Manaf retweeted
Evolving threat 🚨 CVE-2026-111497, previously known to affect Node.js (node2shell) and Python has evolved into “HTTP2Shell.”
A significant blast radius.
This vulnerability leaves many libraries and applications using HTTP vulnerable to pre-auth RCE via Brotli decompression.
Please be aware. Fixes not yet available for all affected services. Look for Brotli (1.2.1) dependency upgrades when they become available.
Manaf retweeted
We ran DeepSeek v4 Pro 0813 on our cybersecurity benchmark, it outperformed EVERY (!) other model at finding vulnerabilities
- At pass@3, it rediscovered 87.5% of the benchmark CVEs. Far above Opus 5 and Qwen 3.8 at 81.3%
- The tradeoff is precision. Only 65.6% of vulnerabilities reported by DeepSeek were valid. Far below GPT-5.6-Sol's 86.4%
- The model can also be unpredictable. It only finds an average of 58.3% of vulnerabilities per run. It is strongest when combining its runs' findings.
@deepseek_ai is amazing. They just outperformed every other labs with an open model
1/3 🧵
Manaf retweeted
🔥 Introducing Aikido Machine, on-prem AI pentesting entirely under your control.
Attackers use AI to find and weaponize vulnerabilities faster and cheaper than ever. Now you can find them first, without your code ever leaving your network.
Aikido Machine is a GPU server that runs continuous pentests on your critical applications, fully within your premises. Built for the regulated industries, and powered by our acquisition of Milou to bring AI pentesting fully on-prem.
Offense is your best defense.
Manaf retweeted
Our AI pentest found eight high-severity vulnerabilities in NodeBB in six hours.
XSS bugs that required a custom Federation server to exploit, a template injection affecting practically every input, private message leaks, and post hijacking.
NodeBB fixed all eight. More below 🧵
Manaf retweeted
Deleting a Google API key doesn't revoke it immediately.
Our research found successful authentications up to 23 minutes after deletion across Google's infrastructure. During that window, attackers with a leaked key can still access enabled APIs, including Gemini.
Google closed our report as "won't fix."
Manaf retweeted
Few months ago, @manaaaaaaaf and I decided to join @AikidoSecurity because there is no better place to build AI Pentest.
A platform to cover all security aspects is the only way to achieve unhackability. Aikido is now a 🦄
Super proud to be part of @ProjectEurope_ !
We’re building truly special at @haicker_app with my co-founder @pilvar222, super excited for what’s next!
We're happy to announce we're backed by @ProjectEurope_!
These people are completely insane. So much energy and ambition! With them, we're cooking so hard @GordonRamsay would be proud.
Hack the planet!
Manaf retweeted
For my French-speaking friends:
You can find the replay of the stream my co-founder @manaaaaaaaf and I were invited to, in which we talk AI stuff and present @haicker_app in action! 🔥
Thank you @TheLaluka for the invitation! ❤️
Last replay : documenté, chapitré, sourcé ! 💣🧠🔫
On y aborde la recherche de failles par agents IA via l'entreprise & produit @haicker_app (hors sponso), en compagnie des créateurs @pilvar222 @manaaaaaaaf et du fidèle compagnon @KharaTheOne pour la partie Techno Watch ! 💌
youtube.com/live/fa8KV76h9WM
Manaf retweeted
It's finally out! :D
@manaaaaaaaf and I have been building @haicker_app for the last 6 months, putting all our knowledge and skills into it.
We're releasing it to the market. Any organization can now secure their application using @haicker_app !
Very excited for what's next!
I’ve been working on this for a while with @pilvar222, happy that we are launch !
Book a demo with us to get access at haicker.app
Manaf retweeted
My friend @manaaaaaaaf and I have created an AI hacker! 👨💻
It can find 0-days in web applications with 0% false positives, and it also works on CTF challenges!
What you see ⬇️ is @haicker_app solving a web challenge from UMassCTF 2025 (only 45/557 teams were able to solve it!)
Manaf retweeted
Waitlist is open, sign up for early access 👀
👉haicker.app
Manaf retweeted
Research into a unique 0-click deanonymization exploit targeting Signal, Discord and hundreds of platform 🧵
Manaf retweeted
🇪🇺 The European Cybersecurity Challenge 2024 kicks off tomorrow in Turin, Italy 🇮🇹
👉 Read the opening press release on: ecsc2024.it/news/2024-10-07-…
#ECSC2024 #Cybersecurity #Challenge #CTF
@CyberSecNatLab @csirt_it @enisa_eu



















