Juno @junorouse

@chainlight_io intern, team lead. Building an essential risk management platform for Web3. imjuno.com Seoul Joined April 2019

Tweets

1K
Followers

2K
Following

1K
Likes

4K

Tim Becker @tjbecker

a week ago

Can finally share the details of a really nice Redis RCE found by @xint_official back in December. IMO, the bug is really cool! In short, carefully crafting eviction parameters and blocking on a key can cause a client to self-evict during unblocking, leading to a use-after-free!

2 12 77 6K 19

View Details

Brian Pak @brian_pak

a month ago

Surfaced by Xint Code — our AI vuln research platform — pointed at the kernel's crypto/ for about an hour, on a starting hunch from @5unKn0wn. Came back with CopyFail (plus others, still in coordinated disclosure). Write-up + PoC (exploit): copy.fail Xint Code: code.xint.io

4 32 287 58K 154

View Details

Xint @xint_official

a month ago

Patch your Linux boxes! Copy.Fail is a trivially exploitable logic bug in Linux, reachable on all major distros released in the last 9 years. A small, portable python script gets root on all platforms. Found by the teams at @theori_io and @xint_official More details below xint.io/blog/copy-fail…

24 363 983 250K 457

View Details

Juno @junorouse

a month ago

x.com/xint_official/…

Xint @xint_official

a month ago

24 363 983 250K 457

0 1 30 17K 8

View Details

Juno @junorouse

a month ago

Full write-up (CVE-2026-31431): xint.io/blog/copy-fail…

2 17 130 19K 58

View Details

Xint @xint_official

a month ago

'Before [Xint security researcher @tjbecker] started working on automatic bug finding with AI, he worked on vulnerability research, finding zero days and reporting them to maintainers. He said it used to take him weeks or months to find a high-impact vulnerability in a brand-new codebase, and now it only takes hours. “I just drop the code into our AI bug-finding tool [Xint] and in a couple hours I get a report with a bunch of candidate vulnerabilities, and most of them end up checking out and being real issues,” he said. “The bar to diving into a new million-line codebase and finding a bug is so much lower than it used to be.”' Great report from @verge looking into the new era of cybersecurity, where even non-technical attackers can use AI to find the weaknesses in the apps and networks of organizations faster and at a scale never thought possible before. theverge.com/ai-artificial-…

1 5 34 9K 21

View Details

Xint @xint_official

2 months ago

Join award-winning security researcher @tylerni7 on @TechstrongTV for this hands-on workshop for product security practitioners. In this workshop he will: 1) go deep into how AI-native AppSec differs from traditional tools and methods 2) share the pitfalls of poorly harnessed AI bug finding 3) and provide a demonstration of how the scaffolding (and not the model) is what will provide superior results for what product security looks like in the real world webinars.techstronglearning.com/how-to-conduct…

0 2 10 2K 9

View Details

Juno @junorouse

2 months ago

@tjbecker VIBE

0 0 0 115 0

View Details

Juno @junorouse

2 months ago

@cal_nix Thank you ser

0 0 1 38 0

View Details

Juno @junorouse

2 months ago

💻💻📲📲🔒🔒

Xint @xint_official

2 months ago

Big news: Samsung Electronics selected Xint as a strategic tool to overcome the limitations of traditional manual security audits and to eliminate security blind spots. Leveraging AI on top of Theori's expertise as world class hackers, Xint autonomously analyzes the structure and

0 5 17 4K 2

3 2 10 3K 2

View Details

Juno @junorouse

2 months ago

@lj1nu lol

0 0 0 101 0

View Details

Juno @junorouse

2 months ago

Sounds like there's an insider? NUKE every K8s cluster 💣💣💣💣💣💣 > Rather, the attacker was able to gain access to the list of RPCs our DVN uses, compromise two of them – which were independent nodes running on separate clusters without direct connection to each other – and swap out binaries running the op-geth nodes.

LayerZero @LayerZero_Core

2 months ago

x.com/i/article/2046…

375 469 2K 2.0M 829

1 2 6 1K 2

View Details

Florian Roth ⚡️ @cyb3rops

2 months ago

. @mubix shared this on LinkedIn and thought some of you might find it useful: “A Practical Reprioritization Guide for CISOs Entering the AI Vulnerability Era” linkedin.com/posts/mubix_th…

6 88 386 59K 451

View Details

Tim Becker @tjbecker

2 months ago

Our AI code scanner, Xint Code, finds all 4 featured Mythos vulnerabilities (OpenBSD, FreeBSD, firecracker, FFmpeg) using its default pipeline (no custom prompts or configuration). These same scans found over 10 new vulnerabilities in OpenBSD, FFmpeg, and FreeBSD.

Xint @xint_official

2 months ago

Anthropic is (rightfully) generating a lot of attention for Mythos’s ability to find 0days, BUT the hard problem is not whether an LLM can recognize a bug when pointed at it; it is whether a system can find the right code to examine across a 9-million-line codebase, distinguish

0 14 49 19K 35

3 6 75 10K 50

View Details

Juno @junorouse

2 months ago

@Jeyffre what do you say on zip slip type bugs? path traversal is a spec issue, and i believe those are hard to be modeled (unless AI understands the specs and the threat models), and FV probably won’t catch it. so feels like there's still room for humans here.

0 0 3 543 0

View Details

Juno @junorouse

2 months ago

@kaijieguigui @cbwang505 @carmen_cqq You're assuming CC/Codex trusts the target dir? idk if that’s their threat model.

0 0 0 244 0

View Details

Juno @junorouse

2 months ago

@smaury92 @Black2Fan Pretty sure the reporter can pick it lol

1 0 0 143 0

View Details

Juno @junorouse

2 months ago

@thsottiaux i like it

0 0 0 117 0

View Details

OpenAI @OpenAI

2 months ago

We’re expanding Trusted Access for Cyber with additional tiers for authenticated cybersecurity defenders. Customers in the highest tiers can request access to GPT-5.4-Cyber, a version of GPT-5.4 fine-tuned for cybersecurity use cases, enabling more advanced defensive workflows. openai.com/index/scaling-…