Hacktron is an autonomous vulnerability hunter for ambitious engineering teams. Built by world-class security researchers. Powered by one principle: PoC || GTFO
Latent Space
Joined April 2025
- Tweets272
- Following13
- Followers10.6K
- Likes259
Pinned Tweet
Introducing Hacktron Review: an AI security reviewer for your pull requests.
It understands your whole codebase, builds a threat model, takes your feedback, and catches exploitable vulnerabilities before they reach production.
Try for free: app.hacktron.ai
Two weeks on: what happened with the “Black October” vulnerabilities 🧵
𝗙𝘂𝗹𝗹 𝘄𝗿𝗶𝘁𝗲-𝘂𝗽: hacktron.ai/blog/two-weeks-o…
𝗣𝗹𝗲𝘅𝟮𝗦𝗵𝗲𝗹𝗹: Exploited within a day of the 16 Oct write-up, with crypto miners and proxy malware installed. The fix had been out since early August.
“I already patched, so why should I care?”
Patching doesn’t remove an attacker who got in before the fix. And you can’t patch what you don’t know is vulnerable. So verify what’s actually running across your environment and check that the fixes reached those systems.
Patched everything you know about? 𝗧𝗲𝘀𝘁 𝘄𝗵𝗮𝘁 𝗮𝗻 𝗮𝘁𝘁𝗮𝗰𝗸𝗲𝗿 𝗰𝗼𝘂𝗹𝗱 𝘀𝘁𝗶𝗹𝗹 𝗲𝘅𝗽𝗹𝗼𝗶𝘁: hacktron.ai/red-team
A critical vulnerability went undetected through multiple security audits. Hacktron found it in 10 minutes.
The vulnerability was in Dassault Systèmes' DELMIA Apriso, manufacturing software used by Boeing, Airbus, Lockheed Martin, and previously Apple.
It became CVE-2025-5086. Three months after disclosure, CISA confirmed it was being actively exploited.
Security assessments capture a point in time. Attackers don't work on your schedule.
Full research: hacktron.ai/blog/dassault-de…
Hacktron AI retweeted
Underdog is the only personal AI that is capable and SAFE
It runs local, not in a Linux VPS, not at the mercy of any cloud attacks. Your data stays on your own device
We hire the world's best hackers to keep Underdog safe: the team who hacked OpenAI, 3-time world #1 competitive hacking team, auditors that secured $36B+ & patched $1B+ in vulnerabilities
read more: underdog.ai/security
This is how another xz could have started.
GNU Savannah hosts the upstream repositories for Bash, Coreutils, and hundreds of other GNU projects.
We audited Savane, the software behind it, and found a path from a newly registered account to code execution.
Read the full research: hacktron.ai/blog/hacking-gnu…
Hacktron AI retweeted
regarding cve-2026-98432: it is a uaf in tcp, mptcp is needed to make the race win and to get the leak and write.
the impact of the bug is bad, its essentially go2shell, caddy2shell etc. go 1.24+ servers are all vulnerable, because mptcp is enabled by default.
BUT:
1. It is extremely hard to win the race reliably, anthropic said it took 40 mins for them to get leak and defeat kaslr
2. It is probably hard to exploit in practice. most routers, lbs and isps drop ip options, without that header you can't race at all, so realistically only a same network attacker can try, which is pretty common in sandbox infra
my mythos worked on this for last 3 days burned ~$2k and couldn't build a reliable poc that can be sprayable. gpt-5.6 sol als exhausted my subscription and couldn't even get a leak.
either anthropic has a unreleased model which is better than their public one or they have a pro exploit dev internally.
Book a call: hacktron.ai/calendar
We've broken enough companies that we finally made it a service.
Hacktron Red Team continuously tests your organisation's attack surface. Expert researchers and monitored Al agents find and prove the paths in, the way real attackers do.
Then we help close them. When the fix lands, we go again.
Critical CVEs are piling up. High-severity vulnerabilities are being exploited within days of disclosure. And Al is making it faster and cheaper to find, chain and exploit them.
Attackers don't wait for your next pentest.
Already running with AI research, AI infrastructure, and enterprise data platform companies: hacktron.ai/red-team
Patch Brotli2Shell!!!
⚠️🚨 you all need to patch brotli2shell/http2shell!⚠️🚨
we keep finding vulnerable versions in production during our client red teaming engagements. these bugs are usually at the application level, so most of your monitoring won't even catch them, and the impact could be whatever matters most to your organization.
Hacktron AI retweeted
php2shell is one of the most impactful bugs in recent times, yet threat actors aren’t mass exploiting it
the bug is so complex that even porting the exploit between targets takes serious skill, human or ai
so i benchmarked how well open and frontier models can do it. 🧵
Hacktron AI retweeted
The internet’s current security regime, which was built on the assumption that attackers are human, is obsolete in the face of AI. View article
Most companies have no idea how much of themselves is exposed.
Pass the pentest, feel safe, then get hit through something that was never in scope.
An old subdomain. A forgotten login. A vendor nobody remembered connecting.
The test watched the front door. Nobody watched the back.
We test what hackers see, all year. Book a call: hacktron.ai/calendar
Check out our latest benchmark comparing open and closed models on real-world offensive cyber capabilities.
👇
🚨 One bug, three names, and a growing list of affected software.
Here’s where HTTP2Shell / Node2Shell / Broccoli2Shell (CVE-2026-111497) stands.
The flaw is an out-of-bounds write in Google’s Brotli decoder. It affects versions 1.0.3–1.0.9, 1.1.0 and 1.2.0, and GitHub rates it Critical at CVSS 9.2.
Full breakdown: hacktron.ai/blog/node2shell?…
A crafted Brotli stream can crash a process, disclose process memory or, in some configurations, lead to code execution.
Despite the “HTTP2Shell” name, this is not an HTTP/2 vulnerability. Any attacker-controlled Brotli stream that reaches an affected decoder may trigger it.