reverse engineering

Today one of the Biggest Critical Security Breaches happened, anthropic claude code CLI source code has been breached by someone who says it was a security research (I don't think that was a legit one) How the breach happened: - who has leaked the source code says it was publicly noted that Claude Code source material was reachable through a .map file exposed in the npm package:

"Claude code source code has been leaked via a map file in their npm registry!"

- who is involved in the leak Chaofan Shou (@Fried_rice) The scary part: - anthropic knows that claude hallucinates and not giving you accurate answers while it has the capability to do - claude has massive power but it's restricted to you but not to the employees in anthropic - they are trying to keep you consuming and paying for tokens that runs out quickly due to the stupid answers you get - anthropic is developing more powerful agents but keeps everything undercover - claude has modes that can be switched to, to do specific tasks based on the job/task type but that's not for you as well The funny part: - I have found the same vulnerability not too far from now in some service provider, where I found source maps also exposed logs that contains data about the databases and administrators - days before I heard some security professional says that the AI bubble is near to burst or vanish The leak repository: - Can be found on github That's why I am always warning about these security vulnerabilities specially for developers Thank you for reading ♥️ @reverseengineer101

We are now in the age of Vibe Coding, it's great and everyone in tech feild should use AI in his work and if not he will not equalify his mates in the field or lose his job But, when it comes to security concerns every developer or organization shall not relay on the AI code generated because it really can cause massive damages or manipulations on their business logic or lose thousands of dollars The screenshots here is showing a real case found on the wild (my own security researchs) where the developer stored AES Encryption Keys in different places in the code without obfuscation which are responsible to encrypt and decrypt sensitive information like PIN used to unlock users' wallets and other storage that shall be secure by encryption algorithms but unfortunately the keys are exposed Usually when I see emojis inside a code (like ✅ and ❌❎) I understand it was written by AI or this code wasn't written by a professional developer so I start my investigations from that point @reverseengineer101

SaveAny-Bot 🗃️ Save Any Telegram File to Anywhere 📂 (Alist, Disk, Webdav, S3, Rclone...) . Support restrict saving content and files beyond telegram.

🎯 Features 1- Support documents / videos / photos / stickers… and even Telegraph 2- Bypass "restrict saving content" media 3- Batch download 4- Streaming transfer 5- Multi-user support 6- Auto organize files based on storage rules 7- Watch specified chats and auto-save messages, with filters 8- Transfer files between different storage backends 9- Integrate with yt-dlp to download and save media from 1000+ websites 10- Aria2 integration to download files from URLs/magnets and save to storages 11- Write JS parser plugins to save files from almost any website 12- Storage backends: - Alist - S3 - WebDAV - Local filesystem - Rclone (via command line) - Telegram (re-upload to specified chats)

https://github.com/krau/SaveAny-Bot Shared by @reverseengineer101

Happy to say that I have won 🎉 🥳 My write-up came as the second best write-up Check the post comments on X https://x.com/i/status/2026660723707855146 Check all the write-ups here (mine is the 5th) https://bugology.intigriti.io/intigriti-monthly-challenges/0226 @reverseengineer101

Now The Challenge Is Finished ! 🔥 You Can Watch The Full Walkthrough Video on YouTube https://youtu.be/fDLTvOayNEk Or You Can Read The Writeup On Medium https://medium.com/@mohamedabozaid961/intigriti-challenge-0226-write-up-dbf9146dc1f4 #CTF #Cybersecurity #intigriti @reverseengineer101

Intigriti Challenge 0226 CTF solved ✓ The write up will be disclosed ASAP the challenge finishes 🏁 @reverseengineer101

Ramadan Kaream all ❤️

a Threat Actor called "quellostanco" claims that he has stolen a full EgyptAir database. The database mentioned has 104K records related to HR section including sensitive employees data as he say @reverseengineer101

I have hit one of the dangerous mistakes a Developer can do As you see here the API is rejecting all the requests without Authorization header but after adding a fake one it returns the data This vulnerability is classified as BFLA/BOLA API1:2023 (Broken Function/Object Level Authorization) or a Broken Access Control (BAC) issue at all You can read more about it on OWASP API Top 10 API1:2023 Broken Object Level Authorization #API_Security @reverseengineer101

New Critical WhatsApp Vulnerability Immediately stop WhatsApp automatic media download, Google wars users that their devices can be hacked through WhatsApp with a 0-click Vulnerability discovered in WhatsApp Resources: Forbes: https://www.forbes.com/sites/zakdoffman/2026/01/26/google-issues-whatsapp-attack-warning-for-all-android-users/ Malwarebytes: https://www.malwarebytes.com/blog/news/2026/01/a-whatsapp-bug-lets-malicious-media-files-spread-through-group-chats @reverseengineer101

Chinese hackers have hacked American Telecommunications Companies In a process called Salt Typhoon, Chinese Hackers has intercepted some calls and compromised millions of metadata records after hacking the American Telecommunications Companies from 2 years before now unnoticed which make it one of the biggest security flaws have occurred. Experts say it's mostly sponsored by the Chinese Government for spying and politics related reasons Salt Typhoon Hacks of Telecommunications Companies and Federal Response Implications (American Congress) @reverseengineer101

Microsoft Windows and Privacy 🔏 🫤 https://youtube.com/shorts/eJ28htLZxvA

BITNET an AI model can run locally introduced by Microsoft and it can run with limited resources (cpu, ram,...) people say you can run it using your old PC https://github.com/microsoft/BitNet Shared by @reverseengineer101

HackerAI is now available on Mac, Linux, and Windows. hackerai.co/download Github https://github.com/hackerai-tech/hackerai Shared by @reverseengineer101

Well thank you ❤️

This must be a joke 😂 How to say our app can be a Trojan without saying 😁 Anyway that is why I always advise you not to install anything on your device I don't have any personal issues with the app manufacture, but I had say my opinion from a security perspective #stay_safe_stay_secure @reverseengineer101

Claude AI is down After what we saw from cloudflare at the end of 2025 will Claude be the same 😂 As some people say DaaS (Downtime As A Service) Be updated on https://status.claude.com/

The Proof of Concept (PoC) https://github.com/g0vguy/Telegram_1-Click_Vulnerability Thanks for RHine for sharing ❤️

Be careful ! about what you are clicking these days Don't click any usernames from untrusted sources because one click can expose your IP address to the attackers servers via a fake proxy initialized before by the attacker Shared from https://www.facebook.com/Sir.MaTrix @reverseengineer101

Well Discord seems to be banned in Egypt 🇪🇬 Unfortunately as everything has a good side it has a bad one as well 😔 https://eg.downdetector.com/status/discord/