Nerd who likes Hacking, Programming, ITSec. CTF Player, Cyber Security Enthusiast
Joined December 2020
- Tweets8.8K
- Following1.7K
- Followers1.7K
- Likes126K
TheGentlemanHacker retweeted
The best way to level up your bug bounty skills? By reading more! 🧐
We've been publishing free, in-depth web app hacking articles for years, covering everything from SSRF and broken access control to GraphQL, cache poisoning, and AI security. 🤠
Start reading, link in next post! 👇
#BugBountyTips #HackWithIntigriti
TheGentlemanHacker retweeted
Tout va bien !
0xosprey : un tableau de bord pour visualiser l’évolution des CVE… (via 🐻 Pierre Arlais)
👉 cve.0xosprey.com/
ALT Graphique en courbe intitulé « CVE Tracker » sur fond noir, montrant une hausse des valeurs de près de 0 au début des années 2000 à environ 15 000 vers la fin, avec une forte accélération finale. On voit aussi le filigrane diagonal « cve.0xosprey.com » et des repères d’axe datés Dec 2003, Dec 2008, Dec 2013, Dec 2018 et Dec 2023.
TheGentlemanHacker retweeted
This2Shell. That2Shell. Everything2Shell.
WHAT A WEEK IN #CYBERSECURITY.
> Critical RCEs dropping everywhere.
> Millions of exploit attempts.
> AI agents getting hijacked.
> Leaked keys poisoning software packages.
> Old bugs coming back to haunt us.
> And yes, some sites just went offline.
One week. Too many ways to get hacked.
⚡ Full Recap: thehackernews.com/2026/10/we…
TheGentlemanHacker retweeted
🎁ゲーミングPCプレゼント🎁
【抽選で①名様】
ガレリアゲーミングPCをプレゼント‼️
▶️応募方法
・フォロー、リポスト
・「参加」とリプ(任意
#ゲーミングPC #プレゼント #プレゼントキャンペーン
TheGentlemanHacker retweeted
🚨 À l’occasion de la PGW et de nos 20 ans, on vous fait gagner un MAGNIFIQUE ROG STRIX G16 !
Ryzen 9 8940HX + RTX 5070 Ti 🔥
Pour participer :
1️⃣ Likez + retweetez
2️⃣ Commentez avec #ROGPGW26
📅 TAS le 28/10/26
🚨Et si vous passez à la PGW, postez votre photo sur notre stand avec le hashtag #ROGPGW26 pour augmenter vos chances !
France métropolitaine • 1 PC à gagner, tous réseaux confondus • 1 ticket/personne, ou 3 avec votre photo sur notre stand PGW • Multicomptes exclus
#ROGPGW26 #Concours #Giveaway
TheGentlemanHacker retweeted
Gagne un ROG STRIX G16 en participant au concours ! 🎮🔥
Prends une photo sur notre stand avec le hashtag #ROGPGW26 pour tripler tes chances ! 😎👀
#ROGPGW26
@ASUS_BK_ROG
#GOBKROG
TheGentlemanHacker retweeted
À l’occasion du passage du French Monster sur le stand Fnac @LenovoLegionFR vous fait gagner un Legion 5A Gen 11, parfait pour des sessions gaming de qualité avec son écran OLED pixel perfect 👀
🎁 Pour participer : RT + Follow @LENOVOLEGIONFR
📅 TAS : 01/11/26
Publicité
TheGentlemanHacker retweeted
📣 I partnered with Packt to give away two copies of the 5th Edition of Practical Mobile Forensics by Rohit Tamma!
1 winner will receive an eBook
1 winner will receive a print book
To Enter:
☑️ Share this post
☑️ Comment "Print" or "eBook" to indicate which one you want to win
On Saturday, October 31st, entries from across social media will be combined and the winners will be selected.
What the book covers:
✔️ iOS Architecture, Security, and Filesystem
✔️ Data Acquisition from iOS Devices & Backups
✔️ iOS Data Analysis and Recovery
✔️ iOS and Android Forensics Tools and Automation
✔️ Android Architecture
✔️ Android Data Extraction and Data Recovery
✔️ Parsing Third-Party Application Artifacts
Links to the book:
Packt: packtpub.com/en-us/product/p…
Amazon: amazon.com/Practical-Mobile-…
#DFIR
TheGentlemanHacker retweeted
🚨 PHP warns of another unpatched remote code execution risk; CVE-2026-115560
The newly disclosed vulnerability is separate from the two PHP2Shell flaws patched earlier this week and is not fixed by PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
⠀
PHP says exploitation requires an unusual configuration where an application:
• Uses php_binary or php_serialize as its session serializer
• Changes the serializer to php at runtime before session_start()
• Has session upload progress enabled
⠀
PHP considers the risk unlikely and plans to release a fix during its next regular update cycle.
Until then, administrators with affected configurations should set:
session.upload_progress.enabled=0
Applications that do not change the session serializer at runtime are not exposed through this path.
No exploitation has been reported.
Source:
php.net/
TheGentlemanHacker retweeted
Ah bah voilà, c'est parfait ça pour un vendredi !!
Allez hop, on remet ça.
‼️ BREAKING ‼️ PHP warns of another UNPATCHED REC vulnerability just 2 days after releasing emergency patches for critical PHP2Shell flaws.
New "CVE-2026-115560" affects only unusual session configurations. PHP has issued urgent mitigation guidance.
Full details → thehackernews.com/2026/10/ur…
TheGentlemanHacker retweeted
Après PHP2Shell, voici Node2Shell. Le nom fait peur, mais la menace n'a pas la même ampleur.
Cette faille Brotli expose Node.js à une exécution de code à distance
Pour en savoir plus :
👉 it-connect.fr/node2shell-nod…
#cybersécurité #nodejs #infosec
TheGentlemanHacker retweeted
CVE-2026-64638: XSS2Shell WordPress Pre-Authentication XSS to Remote Code Execution
PoC: github.com/Boreas37/CVE-2026…
TheGentlemanHacker retweeted
OAuth Bypass Testbed
403.brutelogic.net/authz/oau…
Test your skills against a LOGIN (randomly vulnerable) and/or 17 AUTHENTICATION SERVER endpoints.
Like with JWT (JBroken), our fully automated OAuth tool (OBroken) with complete FFF (Find, Forge, Fire) PoCs, aces this testbed.
13 Original OAuth Attack Techniques
OAuth is the login layer of the modern web.
Every "Continue with Google." Every "Sign in with GitHub." Every SSO button on every SaaS you've ever tested. All OAuth under the hood.
Most implementations are broken in ways that aren't documented anywhere.
Here's one of 13 original techniques - Grant Type Substitution → MFA Bypass.
MFA bound to the browser flow only. Switch grant type, MFA disappears. CVE-2024-37893.
The password grant being present is itself a finding worth reporting.
MCP is OAuth now and nobody is testing it.
TheGentlemanHacker retweeted
🚨 #GIVEAWAY ALERT 🚨
Win access to @NULLCON Berlin 2026! 🎟️ 🇩🇪
Prizes:
1️⃣ Conference Pass (€649 value)
2️⃣ 15% Discount (con+training)
3️⃣ 10% Discount (con+training)
To enter:
✅ Follow us
✅ ❤️ + RT
✅ Tag 2 friends = 1 extra entry
#NullConBerlin2026 #CyberSecurity #InfoSec
TheGentlemanHacker retweeted
Looking for a list of awesome bug bounty tools to run ?
Awesome-bugbounty-tools by @vavkamil is a curated repository of bug bounty tools organized by category, covering everything from recon and fuzzing to exploitation and reporting! 🤠
Check it out! 👇
github.com/vavkamil/awesome-…
TheGentlemanHacker retweeted
PHP2Shell : vous avez patché PHP sur l'hôte, mais vos conteneurs WordPress ou Nextcloud embarquent leur propre PHP. C'est le cas de toutes les apps PHP.
Comment vérifier la version dans chaque conteneur et le mettre à jour :
it-connect.fr/php2shell-dock…
#docker #php #cybersécurité
TheGentlemanHacker retweeted
LEARN ARDUINO FOR FREE. NO BOARD, NO WIRES, NO PURCHASE NEEDED. 🤩
Someone built a free interactive Arduino trainer that runs right in your browser. It’s called Learn Arduino.
What you can do:
→ Build virtual circuits 🔌
→ Hook up sensors, motors and LEDs
→ Write code and instantly see how it all works ⚡
The best part: the whole project was built with Claude Opus 5.5. 🤖
A few years ago you needed a kit, a cable and a weekend to blink one LED. Now you just open a tab.
Try it here: learn-arduino-red.vercel.app… 👇
TheGentlemanHacker retweeted
🚨 CRITICAL: GitLab flaw (CVSS 10.0) affects 12 years of releases.
CVE-2026-110264 could allow unauthenticated remote code execution on self-managed servers.
Read - thehackernews.com/2026/10/cr…
