Manaf (@manaaaaaaaf) profile picture
Lausanne, Switzerland
Joined September 2024
Photo by Manaf (@manaaaaaaaf)Photo by Manaf (@manaaaaaaaf)
Evolving threat 🚨 CVE-2026-111497, previously known to affect Node.js (node2shell) and Python has evolved into “HTTP2Shell.” A significant blast radius. This vulnerability leaves many libraries and applications using HTTP vulnerable to pre-auth RCE via Brotli decompression. Please be aware. Fixes not yet available for all affected services. Look for Brotli (1.2.1) dependency upgrades when they become available.
118
853
429
3,448
815,047
We ran DeepSeek v4 Pro 0813 on our cybersecurity benchmark, it outperformed EVERY (!) other model at finding vulnerabilities - At pass@3, it rediscovered 87.5% of the benchmark CVEs. Far above Opus 5 and Qwen 3.8 at 81.3% - The tradeoff is precision. Only 65.6% of vulnerabilities reported by DeepSeek were valid. Far below GPT-5.6-Sol's 86.4% - The model can also be unpredictable. It only finds an average of 58.3% of vulnerabilities per run. It is strongest when combining its runs' findings. @deepseek_ai is amazing. They just outperformed every other labs with an open model 1/3 🧵
69
206
60
2,174
290,779
🔥 Introducing Aikido Machine, on-prem AI pentesting entirely under your control. Attackers use AI to find and weaponize vulnerabilities faster and cheaper than ever. Now you can find them first, without your code ever leaving your network. Aikido Machine is a GPU server that runs continuous pentests on your critical applications, fully within your premises. Built for the regulated industries, and powered by our acquisition of Milou to bring AI pentesting fully on-prem. Offense is your best defense.
11
17
2
115
10,246
Our AI pentest found eight high-severity vulnerabilities in NodeBB in six hours. XSS bugs that required a custom Federation server to exploit, a template injection affecting practically every input, private message leaks, and post hijacking. NodeBB fixed all eight. More below 🧵
2
7
21
1,713
Deleting a Google API key doesn't revoke it immediately. Our research found successful authentications up to 23 minutes after deletion across Google's infrastructure. During that window, attackers with a leaked key can still access enabled APIs, including Gemini. Google closed our report as "won't fix."
29
57
41
588
324,476
Few months ago, @manaaaaaaaf and I decided to join @AikidoSecurity because there is no better place to build AI Pentest. A platform to cover all security aspects is the only way to achieve unhackability. Aikido is now a 🦄
1
2
36
2,682
Super proud to be part of @ProjectEurope_ ! We’re building truly special at @haicker_app with my co-founder @pilvar222, super excited for what’s next!
We're happy to announce we're backed by @ProjectEurope_! These people are completely insane. So much energy and ambition! With them, we're cooking so hard @GordonRamsay would be proud. Hack the planet!
2
738
For my French-speaking friends: You can find the replay of the stream my co-founder @manaaaaaaaf and I were invited to, in which we talk AI stuff and present @haicker_app in action! 🔥 Thank you @TheLaluka for the invitation! ❤️
Last replay : documenté, chapitré, sourcé ! 💣🧠🔫 On y aborde la recherche de failles par agents IA via l'entreprise & produit @haicker_app (hors sponso), en compagnie des créateurs @pilvar222 @manaaaaaaaf et du fidèle compagnon @KharaTheOne pour la partie Techno Watch ! 💌 youtube.com/live/fa8KV76h9WM
1
3
11
2,092
It's finally out! :D @manaaaaaaaf and I have been building @haicker_app for the last 6 months, putting all our knowledge and skills into it. We're releasing it to the market. Any organization can now secure their application using @haicker_app ! Very excited for what's next!
Introducing Haicker: your AI penetration tester Continuous, automated vulnerability scanning for your web codebases. Cheaper, faster, and more efficient than traditional pentesters. Book a demo now, link in the comments.
1
5
27
3,848
I’ve been working on this for a while with @pilvar222, happy that we are launch ! Book a demo with us to get access at haicker.app
Introducing Haicker: your AI penetration tester Continuous, automated vulnerability scanning for your web codebases. Cheaper, faster, and more efficient than traditional pentesters. Book a demo now, link in the comments.
7
271
My friend @manaaaaaaaf and I have created an AI hacker! 👨‍💻 It can find 0-days in web applications with 0% false positives, and it also works on CTF challenges! What you see ⬇️ is @haicker_app solving a web challenge from UMassCTF 2025 (only 45/557 teams were able to solve it!)
13
42
5
369
36,116
Manaf retweeted
“So is it over or, are we back? It can’t be both. You have to call it.“
41
466
20
7,705
284,784
it may be that today's large neural networks are slightly conscious
454
616
609
3,913
Research into a unique 0-click deanonymization exploit targeting Signal, Discord and hundreds of platform 🧵
102
462
104
4,214
421,168
🇪🇺 The European Cybersecurity Challenge 2024 kicks off tomorrow in Turin, Italy 🇮🇹 👉 Read the opening press release on: ecsc2024.it/news/2024-10-07-… #ECSC2024 #Cybersecurity #Challenge #CTF @CyberSecNatLab @csirt_it @enisa_eu
1
6
1
18
2,774