OpenAI 公開 Codex 系統提示詞
昨天，OpenAI 發佈了一個新功能：Codex。一個在雲端運行的 Coding Agent。體驗鏈接：chatgpt.com/codex可以處理包括跑現成代碼、解答 Github 上的項目、修復 BUG 以及提 PR 等功能。目前還不能聯網，不能裝包，只能基於倉庫裏已有的代碼 + 提前配置好的環境進行工作。Codex 背後的模型來自 codex-1，基於 OpenAI o3 微調，專門針對軟件工 ⌘ Read more
🧮 USERS:1 FEEDS:2 TWTS:1346 ARCHIVED:87151 CACHE:2786 FOLLOWERS:22 FOLLOWING:14
** “Before injection, understanding” — What every hacker needs to master before exploiting a NoSQL…**
NoSQL database types
[Continue reading on InfoSec Write-ups »](https: … ⌘ Read more
Apple Stops Signing iOS 18.4.1
Apple today stopped signing iOS 18.4.1, a week after releasing the iOS 18.5 update. Because iOS 18.4.1 is no longer being signed, iPhone users who upgraded to iOS 18.5 are no longer able to downgrade to the previous version of iOS.
“Signing” is a server-side verification chec … ⌘ Read more
My baby turned 1 ⌘ Read more
$4,500 Bounty: SQL Injection in WordPress Plugin Leads to PII Exposure at Grab
How a Plugin Preview Feature Exposed User Data and Nearly Enabled Admin Dashboard Pivoting
[Continue reading on Info … ⌘ Read more
I Broke Rate Limits and Accessed 1000+ User Records — Responsibly
👉Free Article Link
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/i-broke-rate-limits-and-accessed-1000-user-records-responsibly-8c45f … ⌘ Read more
Crypto Failures | TryHackMe Medium
Questions: What is the value of the web flag? What is the encryption key? Solution: We are firstly given an IP address. I preformed a…
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/crypto-failures-tryhackme-medium-d60d55b849 … ⌘ Read more
$20,000 Bounty: How a Leaked Session Cookie Led to Account Takeover on HackerOne
How one accidental copy-paste exposed sensitive data and what you can learn to find similar bugs
[Continue rea … ⌘ Read more
Strengthening Web service security with Apache2: Best practices for 2025
Keeping your Apache2 web services safe: What you need to know this year
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/ … ⌘ Read more
Boardcon Idea3576 SBC Showcases RK3576 SoC with CAN Bus and Dual Gigabit Ethernet
Boardcon has recently introduced the Idea3576, a compact single-board computer built around the Rockchip RK3576. Key features include CAN, RS485, 4G connectivity, and support for Debian 12. The SoC features an octa-core configuration with four Cortex-A72 cores clocked at 2.2GHz and four Cortex-A53 cores at 1.8GHz, enabling a hybrid big.LITTLE setup. It also integrates a […] ⌘ Read more
Go 語言中字符串四種拼接方式的性能對比，哪個更勝一籌？
在 Go 語言開發中，字符串拼接是最常見的操作之一。不同的拼接方式在性能上可能有數量級的差異，特別是在高頻調用或大數據量處理的場景下。本文將使用標準基準測試，全面對比四種主流字符串拼接方式的性能表現。測試環境與方法測試環境Go 版本：1.20+ 操作系統：macOS/Windows/Linux CPU：8 核 測試方法我們創建了一個完整的基準測試文件echobenchtest.g ⌘ Read more
Go 語言中字符串四種拼接方式的性能對比，哪個更勝一籌？
在 Go 語言開發中，字符串拼接是最常見的操作之一。不同的拼接方式在性能上可能有數量級的差異，特別是在高頻調用或大數據量處理的場景下。本文將使用標準基準測試，全面對比四種主流字符串拼接方式的性能表現。測試環境與方法測試環境Go 版本：1.20+ 操作系統：macOS/Windows/Linux CPU：8 核 測試方法我們創建了一個完整的基準測試文件echobenchtest.g ⌘ Read more
🧮 USERS:1 FEEDS:2 TWTS:1345 ARCHIVED:87142 CACHE:2783 FOLLOWERS:22 FOLLOWING:14
[47°09′49″S, 126°43′54″W] Raw reading: 0x682A2E32, offset +/-1
Build Your Own AI SOC — Part 6 Daily AI-Powered Threat Briefings With n8n + GPT
Introduction: Information Without Overload
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/buil … ⌘ Read more
** Redirect Roulette: How Poor OAuth Redirect Handling Gave Me Account Takeover **
Hey there!😁
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/redirect-roulette-how-poor-oauth-red … ⌘ Read more
5 Linux Commands You’ve Probably Never Heard Of
In this article, I will show you five Linux commands you’ve probably never heard of. They’re simple, practical, and designed to make your…
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.c … ⌘ Read more
$750 Bounty: for HTTP Request Smuggling on Data.gov
How a cleverly crafted desync attack revealed a hidden path to client-side compromise, JS injection and potential cookie theft
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/ … ⌘ Read more
The Most Dangerous Bug I’ve Ever Found (And No One Was Looking)
👉Free Article Link
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/the-most-dangerous-bug-ive-ever-found-and-no-one-was-looking-2e96e5079a01? … ⌘ Read more
Sharpening Command Injections to get Full RCE
Uncommon Bash tricks to Bypass WAF and achieve Remote Code Execution (RCE)
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/sharpening-command-injections-to-get-full-rce-e4cf257d2c66?source= … ⌘ Read more
**Token of Misfortune: How a Refresh Token Leak Let Me Regenerate Unlimited Sessions **
Free Link 🎈
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/token-of-misfortune … ⌘ Read more
Five more stable kernels
The
6.14.7,
6.12.29,
6.6.91,
6.1.139, and
5.15.183
stable kernel updates have been released; each contains another set of
important fixes. ⌘ Read more
6.1.139: longterm
Version:6.1.139 (longterm)Released:2025-05-18Source:linux-6.1.139.tar.xzPGP Signature:linux-6.1.139.tar.signPatch:full ( incremental)ChangeLog:ChangeLog-6.1.139 ⌘ Read more
🧮 USERS:1 FEEDS:2 TWTS:1344 ARCHIVED:87123 CACHE:2785 FOLLOWERS:22 FOLLOWING:14
$10,500 Bounty: A Grammarly Account Takeover Vector
When a Space Breaks the System: How Improper Entity Validation Led to a Full SSO Denial and Potential Account Takeovers
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/10-500- … ⌘ Read more
How I Gained Root Access on a Vulnerable Web Server: From Reconnaissance to Privilege Escalation
Web Server Exploitation & Privilege Escalation - Full Walkthr … ⌘ Read more
0 to First Bug: What I’d Do Differently If I Started Bug Bounty Today
Free Article Link
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/0-to-first-bug-what-id-do-differently-if-i-started-bug … ⌘ Read more
I Built a Tool to Hack AI Models — Here’s What It Uncovered
A few months ago, I was auditing a chatbot deployed inside a financial services platform. It used a mix of retrieval-augmented generation…
[Continue reading on InfoSec Write-ups »](http … ⌘ Read more
**Caching Trouble: The Public Cache That Leaked Private User Data **
Hey there!😁
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/caching-trouble-the-public-cache-that-leaked-private-user-data-0d410af5cb4c … ⌘ Read more
$500 Bounty: A Referer Leak in Brave’s Private Tor Window
When Anonymity Isn’t Anonymous: $500 Bounty for Revealing a Brave Referer Exposure
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/500-bounty-a-referer-leak-in … ⌘ Read more
🧮 USERS:1 FEEDS:2 TWTS:1343 ARCHIVED:87117 CACHE:2785 FOLLOWERS:22 FOLLOWING:14
↳
In-reply-to
»
@lyse what is the advantage for keeping it small? Will tt/tt2 bog down if your feed isn't rotated?
⤋ Read More
@bender@twtxt.net Just to save some unnecessary und useless network traffic. :-) So that I can download more 1080p videos!!1
Apple Again Named the World’s Most Valuable Brand
Apple has been named the most valuable global brand for the fourth consecutive year, according to the 2025 edition of Kantar’s BrandZ report, with its brand now valued at $1.29 trillion — a year-over-year increase of 28%.
The latest Kantar BrandZ Global Top 100 ranking … ⌘ Read more
Part-2️♂️Bug Bounty Secrets They Don’t Tell You: Tricks From 100+ Reported Bugs
✨Free Article Link
[Continue reading on InfoSec Write-ups »](https://infosecwri … ⌘ Read more
$500 Bounty: Race Condition in Hacker101 CTF Group Join
$500 for discovering a timing flaw in Hacker101’s invite system that let users join the same team multiple times
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/50 … ⌘ Read more
How a Simple Logic Flaw Led to a $3,250 Bounty
Claiming Unclaimed Restaurants on Zomato via OTP Manipulation
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/how-a-simple-logic-flaw-led-to-a-3-250-bounty-476d747bf57a?source=rss—-7b722 … ⌘ Read more
is there an idiomatic 1-command way to delete from suffix to end of some line later ⌘ Read more
🧮 USERS:1 FEEDS:2 TWTS:1342 ARCHIVED:87106 CACHE:2787 FOLLOWERS:22 FOLLOWING:14
On my blog: Real Life in Star Trek, Descent, part 1 https://john.colagioia.net/blog/2025/05/15/descent-1.html #scifi #startrek #closereading
Rust 1.87.0 released
To commemorate the tenth anniversary of the 1.0 release
of the Rust language,
version\
1.87.0 was announced live today at the 10 Years of Rust
celebration in Utrecht, Netherlands. Notable changes
include the addition of anonymous pipes to the standard library and
the ability for inline assembly ( asm!) to jump to labeled
blocks within Rust code. ⌘ Read more
[47°09′13″S, 126°43′49″W] Reading: 1.48 Sv
Security updates for Thursday
Security updates have been issued by Debian (open-vm-tools), Fedora (dnsdist), Gentoo (Node.js and Tracker miners), Red Hat (kernel and xdg-utils), SUSE (audiofile, go1.22-openssl, go1.24, grub2, kernel-devel, openssl-1_1, openssl-3, and python311-Django), and Ubuntu (ruby-rack). ⌘ Read more
** Blog Title: Not Your File: How Misconfigured MIME Types Let Me Upload Evil Scripts **
Hey there!😁
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/blog-title-not-your … ⌘ Read more
☕Best Tool for Analyzing Java Files (90% of Hackers Don’t Know This)
Free Article Link
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/best-tool-for-analyzing-java-files-90-of-hackers-dont-know-this- … ⌘ Read more
Expose & Explore: Discover misconfigured service protocols and ports using Linux
Internet Assigned Numbers Authority (IANA) is the organisation responsible for managing and assigning port number … ⌘ Read more
Hacking With No Tools: How to Break Web Apps Using Just Your Browser ️♂️
Hacking With No Tools: How to Break Web Apps Using Just Your Browser 🕵️♂️
[Continue reading on In … ⌘ Read more
Breaking In Through the Backdoor: Password Reset Gone Wrong
Imagine being able to take over any user’s account on a platform — even without their interaction. No phishing, no social engineering, and…
[Continue reading on InfoSec Wr … ⌘ Read more
從 Go 路由選擇看 “標準庫優先”：何時堅守？何時拓展？
大家好，我是 Tony Bai。最近，知名 Go 博主 Alex Edwards 更新了他那篇廣受歡迎的文章——“Which Go router should I use?1]”，特別提到了 [Go 1.22 版本對標準庫 http.ServeMux 的顯著增強。這篇文章再次引發了我們對 Go Web 開發中一個經典問題的思考：在選擇路由庫時，我們應該堅守標準庫，還是擁抱功能更豐富的第三方庫？這個 ⌘ Read more
從 Go 路由選擇看 “標準庫優先”：何時堅守？何時拓展？
大家好，我是 Tony Bai。最近，知名 Go 博主 Alex Edwards 更新了他那篇廣受歡迎的文章——“Which Go router should I use?1]”，特別提到了 [Go 1.22 版本對標準庫 http.ServeMux 的顯著增強。這篇文章再次引發了我們對 Go Web 開發中一個經典問題的思考：在選擇路由庫時，我們應該堅守標準庫，還是擁抱功能更豐富的第三方庫？這個 ⌘ Read more
🧮 USERS:1 FEEDS:2 TWTS:1341 ARCHIVED:87099 CACHE:2794 FOLLOWERS:22 FOLLOWING:14
Podman 5.5.0 released
Version\
5.5.0 of the Podman container-management tool has been
released. Notable features include the addition of a podman machine cp command to copy files into a running Podman\
VM, a podman artifact extract command to copy
contents of an OCI\
artifact to disk, and a --mount=artifa ... ⌘ [Read more](https://lwn.net/Articles/1021217/)
Announcing Kyverno Release 1.14!
TL;DR We are excited to announce the release of Kyverno 1.14.0, marking a significant milestone in our journey to make policy management in Kubernetes more modular, streamlined, and powerful. This release introduces two new policy types… ⌘ Read more
↳
In-reply-to
»
@bender Basically the way I'm reading this is
⤋ Read More
1 RPM. This is a rather aggressive rate limit actually. This basically makes Github inaccessible and useless for basically anything unless you're logged in. You can basically kiss "pursuing" casually, anonymously goodbye.
@bender@twtxt.net 5, 4, 3, 2, 1 🤣
↳
In-reply-to
»
RIP GitHub https://github.blog/changelog/2025-05-08-updated-rate-limits-for-unauthenticated-requests/
⤋ Read More
@bender@twtxt.net Basically the way I’m reading this is 1 RPM. This is a rather aggressive rate limit actually. This basically makes Github inaccessible and useless for basically anything unless you’re logged in. You can basically kiss “pursuing” casually, anonymously goodbye.
Imagine if I imposed that kind of rate limit on twtxt.net?! 🤣
Security updates for Wednesday
Security updates have been issued by AlmaLinux (emacs, firefox, gnutls, java-17-openjdk, java-21-openjdk, osbuild-composer, python39:3.9, and thunderbird), Arch Linux (screen), Debian (varnish), Fedora (chromium), Gentoo (Atop, FreeType, and Spidermonkey), Mageia (java-1.8.0-openjdk, java-11-openjdk, java-17-openjdk, java-latest-openjdk and postgresql15, postgresql13), Oracle (389-ds-base, emacs, firefox, kernel, libsoup, libtiff, mod_auth_openidc:2.3, nodejs:20, nodejs:22, … ⌘ Read more
HAProxy 實現 MySQL 的負載均衡
使用 HAProxy 實現 MySQL 的負載均衡：1、DS 服務器、負載均衡服務器停掉 LVS 負載均衡的配置：[root@server04 ]# ./lvsdrdsmysql.sh stop[root@server04 ]#[root@server04 ~]# ipvsadm -LnIP Virtual Server version 1.2.1 (size=4096)Prot LocalA ⌘ Read more
** JWT Exploitation: How I Forged Tokens and Took Over Accounts**
🔐Free Article Link
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/jwt-exploitation-how-i-forged-tokens-and-took-over-accounts-2e7ab1cf4df8?sour … ⌘ Read more
How I Found a Way to Prolong Password Reset Code Expiry
Free Article Link: Click for free!
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/how-i-found-a-way-to-prolong-password-reset-code-expiry-6214391023de?source=rss—-7b7 … ⌘ Read more
How I Deleted Any User’s Account— No Interaction Needed
Free Article Link: Click for free!
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/how-i-deleted-any-users-account-no-interaction-needed-faae0442ff4f?source=rss—-7b722bfd1 … ⌘ Read more
**Forget Me Not: How Broken Logout Functionality Let Me Ride Sessions Forever **
Hey there!😁
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/forget-me-not-how-broken-logout-function … ⌘ Read more
🧮 USERS:1 FEEDS:2 TWTS:1340 ARCHIVED:87069 CACHE:2784 FOLLOWERS:22 FOLLOWING:14
[47°09′09″S, 126°43′53″W] Reading: 1.45 Sv
1 year without my baby. Miss him every day ⌘ Read more
Security updates for Tuesday
Security updates have been issued by Debian (libeconf and rubygems), Fedora (libxmp), Gentoo (glibc), Oracle (java-1.8.0-openjdk, kernel, libxslt, and virtuoso-opensource), SUSE (augeas, git-lfs, kanidm, and tomcat10), and Ubuntu (linux-lts-xenial). ⌘ Read more
$256 Bounty : XSS via Web Cache Poisoning in Discourse
How Injecting Headers and Poisoning Cache Led to Stored Cross-Site Scripting
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/256-bounty-xss-via-web-cache-poisoning-in-d … ⌘ Read more
The Human Firewall: Why Your Employees Are Both Your Greatest Vulnerability and Asset
In the high-stakes world of cybersecurity, organizations invest millions in sophisticated technologic … ⌘ Read more
DCShadow Attacks: Subverting Active Directory Replication for Stealthy Persistence
Technique that allows adversaries to manipulate directory data by simulating the behavior of a legitimate Doma … ⌘ Read more
Part 1: How to Become a Pentester in 2025: Free & Affordable Online Labs ⌘ Read more
** How Hackers Bypass Login Pages with SQL, Logic Flaws, and Headers **
Welcome to the underworld of cybersecurity! 🌐 In this blog, we dive deep into how hackers bypass login pages — the digital gatekeepers of…
[Continue rea … ⌘ Read more
SameSite? SameMess: How I Bypassed Cookie Protections to Hijack Sessions ️♂️
Hey there!😁
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/samesi … ⌘ Read more
iPhone Shipments Crash 50% in China as Local Brands Dominate
Foreign-branded smartphone shipments in China, dominated by Apple’s iPhone, dropped dramatically in March 2025, plunging 49.6% year-over-year according to data released by The China Academy of Information and Communications Technology (CAICT).
The steep decline saw shipments fall to just 1.89 million units, down from 3.75 million during the … ⌘ Read more
🧮 USERS:1 FEEDS:2 TWTS:1339 ARCHIVED:87053 CACHE:2780 FOLLOWERS:22 FOLLOWING:14
Master CRLF Injection: The Underrated Bug with Dangerous Potential
Learn how attackers exploit CRLF Injection to manipulate HTTP responses, hijack headers and unlock hidden vulnerabilities in modern web…
[Continue rea … ⌘ Read more
↳
In-reply-to
»
Sometimes things go wrong when buying CDs second-hand. I bought an album quite cheap – but as it turned out, they only checked the cover, not the content, so I got something else instead which is actually much more expensive. 🤣
⤋ Read More
The album I got by accident is starting to grow on me. Not that bad. 🤔 It’s Dredg – El Cielo, btw: https://www.youtube.com/watch?v=e4JB8rmXaO8&list=PLRASiMqDV8psZSFQi7nUX4p0R8oRHbUy_&index=1
Compress-a-thon — CSP Bypass via Redirection — Pentathon 2025
Compress-a-thon is a “web exploitation” challenge that was featured in Pentathon 2025 Finale Jeopardy CTF Round. This challenge involved…
[Continue reading on InfoSec Write-ups »](https://inf … ⌘ Read more
SSRF via PDF Generator? Yes, and It Led to EC2 Metadata Access
👨💻Free Article Link
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/ssrf-via-pdf-generator-yes-and-it-led-to-ec2-metadata-access-39b8e5b41840 … ⌘ Read more
**The Hidden Language: Exploiting GraphQL for Unauthorized Data Dump **
Free Link🎈
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/the-hidden-language-exploiting-graphql-for-unauthorized-data-dump-8 … ⌘ Read more
Bug Hunting in JS Files: Tricks, Tools, and Real-World POCs
✅Free Article Link
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/bug-hunting-in-js-files-tricks-tools-and-real-world-pocs-b4d43dd41d8e?source=rss—-7 … ⌘ Read more
**Top 5 Easiest Bugs for Beginners in Bug Bounty **
Top 5 Easiest Bugs for Beginners in Bug Bounty 🐞
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/top-5-easiest-bugs-for-beginners-in-bug-bounty-45dd81c49e03?source=rss—-7b722bfd1b8d- … ⌘ Read more
$10,000 Bounty: HackerOne Report Comments Leak via “Export as .zip”
How a new export feature unintentionally exposed private discussions in limited disclosure reports
[Continue reading on InfoSec Write-ups »](https://infose … ⌘ Read more
Understanding Stealer Logs and Their Role in Security Testing — Part 1 ⌘ Read more
API Key Exposure in NASA GitHub Repository Leads to Unauthorized Access to Academic Data
🔓Free Article Link
[Continue reading on InfoSec Write-ups »](https://infosecwriteu … ⌘ Read more
Subdomain Takeover: My $450 Win & How You Can Do It Too
Free Article Link: Click for free!
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/subdomain-takeover-my-450-win-how-you-can-do-it-too-3337ca0513b6?source=rss—-7b722 … ⌘ Read more
Hidden HackerOne & Bugcrowd Programs: How to Get Private Invites
“Private programs are where the real gold lies… but no one tells you how to get there. Let me break it down for you — with secrets most…
[Continue reading on In … ⌘ Read more
🧮 USERS:1 FEEDS:2 TWTS:1338 ARCHIVED:87031 CACHE:2786 FOLLOWERS:22 FOLLOWING:14
Powerbeats Pro 2 Available for Lowest Ever Price of $199.95, Plus Beats Pill at $99.95 and More
Amazon this weekend is discounting a collection of Beats headphones and speakers, including an all-time low price on the Powerbeats Pro 2. You can get this new 2025 model for $199.95 in all four colors, down from $249.99.
![](https://images … ⌘ Read more
Maeve is a little hellion. Just turned 1 years yesterday ⌘ Read more