TommyBoy
@tommyboyhacking.bsky.social
Hack/Planets https://tommyboyhacking.github.io/tommylinkin/
Forcing researchers to pay to submit individual submissions is a ridiculous idea still. It effectively turns into gambling. Is platform triage going to randomly mark my bug OOS? (they already did this before AI-slop) Is the company simply not being fair in their decisions?
The bugs that end up having the most real world impact do not qualify as valid in the BB / VDP world
Reverse Engineering a Ledger Nano X Hardware Implant (Tropicon 2026) slides are up! grandideastudio.com/portfolio/se...
when software malfunctioned, people often used to assume it was the effect of malware. but now we assume the software sucks.
These guys found a hardware wallet in a storage locker. I hacked it and we're going to open it on their livestream in a few minutes. Come experience the drama with us! I think it's empty, but you never know 😅 www.twitch.tv/rubaz www.twitch.tv/Eisteelepeac...
BB platforms will not be relevant in a future security industry that actually cares about security
Everything you thought wasn't an embedded browser actually is an embedded browser
Random recent positive news: a top bug hunter informed one of my hacker friends that he nominated both my friend and I to be +1 for a upcoming Live Hacking Event. I doubt I'll make the final cut, but that was genuinely one of the coolest things that's happened to me here and I'm forever grateful.
Wanted to get into some mobile app hacking but i feel like every time ive tried it devolves into chaos and everything not working
“GPT-5 is the first time that it feels like talking to an expert in any topic — a Ph.D.-level expert,” OpenAI CEO Sam Altman said.
Theo Sanderson@theo.io · last yr.(real, one-shot :p )
Get email that program is reopening old reports incorrectly closed by H1 and never looked at by mediation for 6 months:
a close up of a white cat 's face with blue eyes and the words ahhhh written on it .
Alt: a close up of a white cat 's face with blue eyes and the words ahhhh written on it .
media.tenor.com
Honestly at this point I'm only submitting bug bounty reports to laugh at the creative ways they come up with to avoid paying
I'm happy to release a script gadgets wiki inspired by the work of @slekies, @kkotowicz, and @sirdarckcat in their Black Hat USA 2017 talk! 🔥 The goal is to provide quick access to gadgets that help bypass HTML sanitizers and CSPs 👇 gmsgadget.com 1/4
So I pay all the money and the AI gets to do all the hallucinating?
Just decided to make this at 4am last night due to some frustrations. Will try to improve on this in the future. SENOAE (Search Engine No AI Emulator) Simple, but effective. It just appends Google's -noai flag to the end of every search. PoC:
It's funny to think how easily it can all be taken away. My life's work is effectively numbers on a profile showing i found bugs on X, Y or Z. Never had a company agree to disclosure. Just realizing now that if I ever got banned I literally have nothing to show for my work in this space.
Ironically making Spike Spiegel my profile picture I've ended up having a similar story arch in chasing bounties, and repeatedly getting shafted by the bounty distributing agency.
New by me - although Citrix say there is no evidence of exploitation of CitrixBleed 2 vulnerability, they are wrong - it has been under active exploitation since mid June by an IP associated to a ransomware group, with multiple IP addresses now involved. doublepulsar.com/citrixbleed-...
CitrixBleed 2 exploitation started mid-June — how to spot it
CitrixBleed 2 — CVE-2025–5777 — has been under active exploitation to hijack Netscaler sessions, bypassing MFA, globally for a month.
doublepulsar.com
