Hacking Twitter for Fun (and Profit?)

An opinion piece arguing that post-Elon Twitter hot takes suffer from the false consensus effect: each user's experience differs based on communities, mute and block settings, and feed configuration.

HackerOne's top five vulnerability reports of Q3 2016: an Uber password-reset account takeover ($10K), SQL injection on an Uber .cn domain, an SVG code-execution report, a subdomain takeover, and an XSS in Twitter's SMS service.

Combining threshold signatures with trusted execution environments (TEEs) can strengthen MPC deployments, if the TEE serves as a defense-in-depth layer rather than a substitute for a sound protocol.

XBOW tests your whole external application estate the way an attacker would, with no source code and no credentials, and proves what is exploitable.

A pentest shows Claude refuses to build an LSASS dumper, but local DeepSeek and uncensored Qwen models produce a working XOR-encrypted minidumper, making AI-assisted EDR evasion nearly effortless.

Syncing Domain Admins into Entra ID lets attackers pivot from compromised on-prem AD to the cloud, and back via password writeback. CIS and Microsoft advise keeping privileged admin accounts cloud-only.