find me a critical vulnerability, make no mistakes.
Joined September 2015
- Tweets372
- Following268
- Followers1.9K
- Likes1.1K
Ron Masas retweeted
A very interesting data point on whether distillation gives you a competitive advantage. Sonnet 5 is just objectively worse than GLM 5.2, and is likely around a similar size. Sonnet 5 was almost certainly distilled (and not just distilled from tokens, but proper distillation from logits) from Mythos. This should give you an update on how relatively unimportant distillation is, in particular for the Chinese labs. It's just a way to warmstart the model for RL; the American frontier labs do it with human data, Chinese do it with tokens from American models, but they could get to basically exactly the same model without it, it would just be a little bit more expensive and require more human data collection coordination/aggregation
Ron Masas retweeted
Microsoft ranked me #6 in the world on the 2026 MSRC Most Valuable Researchers list.
#3 Azure · #3 Azure DevOps · #7 Dynamics & Power Platform
My unfair advantage: autonomous AI agents I built, hunting alongside me.
Offensive security now runs at machine speed.
Today, we're proud to recognize the Top 100 Microsoft 2026 Most Valuable Researchers (MVRs).
Security researchers play a critical role in helping protect customers by identifying and reporting vulnerabilities across Microsoft products and services. We're grateful for their partnership and the impact they have made over the past year.
Congratulations to this year's Top 10 MVRs:
🥇C46F3708A45EF0041BD0A49DDAEA0E25
🥈ShinHyuiq & Alan Pang
🥉cherrypick
4. Brad Schlintz (@nmdhkr)
5. wtm (@wtm_offensi)
6. Asaf Cohen (XBREACH.AI)
7. bccc95a61a3cc79d7b2c4423c808f744
8. Felix B.
9. 142a423e2574abf10d65eba46891ca5e
9. Anonymous
This year, we updated the MVR leaderboard to rank researchers based on total bounty awards, creating a clearer connection between recognition and security impact. We also introduced Special Mentions to recognize researchers who submitted valid vulnerability reports during the recognition period, regardless of leaderboard ranking.
See our blog for the complete list of the Top 100 MSRC 2026 Most Valuable Researchers and the top researchers by bounty program: microsoft.com/en-us/msrc/blo…
Thank you to every researcher who partnered with us this year to help protect customers worldwide.
ALT Microsoft 2026 Most Valuable Researchers (MVRs)
Ron Masas retweeted
I got a 1T (trillion) parameter model running on my MacBook Pro.
Kimi-K2. 1.029T params.
~1 TB raw weights.
524 GB converted.
~1.7 tok/s.
Yesterday it was 671B. Today it's 1T.
Same laptop. Same M4 Max. No cloud.
When I say we: I mean Claude and me.
Ron Masas retweeted
⚠️ I found a Stored #XSS nested inside the OAuth credentials configuration.
Because n8n makes these credentials shareable, a threat actor can easily propagate this attack vector to any victim they choose !
Full write-up here ➝ lnkd.in/e5Y_VdE7
Ron Masas retweeted
zeroday.cloud 2025?… UNREAL.
2 days. $340k in prizes 🤑
Live exploits on stage that literally shook the room.
THANK YOU to everyone who came!
You made history. You made the cloud safer.
Ron Masas retweeted
The only thing comforting about the @reactjs & @nextjs CVE (a critical unauth RCE that works on default configurations) is that AI Agents using Frontier models are still far from auto-generating Proof of Concepts based on code diffs - unless someone proves otherwise
There is critical vulnerability in React Server Components disclosed as CVE-2025-55182 that impacts React 19 and frameworks that use it.
A fix has been published in React versions 19.0.1, 19.1.2, and 19.2.1. We recommend upgrading immediately.
react.dev/blog/2025/12/03/cr…
Ron Masas retweeted
🚨 I uncovered a pre-handshake DoS in the LSQUIC implementation of QUIC.
Attackers can crash servers without establishing a single QUIC connection.
✅ Patch now.
🔗 imperva.com/blog/quic-leak-c…
#QUIC #HTTP3 #DoS #CyberSecurity #QUICLEAK
Ron Masas retweeted
Apple awarded me only $1,000 for this bug, I should quit this bug bounty thing and get a real job.
CVE-2025-30466: Safari <18.4 UXSS to bypass Same-Origin Policy with CVSS of Critical 9.8 🔴 ;)
support.apple.com/en-us/1223…
Ron Masas retweeted
Android web attack surface
ndevtk.github.io/writeups/20… no longer has anything redacted :) also got a new duck profile banner (Subject to change)
Ron Masas retweeted
gaining access to anyones browser without them even visiting a website (CVE-2024-45489)
kibty.town/blog/arc/
Ron Masas retweeted
Surprise, surprise! The Rabbit R1 runs Android under-the-hood, and its entire interface is powered by an Android app.
I managed to get that app up and running on a Pixel 6a.
More details👇
androidauthority.com/rabbit-…
Ron Masas retweeted
Neuralink was kind enough to open their doors for me to tour their headquarters a few weeks back. It was an amazing experience and a day I'll never forget. This was at a company wide meeting at the end of the day. Thank you to everyone who made this possible. Hope y'all enjoy! I'm hoping to tell my story in full some day.
Ron Masas retweeted
Deep State of Cybersecurity: a Probabilistic Perspective
1. Fail to install updates timely and get hacked with N-day exploits.
2. Install updates too eagerly and get hacked with yet-uncaught supply chain implants.
3. You are always affected by 0-day exploits.
4. Statistically, the odds of being hacked tend to infinity as time goes.
Conclusion: high value "targets" who have used a computer for long enough, are already pwned with a near-1 probability
Ron Masas retweeted
here is sora, our video generation model:
openai.com/sora
today we are starting red-teaming and offering access to a limited number of creators.
@_tim_brooks @billpeeb @model_mechanic are really incredible; amazing work by them and the team.
remarkable moment.
Ron Masas retweeted
I spoke about XS-Leaks on the modern web. Slides from today are available at zeyu2001.com/pdf/talks/bside…
Ron Masas retweeted
This is the best paragraph in the blogpost for the curl CVE-2023-38545 - I love the self-reflection. Huge respect to @bagder for his work on curl!
