Principal Security Consultant @FORTBRIDGE
London, England
Joined February 2010
- Tweets3.3K
- Following744
- Followers645
- Likes56.7K
Pinned Tweet
Achievement Unlocked: Spoke at @Microsoft 's @BlueHatIL 🏆💻
(And yes, it was epic.)
BHIL '25 is a wrap, and it was a privilege to be on that stage and connect with so many brilliant minds. I had an absolute blast.
Huge shoutout to the incredible Day 2 speaker lineup—every talk was insightful, creative, and inspiring:
@BLanyado , @DrorOphir , @yarden_shafir , @AradCohen, Omer Nevo, @NetanelBenSimon , @BlauMeir , @avi_lum , @GalElbaz1 , @cglyer , Efim Hudis, @sh0oki , @SecurityBaby , Edan Zwick, Yohan Guez, @sapirxfed , Dor Amit, Shaked Ilan — I learned so much from each of you.
Big thanks to @Microsoft and the amazing BlueHat IL organizing team — @shirleyhermann , @IdaVass1 , @AsherVered10 , and everyone else who made this event happen — thank you!
And last but not least, a special thank you to the CFP board legends. I’ll name just a few that I had the pleasure of meeting face-to-face:
@gentilkiwi , @ace__pace , @dwizzzleMSFT , @ItaiGrady , @TalBeerySec , @j0nathanj — you guys rock.
Also, great to finally meet @LiveOverflow and @ghidraninja in person — super chill guys.
Grateful to have been part of something this special. Until next time!
#bluehatil #CyberSecurity #Microsoft
Lord Steak retweeted
WordPress 的“有人引用了你的文章”，被串成了免登录执行服务器命令的入口！
这条链借的是 Pingback 回链通知：攻击者告诉网站“我的网页引用了你”，WordPress 就会主动去抓取那个页面，核实链接是否存在。
坑就藏在抓回来的响应里。对方返回精心构造的 Brotli 压缩数据，底层 libcurl 在解压时触发内存破坏，最后把处理普通响应的流程带到了命令执行。
新公开的复现在 WordPress 7.1.3、PHP 8.3.36 和受影响的 Brotli 解码库组合上跑通，返回了 www-data 身份的命令输出。入口需要开放 Pingback，并能访问攻击者提供的网址。
这次真正要补的是底层 Brotli 库：换成发行商修复过的包或容器镜像，再重启加载旧库的进程。只更新 WordPress，补不到这里。
fortbridge.co.uk/research/cv…
Lord Steak retweeted
Project Zero (and by that I mean @j00ru) already found and reported the Brotli vulnerability (aka CVE-2026-111497) to the actual upstream on September 23.
Brotli: heap out-of-bounds read and write in the decoder's internal input buffer (DecodeBlockTypeAndLength) project-zero.issues.chromium…
Lord Steak retweeted
Fuzzers vs. AI: Comparing Fuzzilli and BigSleep on JavaScript Engines projectzero.google/2026/10/f…
Lord Steak retweeted
I've been nominated for the SANS Difference Makers Awards, in the Red Teamer category! I'd love your vote: feedback.sans.org/733559
If I win*, I'll share something that genuinely surprised me involving a website, a vulnerability, and GLM 5.3 #SANSDMA #DifferenceMakers
*I'll also share it if I lose
Lord Steak retweeted
that's why we launched the $100k Save CTFs fund. CTFs need to quickly adapt to AI, or else they'll disappear. I heard ECSC did a good job this year.
@_mixy1 wrote a great blog osec.io/blog/save-ctfs-fund/
Lord Steak retweeted
WordPress pingback and Brotli RCE fortbridge.co.uk/research/cv…
Lord Steak retweeted
Brotli RCE via WordPress pingback: published PoC reproduced in a lab. Not a WordPress Core flaw.
fortbridge.co.uk/research/cv…
Lord Steak retweeted
My goat, Sir Patrick Stewart, time for the last great adventure. Five-card stud, nothing wild.. and the sky's the limit 🥃
Lord Steak retweeted
Confirmed, and yeah this seems like a horrible idea
haha, so apparently OpenAI are about to start training on your Daybreak Blue sessions, with no way to opt out.
Literally stealing people's private work, as they do it, is cartoonishly evil.
It also will presumably kill Daybreak usage by security researchers. Or at least, it should. The thing OAI have had to swear they are not doing to math researchers, they are now explicitly about to start doing to security researchers.
Yet another reminder of the importance of open models.
Lord Steak retweeted
Anthropic trains on every request that hits a classifier.
OpenAI will start training on all cyber requests.
Kimi K3.1 Pro removes cyber from their mid/post training.
DeepSeek has a supposed cyber endpoint hidden behind KYC (unverified)
We must hold the line and train strong open source cyber.
Lord Steak retweeted
Huge announcement by OpenAI on Daybreak Blue (TAC): Starting November 29th, OpenAI will force train its models on all personal account AI sessions enrolled in Daybreak Blue, even when model training is disabled! Keep that in mind when feeding the model private reports or research.
I grew up watching this series :(
Legendary ‘X-Men’ and ‘Star Trek’ Actor Patrick Stewart Has Died, farewell captain. gizmodo.com/patrick-stewart-…
Lord Steak retweeted
I learned that infosec companies are buying reviews to push their mediocre courses and fool my audience, so I'm launching a promotion campaign for my own Zero Day Engineering training system to raise visibility and remind how it differs:
- My training programs are 100% original content produced by my own first-hand VR work at the frontiers;
- My attendees include prominent security researchers and I heard them getting $250K bounties with the frameworks that I teach more than once;
- I'm seeing insanely high ratios of repeat and bundle purchases of my high ticket courses; clearly, people are getting the value;
- My company website has a wall of grateful reviews from past attendees, published across all the social platforms;
- I am an active exploit engineer specialized in hardened systems, and happy to share my expertise with paying clients;
- I built a unique universal methodology in 23 years of reverse engineering professionally that works across systems, classes and objectives;
- My methodology proved useful to keep finding bugs in the most difficult systems for well over a decade;
- I don't buy reviews, ads, or distribution - I trust that genuine value will speak for itself;
- I don't build alliances or leverage capital to "beat" other creators - I believe in infinite-sum games, and that every offer has its place on the market;
- I don't force sales or marketing - I let my audience discover my work and make their purchase decisions on their own timelines;
- I run my business solo and take offense personally.
Details of the promo in the comment below
Lord Steak retweeted
Many of the CVEs you see coming out these days are actually not very weaponizable against real production systems, for one reason or another
Example: Anthropic’s recently reported Linux network RCE, which takes almost an hour to run, causes a kernel panic on any system that has even the default level Linux Firewall, in our testing
Often, the reason why you have even of these these bugs is because firms put them in the throwaway conference-talk category
Important to keep this in mind
Lord Steak retweeted
I do feel ownership of what I instruct the AI to do. So it just feels like using a tool like a fuzzer and find stuff.
And it’s actually easier to share stuff, because I can just say “AI did that”. If it’s bad what I share, I can offload this responsibility to AI 🙃
