V12

Changing one letter bypassed an entire admin API in @huggingface chat.

One request could trigger bulk internal exports of every user’s private chats, completely unauthenticated.

Here’s how. 🧵

x86 formal verification is coming!

The (first?) published machine-checked proof of a security property for the end-to-end execution of a Linux process running an x86 binary statically linked against glibc.

And we believe it scales!

A joint research project with @zellic_io 🧵👇

We found bugs in the AES-256 encryption of multiple PDF editors.

Some so weak you could break them by hand 🫠

V12 found 25 vulnerabilities in the x402 protocol.

Critical findings included:
- Requests approved without any payment
- Maliciously high requests being paid by default
- Session takeover from relayed login signatures

Here's how. 🧵