𝚑𝚐𝟾 @_hg8_

Security Researcher & Privacy Activist. 🐘 DM are welcome for any questions. hg8.sh /dev/urandom Joined September 2016

Tweets

3K
Followers

3K
Following

419
Likes

587

asymmetric research @asymmetric_re

a week ago

New post: @RelayProtocol’s contracts trusted Ed25519 verification without validating offsets, opening the door to forged allocator signatures and potential double-spends. @_fel1x details the bug, the risks it posed to cross-chain liquidity, and how the issue was addressed.

6 16 104 36K 47

Download Image

Aero @AeroPool_

3 months ago

Meet Aero, a stake pool designed to empower and uplift Solana ecosystem contributors. Here's everything you need to know. 🧵

16 67 157 30K 22

Download Image

asymmetric research @asymmetric_re

2 weeks ago

Threat Contained: marginfi Flash Loan Vulnerability by @_fel1x A new instruction broke the flash loan logic, creating a way to borrow without repaying and putting $160M at risk. We explain the vulnerability, potential impact, and how it was fixed. Full post below ↓

6 31 153 32K 97

𝚑𝚐𝟾 @_hg8_

2 weeks ago

Verifying myself: I am hg8 on Keybase.io. EKch8vJv9Y1TmJ_7OC6xVP_ASNvHltHQVNu4 / keybase.io/hg8/sigs/EKch8…

0 0 0 101 0

𝚑𝚐𝟾 @_hg8_

3 weeks ago

"The NPM account of the popular developer qix was compromised, leading to malicious versions being published for dozens of packages, including chalk, strip-ansi, and color-convert." Recommended read. Interesting payload. jdstaerk.substack.com/p/we-just-foun… #SupplyChain

0 1 2 334 0

chris @chrischang43

4 weeks ago

article here: sandwiched.me/research/sandw…

1 4 11 790 4

𝚑𝚐𝟾 @_hg8_

2 months ago

End of Season 8 🎉 #hackthebox

0 0 1 225 0

Download Image

siunam @siunam321

5 months ago

Here's my research about Python dirty Arbitrary File Write to RCE via overwriting shared object files or overwriting bytecode files. Enjoy! siunam321.github.io/research/pytho… #Research #WebAppSec

0 55 186 11K 122

𝚑𝚐𝟾 @_hg8_

3 months ago

"CVE-2025-32463: sudo local privilege escalation via chroot option" An attacker can leverage sudo's -R (--chroot) option to run arbitrary commands as root, even if they are not listed in the sudoers file. Sudo versions 1.9.14 to 1.9.17 affected. openwall.com/lists/oss-secu… #infosec

0 0 0 170 0

𝚑𝚐𝟾 @_hg8_

3 months ago

"TensorFlow Remote Code Execution with Malicious Model" Old technique but good writeup splint.gitbook.io/cyberblog/secu… #ctf #tensorflow #ai #infosec

0 0 0 179 1

𝚑𝚐𝟾 @_hg8_

2 years ago

"Code injection or backdoor: A new look at Ivanti’s CVE-2021-44529" labs.greynoise.io/grimoire/2024-…

0 0 1 373 1

𝚑𝚐𝟾 @_hg8_

2 years ago

"What the I-Soon Leak Tells Us About WiFi Hacking" supernetworks.org/pages/blog/iso…

0 1 3 514 0

Andy Nguyen @theflow0

2 years ago

Last year I discovered multiple bugs in virtio-net for VirtualBox (CVE-2023-22098, CVE-2023-22099, CVE-2023-22100) and wrote a 100% reliable VM escape using an out-of-bounds write (with ASLR defeat). Published the exploit code: github.com/google/securit…

9 149 685 81K 157

𝚑𝚐𝟾 @_hg8_

2 years ago

"Reverse engineered an ESP32-based smart home device to gain remote control access and integrate it with Home Assistant." Great write-up. Recommended read. jmswrnr.com/blog/hacking-a…

0 0 0 254 1

𝚑𝚐𝟾 @_hg8_

2 years ago

"CVE-2024-0204: Fortra GoAnywhere MFT Authentication Bypass Deep-Dive" Tl;Dr: "/goanywhere/images/..;/wizard/InitialAccountSetup.xhtml" unauthenticated leads to the setup page, allowing you to create a new admin account. horizon3.ai/cve-2024-0204-… #cve #poc #exploit

0 1 0 341 0

vs1m @Vsimpro

2 years ago

Got an ethical pentest for a kiosk-esque environment, but you're stuck in a browser? Have access to websites, but have a need to go deeper? Look no further! With kiosk.vsim.xyz you have access to tools that enable lateral enum, calculator://, file browsing, and more!

8 92 441 37K 287

Download Image

Ivan Fratric 💙💛 @ifsecure

2 years ago

In December, in macOS Sonoma, Apple fixed 15 video decoding vulnerabilities I reported. This is how these issues were found: github.com/googleprojectz…

2 44 195 37K 86

𝚑𝚐𝟾 @_hg8_

2 years ago

Supply Chain Security: How the Figma security engineering team leveraged commit signatures and Okta Device Trust certificates to protect GitHub release branches. figma.com/blog/how-we-en… #supplychain

0 0 1 209 0

Derin Eryilmaz @deryilz

2 years ago

My first blog post! It's about CVE-2023-4369, a $10,000 bug I found in ChromeOS in July. The bug used a chrome:// URL XSS to allow Chrome extensions to execute privileged code and read/edit downloaded files without user interaction. 👀 0x44.xyz/blog/cve-2023-…