AI offensive security at @RunSybil (prev. @BishopFox). security research. ccdc red team. tummy ache survivor.
Virginia, USA
- Tweets 6,293
- Following 1,498
- Followers 10,391
- Likes 47,488
Let’s set the record straight: @lcfr_hax was the first to discover php2shell and develop a working exploit. See his August 5 tweet: nitter.siddz.com/lcfr_hax/status/208503…
His work convinced the PHP Foundation to invest in fixing this entire bug class. He then worked around the clock to review, test, and retest the patches.
21
119
979
65,255
d935be023a55b04681eccd1d2b8385b4b295e141a5df108e5e979d8d5d7124ac (posted in august)
(related)
8da579ec498d57c20977c8d186d7f6cd4c04f46ffa1b436dd646ec19b99bdf47
cb4c8532c245ff7e05d6e270fca5742bb3271f541ef80f0071ca3d4307eb2b53
957f8cc21b18483f80a9d723aa4f9ded26e456424ffd065a044d1ed9d58a4fbc
4f93976ef105f0d9ff2d60f35d48958c8bba9d9eb2873cd93b3f7105fa4716a6
Despite all the doom and gloom from InfoSec we are how many months are into people throwing endless tokens at various OSS projects? Hows Apache? Nginx? OpenSSH doing? Any public point and shoot RCEs in RDP/SMB in Windows? All of the above technology getting wrecked in the wild?
17
6
80
23,597
sshell retweeted
For the next few days or weeks, anyone now has a root CA thanks to eMudhra. Time to have some fun with MiTMing unwilling devices!
45
206
2,591
394,034
sshell retweeted
I spoke to @josephmenn this week about AI worms and wanted to add more color to my thoughts. What makes an AI worm different is that a model is capable of learning on the fly. This type of threat isn't here yet, but this is an example of an increasing shift that defenders are feeling.
We keep hearing the same theme from @runsybil customers: finding vulns is only the start. Teams need to patch and understand their attack surface in real time. Our job is to find and fix what's exploitable faster than attackers. Onward 🚀
Full article here: theguardian.com/technology/2…
3
6
1,058
sshell retweeted
Runescape Bench talk now up on youtube!
Covers results from the benchmark, design of the harness, and economic swarm experiments I've been doing.
piped.video/watch?v=cNm4zyUt…
Thanks @recursecenter
26
34
265
31,127
sshell retweeted
1/ I trained an AI to be top 1% in the world at Super Smash Bros. Melee by watching 80k hours of human replay.
Meet HAL.
148
120
1,858
369,605
sshell retweeted
This keeps happening and will continue to get worse. A couple months ago I found an insane vuln in a vibecoded IoT web frontend and took over their entire cloud env, device fleet, and could spy on the vendor in their own office. They never once noticed keys in their source code.
❗️ The CEO of a South African coffee chain vibe-coded an internal dashboard for all of his 132 stores, only it had one big flaw: all of the sensitive internal data was stored in the source code of the login screen.
The dashboard URL was discovered through employees posting photos of their laptop screens on Instagram.
The CEO said he had discovered Claude and was "almost certain" that software itself will soon "become free," they said.
3
25
222
8,243
sshell retweeted
i didnt get it until i read the github description. oh my god ultrabanger. must read
(cheng. never. misses.)
My dear friends, I’d like to show you my latest toy project
Introducing Handwired: turn your regular JavaScript code into a neural net!
- no training
- exact outputs vs the JS program
- fully differentiable
All runnable in a browser, without GPU
49
101
3,013
183,379
sshell retweeted
🫡 i am dreadnode researchers and so can you, go to scopebench.ai/ today
In her latest piece for @axios, @samsabin923 reports on security agent scope adherence and efforts to keep them under control.
Timely topic following our release of #ScopeBench last week at @OffensiveAIcon, which is referenced in the article alongside @SpecterOps' research. Check it out! axios.com/2026/10/13/rogue-a…
2
9
875
Gemini 4 Argon has arrived! The era of super intelligence in cyber security has begun, excited to share more on how we use it to secure the world - and we are just getting started 🌎
piped.video/ftkic7Tdpcg?si=3QxA…
deepmind.google/blog/introdu…
15
17
196
18,305
sshell retweeted
I built a game and I can't stop playing it, I just traded for the HackerOne card
Every wikipedia article is a card and we're up to 600+ players so far
Come try it! ❤️
kosmora.io/s/1hn3Ih4Rpk3j2YN…
4
6
29
7,093
Inputs: 124M lines audited. $124.
Outputs: 957k rows per Top 25 CWE class.
Resolved licenses left 13.9M rows permissive. Fine tuned 350M encoder.
54.8k tokens per second on local GPU. 1 repo. 40 findings. 15 true positive. 25 false positive. 4.8s.
Blog soon.
My "Audit every line of the Top 1000 Github repos in less than 30 days for $100" project is nearing completion.
I'm currently 7 seconds over and I'm mad as hell about that.
3
3
23
1,427
sshell retweeted
it’s an insane time to be building in security
we closed out Q3 at @runsybil last week as our strongest quarter yet. 10x revenue growth over Q2
I’m really proud of the team we’ve built to meet this moment
13
4
120
8,227
sshell retweeted
Have you ever felt like a model isn't actually trying to do what you asked? Did you just ask it wrong, or is there something else at play here? In "The model isn't cooperating", I take a little look. Link below 👇
10
36
233
17,746
sshell retweeted
Thank you to @UnpromptedAU & @BSidesCbr for inviting me to speak. Being back down under was lovely! You can find the slides for my n-day automated pipeline talk here. I’m at OAIC this week if you want to chat about exploit dev in 2026 and beyond. beautiful.ai/player/-P2q0r-B…
12
89
336
19,967