At least after all these live-fire drills we are going through, hopefully we’ll be in better shape to deploy patches when even nastier bugs land in the future.
1
0
7
1,012
We have an epic bug to show off soon, but after seeing the marketing and branding of the PHP bugs (it's well done and I enjoyed much), I'm not convinced we can beat that level of branding despite our bug being "holy grail of web server pwn" 😭
16
17
237
25,840
We'd probably need to work with industry leaders to coordinate the disclosure + patch distribution because.. it'll definitely affect the world.
But until we figure out how to do that, I guess we'll patiently wait and help with the fix first. 😺
But until we figure out how to do that, I guess we'll patiently wait and help with the fix first. 😺
4
0
28
4,330
We could've used this "feature" to lower Xint's cost significantly. Obviously we decided to responsibly disclose the bug. It was promptly fixed by @OpenAI team, but $600 for something that has far greater business / financial impact was a little insulting tbh 😭
🫸👻🫷🧵
Let's talk GhostCompact:
What if you could cut your output token costs on OpenAI by 97-99%? 🤑
Our researcher @tjbecker found a discrepancy between the actual token costs burned versus what ended up being billed. He had a hunch and used Xint to validate that there was a logic bug in OpenAI's compaction feature released in February 2026 that led to billing based on compacted output and not on the actual tokens consumed.
xint.io/blog/openai-co…
1
2
20
1,698
This legit makes me want to go back to school after 15 years since I graduated. If you are a CMU student, make sure you take this opportunity! You’ll probably learn far more than just compilers from @realGeorgeHotz.
syllabus: gist.github.com/geohot/4768597…
syllabus: gist.github.com/geohot/4768597…
Compilers for Machine Learning
Carnegie Mellon University
Spring 2027 Semester
In person, Pittsburgh
10-411/711, MWF 10-10:50
139-seat classroom reserved
Lectures not posted online
Don't miss registration!
3
10
278
29,429
Brian Pak retweeted
#Pwn2Own Ireland schedule is finalized.
Team Xint attempts (Ireland time):
LiteLLM - Tuesday 9:30
Philipps Hue - Tuesday 18:30
Home Assistant - Wednesday 9:30
Oracle AI Database - Wednesday 11:45
Pixel 10 - Thursday 11:15
zerodayinitiative.com/blog/2026/10/5…
Team Xint attempts (Ireland time):
LiteLLM - Tuesday 9:30
Philipps Hue - Tuesday 18:30
Home Assistant - Wednesday 9:30
Oracle AI Database - Wednesday 11:45
Pixel 10 - Thursday 11:15
zerodayinitiative.com/blog/2026/10/5…
0
3
32
7,515
Hey everyone. We’ve seen the discussions around Copy Fail (CVE-2026-31431) and the disclosure process. We appreciate the passion from distro maintainers, defenders, and the broader Linux community. This is a serious issue, and we want to share some context on our side in good faith. 🧵
16
81
531
108,466
Some have also raised concerns about us releasing the exploit publicly. We have experience writing N-day exploits and know that monitoring git commits for fixes is common practice in offensive security. Attackers were likely already aware and exploiting this within the a few days after the kernel fix landed. With AI coding tools today, turning a CVE plus commit into a working exploit happens in hours anyway.
2
16
96
36,311
We’re grateful to the kernel security team and everyone working hard on patches. Looking ahead, we’re sure Xint and our researchers will uncover many more critical vulnerabilities. We’ll try our best next time to create less chaos for folks. Happy to discuss improvements openly.
Thanks for reading. Let’s keep making Linux stronger together. 🙏
Thanks for reading. Let’s keep making Linux stronger together. 🙏
3
2
100
12,589
and yes, RHEL 14.3 doesn't exist 😅 We meant to say RHEL 10.1. Sorry for the confusion!
And also yes, the static webpage copy.fail -- even the logo -- is vibe-coded. Too busy triaging shit ton of other bugs to build a legit website ground up.. and i think it's a perfect use case of vibecoding tbh 😆
And also yes, the static webpage copy.fail -- even the logo -- is vibe-coded. Too busy triaging shit ton of other bugs to build a legit website ground up.. and i think it's a perfect use case of vibecoding tbh 😆
3
5
54
6,608