosed QPACK flaws trigger up to 4,000× memory amplification in tests, exhausting server resources.
→ PoC is public
→ 7 implementations affected
→ Still unpatched: Bun, aioquic, h3
Full details ↓ thehackernews.com/2026/10/ne…
1
5
12
555
This is mental!
If you haven’t updated your PHP apps yet, it might already be too late at this point. Maybe you should just wait for the ransom email from an attacker.
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.
6
9
88
10,813
This is embarrassing mannn
In the age of AI, it’s pretty common that multiple teams find similar vulns in parallel. We have another major vuln coming 🤞🤞 that has also has several teams reporting it in parallel..
It’s been an amazing collaborative effort to work on the patch and mitigations.
11
1,126
> On July 30th, the guys at Calif started auditing PHP.
> By August 11th, a researcher at Calif had discovered a way to exploit a vulnerability that could lead to pre-auth RCE and reported it to the PHP team.
> OpenAI reported the same vulnerability to the PHP team on the same day as the Calif researcher. (Was this a coincidence, or did something fishy happen? How did OpenAI discover it?)
> Then, on August 24th, the guys at Wiz reported the same vulnerability. (But all of a sudden, Wiz is posturing as though they discovered the RCE first & went into full-blown marketing mode with their SOTA AI, lmao.)
It’s a shame what the industry has become. Anyway, inform your governments to patch their websites.
They chose today of all days to post this marketing slop, even when Wiz themselves couldn’t dare mention that it was Argon who helped them uncover the PHP vulnerability someone else already found with a different model before they did. Nah man!
7
14
85
10,760
They chose today of all days to post this marketing slop, even when Wiz themselves couldn’t dare mention that it was Argon who helped them uncover the PHP vulnerability someone else already found with a different model before they did. Nah man!
Researchers at @wiz_io put Gemini 4 Argon to the test against complex cyber threats.
In real-world testing, it found more than two times more vulnerabilities than baseline models — catching a critical risk that previous frontier models missed.
See how they did it ↓
4
2
34
13,861
Why is Wiz taking most of the credits???
lmaoooo smh
Let’s set the record straight: @lcfr_hax was the first to discover php2shell and develop a working exploit. See his August 5 tweet: nitter.siddz.com/lcfr_hax/status/208503…
His work convinced the PHP Foundation to invest in fixing this entire bug class. He then worked around the clock to review, test, and retest the patches.
3
16
3,527