@sshell_

AI offensive security at @RunSybil (prev. @BishopFox). security research. ccdc red team. tummy ache survivor.

 Virginia, USA
sshell.co
Joined June 2013
  • Tweets6.3K
  • Following1.5K
  • Followers10.4K
916Media
Include

Only show posts containing:

Exclude

Hide posts containing:

Time range
-
Minimum likes
Replying to @d0nutptr
:O
163
Replying to @d0nutptr
super super cool work. love to see it!
60
Yep. Because you can't just prompt "find me all the vulnerabilties". Maybe in awhile but we're nowhere near that now. Skilled researchers, custom harnesses, and other techniques are changing the bug depth game, in addition to bringing down the cost.
ℏεsam
@HesamationOct 22
wait, PHP was actually scanned by Anthropic’s Claude Mythos earlier this year. they also had access to OpenAI’s Daybreak Red for validating exploits. the PHP Foundation revealed this JUST yesterday. keeping frontier cyber models in the hands of a selected few doesn’t seem to be working well for the internet. thephp.foundation/blog/2026/…
3
11
2
58
7,950
sshell retweeted
shubs
@infosec_auOct 22
Just published our high fidelity scanner for php2shell: github.com/assetnote/php2she… See our detection logic here: slcyber.io/research/high-fid… We've taken care in our detection logic and hope it helps defenders. Congrats to @calif_io and @lcfr_hax for the discovery.
14
90
8
534
50,278
when you drop codex into the PHP source repo and ask it to look for bugs
2
308
sshell retweeted
shubs
@infosec_auOct 20
You can now perform content discovery at 100k requests per second with h3fuzz on http/3 hosts (fork of ffuf with http/3 support). Tool here: github.com/assetnote/h3fuzz Research post here: slcyber.io/research/how-prac…
10
106
1
511
22,239
sshell retweeted
Calif
@calif_ioOct 21
Let’s set the record straight: @lcfr_hax was the first to discover php2shell and develop a working exploit. See his August 5 tweet: xitter.cf/lcfr_hax/status/208503… His work convinced the PHP Foundation to invest in fixing this entire bug class. He then worked around the clock to review, test, and retest the patches.
LCFR
@lcfr_haxAug 5
d935be023a55b04681eccd1d2b8385b4b295e141a5df108e5e979d8d5d7124ac
54
409
93
3,086
394,867
sshell retweeted
LCFR
@lcfr_haxSep 23
d935be023a55b04681eccd1d2b8385b4b295e141a5df108e5e979d8d5d7124ac (posted in august) (related) 8da579ec498d57c20977c8d186d7f6cd4c04f46ffa1b436dd646ec19b99bdf47 cb4c8532c245ff7e05d6e270fca5742bb3271f541ef80f0071ca3d4307eb2b53 957f8cc21b18483f80a9d723aa4f9ded26e456424ffd065a044d1ed9d58a4fbc 4f93976ef105f0d9ff2d60f35d48958c8bba9d9eb2873cd93b3f7105fa4716a6
Justin Elze
@HackingLZSep 23
Despite all the doom and gloom from InfoSec we are how many months are into people throwing endless tokens at various OSS projects? Hows Apache? Nginx? OpenSSH doing? Any public point and shoot RCEs in RDP/SMB in Windows? All of the above technology getting wrecked in the wild?
25
9
2
168
64,705
Replying to @lcfr_hax
this goes so hard
4
1,170
Replying to @calif_io
amazing work as always. you guys are killin it!
2,546
sshell retweeted
Calif
@calif_ioOct 21
php2shell - A tale of two PHP remote vulnerabilities: calif.io/php2shell
19
250
29
778
179,963
Replying to @farazsth98
lmao this is my surprised face😐
1
327
4 son, or php daughter?
85
1,948
63
22,915
245,358
it's very easy for people to create piles of plausible-looking slop and call it a PoC someone out there has figured out the PHP RCE (CVE-2026-109618 / CVE-2026-109619), but it might not be the person whose code you're retweeting sight unseen
4
6
1
80
8,416
For the next few days or weeks, anyone now has a root CA thanks to eMudhra. Time to have some fun with MiTMing unwilling devices!
49
232
82
2,825
482,208
I spoke to @josephmenn this week about AI worms and wanted to add more color to my thoughts. What makes an AI worm different is that a model is capable of learning on the fly. This type of threat isn't here yet, but this is an example of an increasing shift that defenders are feeling. We keep hearing the same theme from @runsybil customers: finding vulns is only the start. Teams need to patch and understand their attack surface in real time. Our job is to find and fix what's exploitable faster than attackers. Onward 🚀 Full article here: theguardian.com/technology/2…

What are self-replicating ‘AI worms’, and why is Anthropic worried about them?

The tech company says successful AI worms need more capability on less powerful devices, but current trends make that feasible by the end of the year

theguardian.com
4
9
1,266
Replying to @d0nutptr
gl fam
62
Replying to @threepointone
it’s all i’ve been thinking about for 12 hours now. it’s so incredibly singular. it feels like the words to describe it haven’t been created yet.
1
1,233
sshell retweeted
max@maxbittkerOct 17
Runescape Bench talk now up on youtube! Covers results from the benchmark, design of the harness, and economic swarm experiments I've been doing. youtube.com/watch?v=cNm4zyUt… Thanks @recursecenter

RuneScape Bench: MMOs for Agents | Max Bittker

RS-sdk is a 2026 project by Max Bittker that turns LostCity into a ...

youtube.com
29
36
16
270
33,074
sshell retweeted
Eric Gu
@ericyueguOct 16
1/ I trained an AI to be top 1% in the world at Super Smash Bros. Melee by watching 80k hours of human replay. Meet HAL.
147
121
96
1,859
373,117
Load more