Divideyn (@0x94) header
Divideyn (@0x94) profile picture

Divideyn

@0x94

@Secunnix

Joined March 2009
  • Tweets1.1K
  • Following3K
  • Followers4.8K
167Media
Photo by Divideyn (@0x94)Photo by Divideyn (@0x94)Photo by Divideyn (@0x94)Photo by Divideyn (@0x94)Photo by Divideyn (@0x94)Photo by Divideyn (@0x94)Photo by Divideyn (@0x94)Photo by Divideyn (@0x94)Photo by Divideyn (@0x94)Photo by Divideyn (@0x94)
Pinned Tweet
Divideyn (@0x94) profile picture
Divideyn@0x94Feb 12
LinkedIn'de 0x94 adresini aldım. Research yazılarımı artık oradan paylaşarak devam edeceğim. linkedin.com/in/0x94
32
3,080
Divideyn retweeted
Secunnix (@secunnix) profile picture
Secunnix@secunnixOct 29
Gökyüzünden kişisel verilere uzanan zafiyetin anatomisi. Secunnix Ekibinden Aybora Ünveren ve @0x94 tarafından DJI Fly Uygulamasında keşfedilen zafiyetin detayları sizlerle. scnx.com/yazilar/bir-link-il…
Bir Link ile Drone Pilotunun Konum Bilgisi Nasıl Ele Geçirildi?

Bir Link ile Drone Pilotunun Konum Bilgisi Nasıl Ele Geçirildi?

Bu yazıda, DJI Fly uygulamasında tespit ettiğimiz bir deep link zafiyetini ve bunun drone pilotunun token, email, konum ve cihaz bilgilerinin…

scnx.com
2
2
204
Connect with ConnectX 2xGX10, fine-tune a good AI model, and enjoy @0x94 @c1k0x
Image from Safa Karakuş (@sfkarakus)
Image from Safa Karakuş (@sfkarakus)
2
16
2,082
siberci öğünü 🕶️ @0x94
Image from Muhammed Can KURUNÇ (@c1k0x)
1
7
424
We focused on Windows and discovered LPE... We spent a lot of time and sleepless nights. By reading multiple articles and constantly reviewing, we began to understand what was what, the joy of learning is something else entirely @0x94 @hisoglu_taha @secunnix
Image from Safa Karakuş (@sfkarakus)
2
11
140
9,323
Everyone benchmarks CTI models the same way: a multiple-choice exam. GPT-5.4 gets 82%. Gemini 3.5 Flash gets 81.6%. Impressive, right up until you remember that no analyst's actual job is answering four-option questions about ATT&CK. So we handed those same models a real threat report and asked which techniques were in it. GPT-5.4 fell to 46.5. Gemini to 28.2. The quiz was never the job. We built BeyondCTI-27B for the job. On that same extraction task it scores 62.3, nearly 16 points ahead of GPT-5.4 and more than double Gemini, at 27B, open weights. It already runs inside our own pipeline, reading forums and leak sites at 4am so an analyst doesn't have to. Apache 2.0, on Hugging Face. Run it on your own reports and tell us where it breaks. Full writeup below.
Image from BeyondMemory Intelligence. (@beyondmemory_io)
Image from BeyondMemory Intelligence. (@beyondmemory_io)
1
9
2
18
2,707
🛑 URGENT - A single anonymous HTTP request can run code on an unpatched #WordPress 6.9 or 7.0 site, even on a default install with zero plugins. The new wp2shell flaw sits in core and still has no CVE for scanners to match. Affected releases and mitigations 🠖 thehackernews.com/2026/07/ne…
Image from The Hacker News (@TheHackersNews)
22
205
28
685
409,006
‼️🚨 Critical remote code execution in libssh2, the SSH client library embedded in countless tools: CVE-2026-55200, rated CVSS 9.2 by VulnCheck. Every version up to and including 1.11.1 is affected. It's an out-of-bounds heap write in ssh2_transport_read(), which fails to bound-check the SSH packet_length field. A malicious or MITM'd SSH server can send oversized packets to corrupt memory and run code on the connecting client. No known exploitation yet and it's not in CISA's KEV. Fix: move to a build that includes commit 7acf3df (PR #2052), and inventory anything that links libssh2 for SSH, SCP, or SFTP.
Image from International Cyber Digest (@IntCyberDigest)
Image from International Cyber Digest (@IntCyberDigest)
27
306
33
1,565
253,384
Divideyn retweeted
V12 (@v12sec) profile picture
V12
@v12secJun 22
AnyPwn: AnyDesk preauth 0click RCE (heap buffer overflow) we will release PoC post disclosure and patch
29
234
9
1,602
158,632
Sorun "yetenek yok" değil; yeteneği ürüne ve sürdürülebilir Ar-Ge'ye çevirecek sermaye, kamu satın-alma kültürü ve kariyer yolu yok. Entegratör ekonomisi bilgiyi tüketiyor, biriktirmiyor ve en iyileri elinde tutamıyor.
3
17
971
Divideyn retweeted
Safa Karakuş (@sfkarakus) profile picture
Safa Karakuş@sfkarakusJun 6
Biz ona kısaca 'Pense' diyoruz, hem esnek hem de telemetri konusunda güvenli @secunnix katkılarıyla @0x94 sunar 🚀
Image from Safa Karakuş (@sfkarakus)
Image from Safa Karakuş (@sfkarakus)
1
4
1
18
2,266
Online JSON formatter'lara yapıştırılan verilerde neler neler çıktı 🤭
BeyondMemory Intelligence. (@beyondmemory_io) profile pictureBeyondMemory Intelligence.
@beyondmemory_ioJun 4
Well, well, well. The public JSON formatter sites your developers paste production data into have been quietly publishing every paste for about seven years. Naturally, we read all seven years of it. 200,000+ documents. Cloud keys, SSH keys, payment API keys, whole tax returns with SSNs, people's full identities, bank balances. Nobody hacked anything. People pasted it in to make it look tidy, as you do. Full writeup below. Yes, it's as bad as it sounds.
Image from BeyondMemory Intelligence. (@beyondmemory_io)
1
1
39
17,451
Yeni telerik rce ortalığı karıştıracak 🤭
1
23
4,585
Apache rce çok can yakacak 🤭
4
35
6,540
Cpanel exploit çok can yakacak 🤭
11
2
98
24,153
code.ffmpeg.org/FFmpeg/FFmpe…
stack-buffer-overflow in libavcodec/aac/aacdec_usac_mps212.c

stack-buffer-overflow in libavcodec/aac/aacdec_usac_mps212.c

# Summary of the bug A stack buffer overflow exists in `get_freq_strides()` called from `ff_aac_ec_data_dec()` in `libavcodec/aac/aacdec_usac_mps212.c`. When a crafted xHE-AAC/USAC stream sets...

code.ffmpeg.org
1
1
8
1,385
Divideyn retweeted
frostb1te (@frostb1ten) profile picture
frostb1te
@frostb1tenApr 28
Fun fact! Just like the notepad Ctrl+Click RCE, Windows, Linux, and Mac terminals all support something similar. printf "\x1b]8;;file:///C:/windows/system32/calc.exe\x07Click here\x1b]8;;\x1b\\\n" Ctrl-Clicking will open Calc with no warning and we're able to make it remote by outputing to /dev/pts/# Microsoft does not consider this a vulnerability
26
108
8
704
80,970
Apache httpd 2 gün önce yüksek seviyede timing attack zafiyetini giderdi. strcmp kullanmışlar. Karakter karakter Authentication bypass edilebilir. github.com/apache/httpd/comm…
Add ap_*_timingsafe() constant-time comparison functions: · apache/httpd@7f5de0a

Add ap_*_timingsafe() constant-time comparison functions: · apache/httpd@7f5de0a

* include/httpd.h: Declare ap_memeq_timingsafe(), ap_streq_timingsafe(), ap_strneq_timingsafe(). * server/util.c: Implement, wrapping apr_*_timingsafe() if APR >= 1.8, with a fallback t...

github.com
7
1,205
Divideyn retweeted
Safa Karakuş (@sfkarakus) profile picture
Safa Karakuş@sfkarakusApr 4
=== CVE-2024-27398 LPE (SMEP BYPASS) === [+] Pivot page at 0x81011000, ROP at 0x81011cf1 [*] HCI ready [*] Waiting 3s... [*] No luck [*] Batch 1 [*] Waiting 3s... [*] No luck [*] Batch 2 [*] Waiting 3s... [*] No luck [*] Batch 3 [*] /tmp/pwn: uid=0 gid=0 ROOTED
Image from Safa Karakuş (@sfkarakus)
Image from Safa Karakuş (@sfkarakus)
1
1
11
1,282
Divideyn retweeted
Safa Karakuş (@sfkarakus) profile picture
Safa Karakuş@sfkarakusApr 2
Sürekli gittiğimiz her yerde hadi bu işten vazgeçin diyoruz, bırakın bu meslekleri çünkü bunlar sürdürülebilir meslek değiller vs sonra @c1k0x inovatif bir ürün geliştirdi. Hem on-prem hem de cloud, sanırım kısa süre içerisinde popüler şekilde yaygınlaşacak çünkü ihtiyaç var.
Image from Safa Karakuş (@sfkarakus)
2
1
1
21
3,187
Divideyn retweeted
NOPcon (@NOPcon) profile picture
NOPcon@NOPconApr 1
NOPcon is back! Call for Papers is now open. After a long break, we’re opening the doors again to the community. If you have something cool to share, this is your stage. Submit your work: nopcon.tr/cfp.html #nopcon2026
32
9
69
23,102
Load more