Well, I am proud enough and happy to say I got my first ACE (Arbitrary Code Execution)

It started with only exposed debugging point then I was able to execute JS over a Sandbox then I managed to escape it and if you are asking how the answer is I found another vulnerability which is prototype pollution and I was able to invoke some native JS as well like the constructor (like react2shell constructor.constructor but mine is not the same vulnerability) this gave me the ability to explore some internals, I trying to leverage it more now maybe to get the full RCE (Remote Code Execution)

Finally what I want to say that wasn't an easy thing to do I passed more than three days just trying and failing and trying. Nothing comes easy as you think

@reverseengineer101

My write (M0habozaid) up got the third place in best write ups

https://bugology.intigriti.io/intigriti-monthly-challenges/1125

Happy to share with that I have completed Try Hack Me -THM- advent of cyber security for 2025 and officially certified

Meta posts the way you can use to intercept the traffic in Facebook (mobile app)

https://bugbounty.meta.com/learn/articles/mitmproxy-burp-tls13-workaround

Tiny XSS Payloads

In case of your target is vulnerable to xss but you have some limitations due to the WAF or filtering you can try them and you can costumize them as well

tinyxss.terjanq.me

Shared by @reverseengineer101
From intigriti on X (formally Twitter)

CVE-2026-21858 + CVE-2025-68613: n8n Ni8mare - Full Chain Exploit

Unauthenticated to Root RCE:
- LFI via Content-Type confusion
- Read /proc/self/environ to find HOME
- Steal encryption key + database
- Forge admin JWT token
- Expression injection sandbox bypass
- RCE as root

CVSS 10.0

https://github.com/Chocapikk/CVE-2026-21858

Well Discord seems to be banned in Egypt 🇪🇬

Unfortunately as everything has a good side it has a bad one as well 😔

https://eg.downdetector.com/status/discord/

Be careful ! about what you are clicking these days
Don't click any usernames from untrusted sources because one click can expose your IP address to the attackers servers via a fake proxy initialized before by the attacker

Shared from https://www.facebook.com/Sir.MaTrix

@reverseengineer101

The Proof of Concept (PoC)
https://github.com/g0vguy/Telegram_1-Click_Vulnerability

Thanks for RHine for sharing ❤️

Claude AI is down

After what we saw from cloudflare at the end of 2025 will Claude be the same 😂
As some people say DaaS (Downtime As A Service)

Be updated on https://status.claude.com/

This must be a joke 😂

How to say our app can be a Trojan without saying 😁

Anyway that is why I always advise you not to install anything on your device
I don't have any personal issues with the app manufacture, but I had say my opinion from a security perspective
#stay_safe_stay_secure

@reverseengineer101

Well thank you ❤️

HackerAI is now available on Mac, Linux, and Windows.

hackerai.co/download

Github
https://github.com/hackerai-tech/hackerai

Shared by @reverseengineer101