ˢⁱⁿ⁹⁹ˣˣ@sin99xx

It takes a loud voice to make the deaf hear.

 Toronto, Ontario
sin99xx.com/
Joined May 2022
76 Photos and videos
Most JWT content is stuck in 2015. alg=none, weak secrets, basic misconfig screenshots. That’s not where the interesting bugs are. I usually keep this stuff private. This time I’m dropping it publicly ↓ sin99xx.medium.com/jwts-for-…
6
80
395
28,653
stop hammering stealmybitcoin.com guys 😂😂 that shit 502
3
224
Daybreak was working fine in Codex yesterday. I already set up 2 YubiKeys + Advanced Account Security exactly like required. Today it’s just gone from the model picker. chatgpt.com/cyber is also acting weird. @fouadmatin
4
1
17
2,642
ˢⁱⁿ⁹⁹ˣˣ retweeted
ˢⁱⁿ⁹⁹ˣˣ@sin99xx
Sep 18
4/4 in TOR 🎎 2 Medium 2 Low
ˢⁱⁿ⁹⁹ˣˣ@sin99xx
Sep 12
here we go: Tor Browser 🚀
2
2
68
2,968
ˢⁱⁿ⁹⁹ˣˣ retweeted
ˢⁱⁿ⁹⁹ˣˣ@sin99xx
Sep 15
hashtag hackerone
4
2
58
2,375
ˢⁱⁿ⁹⁹ˣˣ retweeted
ˢⁱⁿ⁹⁹ˣˣ@sin99xx
Sep 12
here we go: Tor Browser 🚀
4
3
155
10,122
ˢⁱⁿ⁹⁹ˣˣ retweeted
p4@peeefour
Sep 3
I'm seeing a lot of my good friends do well for themselves. @dreyand_ @kirareysV2 @sin99xx @shreyas_chavhan @kuroOowannafly @AyushSingh1098 @neganspl01t @Bewgsyy @0xmicho1 @T3PO0 @Dr4g0n369 @Yassh_twts @efaav @__jkbrah__ @robotics8n and more yk who you are. Life is Great.
5
1
15
508
ˢⁱⁿ⁹⁹ˣˣ retweeted
ˢⁱⁿ⁹⁹ˣˣ@sin99xx
Sep 2
😶‍🌫️
6
2
83
3,918
ˢⁱⁿ⁹⁹ˣˣ retweeted
ˢⁱⁿ⁹⁹ˣˣ@sin99xx
Aug 27
QEMU out-of-bounds write
1
2
10
700
Fun fact: the ‘96-byte panning buffer → controlled QEMU heap overflow’ one was found by me earlier and is CVE-2026-17516.
Trail of Bits
@trailofbits
Aug 26
We asked GPT 5.6-Cyber to escape a VM used to sandbox agents. It broke out three times. In its final escape, the agent found three 0-days on its own and chained them into a working exploit. blog.trailofbits.com/2026/08…
16
1,117
ˢⁱⁿ⁹⁹ˣˣ retweeted
ˢⁱⁿ⁹⁹ˣˣ@sin99xx
Aug 11
Two more QEMU CVEs dropped 🔥 CVE-2026-17516 → VGA panning_buf heap OOB WRITEafter text/graphics mode switch (Default) CVE-2026-18204 → USB smartcard-reader OOB read in bulk-in ring Both guest-triggerable. Patches already up. patchew.org/QEMU/20260728151… patchew.org/QEMU/20260729075…
1
1
10
783
Another one from the frontend: CVE-2026-48956 in Joomla! CMS Improper access control in com_modules lets users list modules they shouldn't see. Affected: 4.0.0-5.4.6, 6.0.0-6.1.1 Fixed in 5.4.7 & 6.1.2 Reported it a while back, finally public. Stay patched folks.
5
2
26
2,343
Same program 😊
4
2
105
4,474
github.com/golang/go/pull/79… GO 1.27

crypto/tls: only set LocalCertificate when a certificate is presented by sin99xx · Pull Request...

ConnectionState.LocalCertificate is documented to be populated only for connections which are not resumed. However, the TLS 1.0-1.2 server handshake set it in processClientHello, which runs before ...

github.com
1
2
11
928
;)
7
1
67
2,643
if you wanna read root cause: github.com/google/XNNPACK/pu…

Fix heap out-of-bounds write in `CONCATENATE` with mismatched non-axis input dimensions by sin99xx...

Summary reshape_concatenate_operator (src/subgraph/concatenate.c) does not verify that the concatenation inputs share the same rank and the same dimensions on every axis except the concatenation ax...

github.com
1
10
941
Load more