Organizer of @HeroCTF || ctf w/ @FlatNetworkOrg || TeamFR 2021, 2022 & 2025 🇫🇷 || Breaking stuff @0xDepi
Joined March 2020
- Tweets1.2K
- Following587
- Followers3.5K
- Likes4.6K
Worty retweeted
With @hash_kitten, we've been looking into Cloudflare's /cdn-cgi/image endpoint and managed to get an XSS :D
To achieve this, we used what I believe to be a new CSP bypass involving the Cache-Control response header, combined with a sanitizer bypass!
I hope you'll enjoy it! 👇
Our security research team discovered a cross-site scripting vulnerability in Cloudflare's /cdn-cgi/image/ endpoint by chaining an SVG sanitizer bypass with a new Cache-Control header trick to bypass the CSP. The issue was reported to Cloudflare and has since been fixed.
You can read more here:
slcyber.io/research/cache-me…
Worty retweeted
I really hope that bug bounty platforms (cc @Bugcrowd @HackerOne @intigriti @yeswehack) will apply their 0day usual policies and will reject the farming of php2shell that is coming very soon.
Don't add to the triage fatigue, please
#BugBounty
Worty retweeted
We released a blog post @depi_ about Mean Time To Detect vs Meant Time To React, especially applied to Software Supply Chain
Beautifully written by @vm00z 🔥
depi.security/blog/20261002-…
Worty retweeted
We're building Depi Red Team.
Zero to a validated exploit in 3m 56s. Depi does the recon and validation, the red teamer builds the exploit locally on top.
We also used Bug Bounty as a sandbox for our research and got XX,XXX$ bounties with it ;D
Our team went from hours or days to minutes on the hardest exploits.
I need help from Red Teamers and get some feedback. DM me what's missing or let's jump into a call ;D
Worty retweeted
Our research team discovered two vulnerabilities in Discourse: a pre-authentication cache poisoning to sitewide XSS (CVE-2026-55674), and an arbitrary file read (RCE) chaining a JPEG race condition with ImageMagick and Ghostscript (CVE-2026-55420). You can read more here:
ALT https://www.slcyber.io/research/a-jpeg-a-race-and-a-ghost-breaking-discourses-image-pipeline
Worty retweeted
Insane research from @kevin_mizu at @assetnote ! Really mind blowing stuff 🔥
Our research team discovered two vulnerabilities in Discourse: a pre-authentication cache poisoning to sitewide XSS (CVE-2026-55674), and an arbitrary file read (RCE) chaining a JPEG race condition with ImageMagick and Ghostscript (CVE-2026-55420). You can read more here:
ALT https://www.slcyber.io/research/a-jpeg-a-race-and-a-ghost-breaking-discourses-image-pipeline
Worty retweeted
Aikido Intel now powers @depi_'s malware detection.
Depi maps every package, pipeline and maintainer between you and a supply chain compromise. Aikido Intel's feed now powers the malware detection behind it.
💜🤝💙
Learn more about Aikido Intel: intel.aikido.dev/
Worty retweeted
I'm happy that my first article as part of the @SLCyberSec research team is finally out! 😁
It covers an interesting ImageMagick race condition that I found back in June, which, combined with a polyglot payload, allowed me to achieve file read/RCE on Discourse. This should resonate with those who've seen the recent @HacktronAI research.
I hope you'll enjoy it! 👇
Our research team discovered two vulnerabilities in Discourse: a pre-authentication cache poisoning to sitewide XSS (CVE-2026-55674), and an arbitrary file read (RCE) chaining a JPEG race condition with ImageMagick and Ghostscript (CVE-2026-55420). You can read more here:
ALT https://www.slcyber.io/research/a-jpeg-a-race-and-a-ghost-breaking-discourses-image-pipeline
Worty retweeted
Blog post about From header smuggling in Apple iCloud just dropped.
Sending emails as [email protected], exotic parsing, and a $15,000 bounty.
sec-consult.com/blog/detail/…
Worty retweeted
We investigated a spam campaign running on throwaway domains, and found the company behind it with our new Pivot tool.
Its WHOIS was privacy-protected, but the company name was left in the organization field, on 208 domains.
blog.profundis.io/blog/from-…
Worty retweeted
Can a private Flutter dependency exposed in an APK become an entry point into your build environment? ⚠️
At @ekoparty's Bug Bounty Village (@BugBountyArg), @pwnwithlove will present ‘DevPUBdency Confusion: Weaponizing the Flutter Supply Chain’.
🕔 7 Oct, 4:55PM
📍 Auditorium E
Worty retweeted
Today, PHP commit 934d4ff patches two Use After Free I reported five months ago ⏳.
If you're interested in PHP core exploitation and vulnerability research, take a look at 🔗
therealcoiffeur.com/c111001.…
Worty retweeted
A logical bug that I've reported to MariaDB has just been disclosed! 🎉
It's a nice logic issue that allows any user (no matter their rights) to update the password of any other user, including root :D
You can find more details 👇
hackerone.com/reports/387643…
Worty retweeted
if you want triager-ready reports... I asked @yeswehack triagers what AI slop looks like, and what makes a great report
their feedback is now a Claude Code plugin that checks your evidence, impact claims & vuln-specific gotchas before you submit! ₍₍⚞(˶˃ ᗜ ˂˶)⚟⁾⁾
Write triager-grade Bug Bounty reports with Claude Code! 📝
Introducing the YesWeHack Claude Kit: an open-source Claude Code plugin that helps hunters structure findings, spot gaps in evidence and review reports before submission 👇
#BugBountyTips #ClaudeCode
yeswehack.com/learn-bug-boun…
Worty retweeted
Write triager-grade Bug Bounty reports with Claude Code! 📝
Introducing the YesWeHack Claude Kit: an open-source Claude Code plugin that helps hunters structure findings, spot gaps in evidence and review reports before submission 👇
#BugBountyTips #ClaudeCode
yeswehack.com/learn-bug-boun…
Worty retweeted
🎙️🇫🇷 Nouvel épisode du podcast Hack'n Speak accompagné de @kevin_mizu 🔥🥇
Épisode dédié à son parcours, ses recherches, son XSS DOMPurify et bien sûr un peu, beaucoup d'IA :)
Bonne écoute à toutes et à tous 🎶
creators.spotify.com/pod/pro…
Worty retweeted
A new #TalkiePwnii mini-series is here! 🎬
This time, @pwnwithlove is taking on challenges from the @PortSwigger @WebSecAcademy 👀
First up: an SSRF lab protected by a whitelist-based input filter.
Let’s break it down 👇
youtube.com/watch?v=0GGYTksa…
Worty retweeted
Recently, I've been looking at DOMPurify again, trying to find ways to bypass 3.x.x after browsers started encoding attrs during serialization.
I ended up with a nice ≤3.2.6 Safari default-configuration bypass using only SMIL tags/attrs :D
Details 👇
mizu.re/post/dompurify-bypas…
ALT https://yeswehack.github.io/Dom-Explorer/shared?id=9c1f671a-fc8f-4284-9217-eba4df143db3