itewqq (@lyq_sqsp) header
itewqq (@lyq_sqsp) profile picture

Working on Agent/Security @DarknavyOrg. CTF player @0ops_ctf. Somehow got a PhD on cryptography @SJTU1896. Opinions/Shitposts are my own.

Joined August 2017
Photo by itewqq (@lyq_sqsp)Photo by itewqq (@lyq_sqsp)Photo by itewqq (@lyq_sqsp)Photo by itewqq (@lyq_sqsp)Photo by itewqq (@lyq_sqsp)Photo by itewqq (@lyq_sqsp)Photo by itewqq (@lyq_sqsp)Photo by itewqq (@lyq_sqsp)Photo by itewqq (@lyq_sqsp)
So that's our robot hacking talk at #39c3 ! Hope you enjoyed it. We will release some of the code/tools soon (but carefully lol). If you missed it live, you can watch the replay here: youtu.be/qjA__5-Bybs?si=CwLp…
1
5
1
55
17,375
Replying to @DJIGlobal
@DJIGlobal @DJISupport Yo, can you stop hiring paid commenters/bots to attack us and our security researcher friends in the Chinese social media? Do you really want to make matters worse?
2
2
1
29
2,103
The drama is officially over; the clown can step off the stage now. Thanks for your performance.
1
6
353
Just let the people talk about the football star now. Peace and love.
6
316
Since the original author has finally released the write-up(it’s a great one!), I think it’s safe to say that we got most of it right back then in July.
Our AI agent, deepsec, reproduced @orange_8361's fabulous pure-logic Microsoft Edge RCE demonstrated at Pwn2Own Berlin 2026, starting only from the binary diff!
1
3
24
1,745
Top Gun 3: Satellite Dogfight
SpaceX Blocked A U.S. And NATO Satellite to Assist a Russian Intercept After Crippling Ukraine's Air Defenses The Math Proves the Reality that Musk doesn't want you to see. On Oct 13-14, SpaceX restricted Starshield/Starlink during a 39-missile Russian attack, cutting Ukrainian drone intercepts by 23% and stranding U.S. personnel in Kyiv. Forty-eight hours later (Oct 15), SpaceX blocked U.S.-licensed NRO, Space Force, and NATO radar satellite ICEYE-X36 in orbit so Russia's COSMOS 2612 weapon could intercept it (99.89%-99.98% posterior) Our Model Demonstrates that the Russian intercept of the US/NATO ICEYE X-36 satellite (contemporaneous with the throttling of Starlink) would not have been possible, and almost certainly not been attempted, without SpaceX resources. At a material opportunity cost, Russia sprinted its COSMOS satellite to intercept ICEYE X36. Based on a previous attempt in June during which X36 maneuvered to evade COSMOS, Russia knew that this would be successful only if X36 could not maneuver. On October 15, SpaceX fixed X36 in place by issuing a collision alert for a sub-kilometer approach with its Starlink 35856 when SpaceX's own data shows that the actual distance was 4.8-5.0x as great. SpaceX issued no warning to COSMOS despite the fact that its sprint was far more threatening than the stable X36 orbit. SpaceX did not maneuver its Starlink 35856 satellite to clear the supposed collision risk. How, absent coordination with SpaceX, could Russia have known that SpaceX would take actions that (a) misrepresented the danger posed by X36, and (b) resulted in the fixing of X36 thereby enabling COSMOS's successful intercept? Thus, SpaceX was directly involved in simultaneously compromising Ukraine’s defensive and offensive capabilities. The conjunction of these two events makes innocent explanations untenable. The Pentagon Capture & Iran Round Two Trap: Pentagon CTO Emil Michael who cashed out $7M–$35M from Musk’s inner-circle SpaceX vehicles (M8/Gigafund 0.1 and M6/Valor M33 II) and KQ Partners / xAI (selling xAIfor $5M–$25M three days before taking over CDAO/OSCand 21 days before SpaceX bought xAI, while keeping M8, M6, M9, M10 & Nomadic open) and Pete Hegseth purged rival Anthropic in two hours, surrendered combat command over US drones used to attack Iran to Starlink’s "Terms of Service," and on October 2 named Musk Co-Director of Project Meridian to design the Pentagon's "Future of Warfighting" just as America enters Iran Round Twowith depleted Patriot/THAAD magazines and Russia feeding U.S. warship/aircraft locations to Tehran. SpaceX’s actions in Ukraine raise serious questions about its alignment with US security interests and its reliability as a cornerstone of US defense. These questions are particularly troubling given the effectively irreplaceable position SpaceX has been granted by the Hegseth/Emil Michael Pentagon. $SPCX $TSLA Our full quantitative analysis below w/ @streetwiseprof
5
659
6.6K bounty 😅 afaik someone is willing to pay >6.6M for a large scale reasoning extraction from Opus 5.5
GhostCompact for free inference, and this to leak reasoning traces! All this for $6,600 total bounty ☠️ But hey, at least we helped a $1.25T company secure its models — and its gross margins. You're welcome! 😭 We love your models <3
1
25
1,827
Just received a speaker voucher from 40C3 (thanks!). Maybe I should bring a gift for the Congress?
At today’s GEEKCON, a researcher demonstrated what I believe is the first remote full-chain exploit of a latest WELL-KNOWN drone. Our Pwn2Own-style live competition never released vulnerability details on those success trials. Actually we did not even show the vendor’s name in plaintext. However, a guy from that vendor called POLICE on-site to take the researcher out for “investigation”. It’s extremely disappointing that in 2026, some still view security work from such a bad perspective.
1
24
1,622
At today’s GEEKCON, a researcher demonstrated what I believe is the first remote full-chain exploit of a latest WELL-KNOWN drone. Our Pwn2Own-style live competition never released vulnerability details on those success trials. Actually we did not even show the vendor’s name in plaintext. However, a guy from that vendor called POLICE on-site to take the researcher out for “investigation”. It’s extremely disappointing that in 2026, some still view security work from such a bad perspective.
8
38
10
278
32,192
WTF someone just reserved CVE-2026-114514 …
7
24
1
241
21,598
OpenAI independently reported the same root cause ON THE SAME DAY? I hope that it is just a coincidence...
From the PHP Foundation on who found it first 👇
2
1
17
1,510
🫨
i jailbroke the nintendo switch 2 so i modded cinnamoroll, peter griffin, hatsune miku, and more into Mario Kart World, a switch 2 exclusive now watch my friends and i get cooked by bots learn more and get the exploit pepsipu.com/blog/2026-10-swi…
3
1,143
itewqq retweeted
Replying to @AliceInDisarray
The situation is even worse for language package manager: "As a result, any pip < 26.2.2 will keep trusting the compromised intermediate CAs regardless of the system trust store, so distrusting them at the OS level is not enough." discuss.python.org/t/informa…
2
1
39
7,997
Test your device with dv-g3b-emudhra.we-have-a-pro… I still remember that my PhD collaborator's paper was rejected for "it is practically impossible for modern PKI to fail."
20
54
5
1,040
94,050
Literally a disaster for IoT vendors that cannot frequently update their products.
1
1
35
10,832