Always on AI Security Engineer. Backed by @ycombinator and @solofounders
San Francisco, CA
- Tweets 84
- Following 2
- Followers 930
- Likes 296
‼️ Node.js has a Remote Code Execution vulnerability.
CVE-2026-111497 is a high-severity bug in its Brotli decoder. Decompressing attacker-controlled data can leak memory or lead to remote code execution.
You don’t need to use Brotli directly. Your app could hit this through fetch() or libraries like body-parser.
OpenHack supply chain tracks this, patch now!
1
4
700
OpenHack retweeted
⚠️ Node.js is vulnerable to remote code execution.
CVE-2026-111497 (high): A Node.js process that decompresses attacker-controlled Brotli data can be made to leak memory or run arbitrary code.
You’re exposed if your app or a library decompresses bad Brotli data (e.g. the built-in fetch(), body-parser)
Aikido detects this. Patches are available.
13
627
9,269
100,926
🚨 LiteLLM 1.107.0 was compromised today and shipped with a credential stealer and remote-code loader.
The malicious files were present in the distributed wheels but absent from the corresponding Git tag.
Full breakdown:
openhack.com/blog/litellm-1-…
1
1
3
917
‼️ Patches for the PHP Vulnerability are out ‼️
Go ahead and patch your servers ASAP.
Full article:
openhack.com/blog/php2shell-…
1
3
364
🚨 PHP is going to be dropping emergency security updates tomorrow (October 21st, 14:00 UTC).
- CVE-2026-109618 & CVE-2026-109619 are unauthenticated RCE vulnerabilities both with a score of CVSS 9.2
- The RCE appears to work on default installations of many services & frameworks such as WordPress, Magento, Laravel and more
- PHP versions >5.4.0 affected
- Discovered by team @calif_io
Kirill Firsov
4
68
612
80,284
OpenHack retweeted
Excited to join ⏚ @OpenHack (YC F26) as a Member of Technical Staff 🎉
An incredible time for AI Cybersecurity right now and glad to be a part of it!!
11
2
31
1,234
OpenHack retweeted
Great chatting with @arinwaichulis from @9to5mac on the Security Bite podcast about the new era of bug hunting, how companies like Apple are handling AI-generated security slop, and how @OpenHack helps separate real vulnerabilities from the noise!
9to5mac.com/2026/10/01/secur…
1
4
18
1,230
We’re thrilled to announce that OpenHack is now a part of @ycombinator Fall 2026! 🙌
Excited for some amazing product announcements very soon.
Excited to share that @OpenHack is now part of YC Fall 2026! 🚀
Feels pretty surreal to be writing this, after building, shipping, selling and figuring things out the hard way.
Despite all advancements in security tooling, organizations still struggle with false positives, knowing what to fix first, and AI-assisted attacks moving faster than ever.
That’s why we’re building an always-on AI security engineer. One that is the most context aware - knowing your business, developer intent and system architecture deeply. It can hunt, reason, prioritize and verify vulnerabilities based on true business impact like a real security engineer.
It’s a much harder problem to solve than it looks on the surface, and we’re just getting started.
Back to building. 🫡
1
4
13
3,463
