The Magic You're looking for is in the work you're avoiding
Joined April 2020
- Tweets16K
- Following637
- Followers474
- Likes43.5K
Pinned Tweet
Never ever ever stop talking about Aafia Siddiqui!!
The resilience of Palestinians that inspiring millions today is simply because of their Iman & Aafia wanted to establish this same level of Imaan in the muslim world!
#FreeAafiaSiddiqui
#JusticeforAafia
#HumanRightsViolation
~/.Humay0on retweeted
Do you know Google Flare team ( an elite reverse engineering and malware analysis unit ) has a crash course that explains and teaches malware analysis from basics to advanced step by step.
Link :- docs.google.com/document/d/1…
~/.Humay0on retweeted
THIS IS F**KING DANGEROUS
SOMEONE JUST DROPPED A MASSIVE COLLECTION OF AI JAILBREAK PROMPTS
THAT COULD PUSH MULTIPLE MODELS PAST THEIR GUARDRAILS.
→ prompts for Gemini, DeepSeek, GLM and Kimi
→ jailbreak experiments across multiple AI models
→ completely free and open source
→ no paywall
ONE REPO. A WHOLE ARSENAL OF JAILBREAK PROMPTS.
REPO BELOW
~/.Humay0on retweeted
Claude Code just found proof that every app on your phone is listening to your conversations. TikTok, Instagram, Facebook, Snapchat. they're using what you say out loud to build your feed. i have the data to prove it.
i was on a call with my friend and told him i'm thinking about breaking up with my girlfriend. didn't text it. didn't search it. just said it out loud with my phone on the table. two hours later she opens TikTok next to me and her entire feed is breakups. "signs your relationship is over." "how to heal after a breakup." she looked at me and said "why is TikTok showing me this." i said i don't know. but i did know.
i connected my iPhone to my MacBook and ran Claude Code.
it scanned every app's background microphone activity for the last 90 days. apps that only had access to photos or location were activating the microphone anyway.
→ TikTok → 412 background activations while the app was "closed"
→ Instagram → 284
→ Facebook → 197
→ Snapchat → 118
each activation lasted 2 to 12 seconds. enough to catch a sentence. each one tagged a keyword and cached it on the phone with a timestamp.
→ "breakup" — tagged 4 hours before her feed changed
→ "new apartment" — from a call with my mom
→ "engagement ring" — from a private call with my sister i never searched
→ "creatine" — said to my roommate, ads within 40 minutes
→ "bali flights" — mentioned at dinner, travel ads by morning
1,011 keywords cached across 4 apps in 90 days. every one matched something i said out loud near my phone.
checked my girlfriend's phone next. same keywords. same timestamps. both phones picking up the same conversation independently.
Claude Code revoked microphone access, disabled background app refresh, turned off "Hey Siri" and nearby interaction on both phones. within 48 hours both feeds went completely random. nothing personal. that's when i knew for sure.
the full prompt is in the first reply. takes 3 minutes. save it and send it to anyone who's ever said "my phone is definitely listening to me." it is. now you can prove it and shut it down.
~/.Humay0on retweeted
I can't sleep after this shit... Claude Code just found 12,154 photos of my face on the old Android I used for 8 years. I never took a single one of them.
The front camera was firing almost every time I picked the phone up. In bed, on the train, in the car, or when I just grabbed it to check the time.
They were real camera frames sitting in a hidden folder, each one with a timestamp and a location. None of them were in the Gallery or in Recently Deleted.
I plugged the phone into my laptop, turned on ADB and told Claude Code to look for front-camera files that weren't in my photos. It pulled a folder inside Android/data that belonged to a flashlight app I installed in 2019 and completely forgot about. 12,154 files.
I started scrolling. Almost all of it was from the last 15 months. Then I saw a file created 2 seconds ago, while I was still looking at the folder. The phone kept taking photos of me as I was reading this.
On Android 8 any app with camera permission can shoot in the background, and you get no green dot or any other warning when it does. That flashlight app had camera and location access from day one.
I uninstalled it, took camera access away from everything that doesn't need it and cleared the folder. How many of these photos already went somewhere else, I don't know.
If you want to check yours, plug it in, turn on USB debugging and ask Claude Code to find front-camera files outside your Gallery and show which apps used the camera and when.
~/.Humay0on retweeted
Since the @Apple Bug Bounty Program is by far the worst program I've ever hacked on, I am going to be dumping all of the data/POCs/report write ups etc for everything found during the 4 months of hacking them. This will include POCs for vulns that didnt meet their bar for a bounty so wasnt reported to them, so you may be able to find ways to escalate some of them. Ill be uploading the data all this weekend.
~/.Humay0on retweeted
⚠️php2shell (CVE-2026-109618 and CVE-2026-109619): we’re seeing “P2SB” multipart probes hitting our Palo Alto GlobalProtect honeypots.
The requests carry a PHP_SESSION_UPLOAD_PROGRESS marker (“p2s-rider”) and a dummy file upload with no payload, which points to someone checking for the vulnerable upload-progress behavior and likely building a target list of Palo Alto devices.
Source is a known mass-exploit IP: 204.76.203.]7 (AS51396 Pfcloud UG, NL)
Track php2shell exploitation on Defused 👉 console.defusedcyber.com/sig…
~/.Humay0on retweeted
You made me buy a HTB subscription... Tenet pwned with php2shell
Completely agree here - You should patch PHP but the sky is not falling yet. The issue here is going to be all the IOT Crap that just does not ever get updated. There still is time to patch.
If you want to see the state of things, find a cyber range (I prefer HackTheBox). Go look for a bunch of old PHP Boxes and try the exploit out on them. Right now I think you are going to have a tough time finding a retired box that you can exploit with PHP2SHELL.... Atleast I hope you do because I am having a hell of a time doing it and both love/hate to learn how much of a noob I am at times.
AI is really good at making crap look good. I know the POC that shows a POC of <?php echo("OK") ?> being exploited sounds scary. But when you look deeper there are a lot of hard-coded offsets that make it only work on that target.
~/.Humay0on retweeted
🚨 Yesterday, PHP2Shell made headlines. Today, we're already teaching you how to exploit it. Yeah, we're THAT fast⚡ Two critical PHP vulnerabilities. 9.2 CVSS. Unauthenticated RCE.
And you can already exploit the chain, bypass ASLR, and pop a shell in our latest recent threat room.
Hackers don't wait. Neither do we 🟢 Go Get hands-on: tryhackme.com/room/cvephp2sh…
~/.Humay0on retweeted
Look at how the blue changes color depending on the lighting. The environment can make it from navy blue to almost metallic blue, it's perfect!
~/.Humay0on retweeted
Just to be clear, I am not leaving The Batman Part II. I am profoundly grateful to Steven for coming to my aid during this challenging time to help me finish principal photography. Thank you to all for your concern and well wishes. 🦇
~/.Humay0on retweeted
Not making the lenses reflective and instead making them translucent was the best decision they made with this mask
