Doing security research. For fun and profit...https://bsky.app/profile/yu5k3.bsky.socialhttps://bsky.app/profile/yu5k3.bsky.social/post/3m6k4lokjbs2sBet you haven't seen a hacker aka bug hunter in a tailcoat in your feed. Now you have 😜 I disappeared a bit in the last few months because of a lot of urgent stuff to close. 1/x26 Nov 2025 14:59 +0000at://did:plc:qq3avcx6txafxkhgncoxqwol/app.bsky.feed.post/3m6k4lokjbs2shttps://bsky.app/profile/yu5k3.bsky.social/post/3lumqwxe5rk2c🌊 2025 YTD #BugBounty stats update, June: 📄 13 issues Reported (5 Crit, 2 High, 6 Medium) 💰 10 issues Paid ⚪ 1 Informative Late update this time, just came back from vacation and started digging for new targets to research. I've had my eye on browser extensions for a while. [contains quote post or other embedded content]23 Jul 2025 09:56 +0000at://did:plc:qq3avcx6txafxkhgncoxqwol/app.bsky.feed.post/3lumqwxe5rk2chttps://bsky.app/profile/yu5k3.bsky.social/post/3lrddkzwkzc2n🤓 2025 YTD #BugBounty stats update, May: 📄 11 issues Reported (4 Crit, 2 High, 5 Medium) 💰 9 issues Paid A new month means 2 more RCEs reported 👌 This time I hit Chromium headless browser for the first time in BBPs. [contains quote post or other embedded content]11 Jun 2025 11:47 +0000at://did:plc:qq3avcx6txafxkhgncoxqwol/app.bsky.feed.post/3lrddkzwkzc2nhttps://bsky.app/profile/yu5k3.bsky.social/post/3lp27yku5ms2l👌 2025 YTD #BugBounty stats update, April: 📄 9 issues Reported (2 Crit, 2 High, 5 Medium) 💰 8 issues Paid Switched to monthly updates instead of weekly. Why? I don't drop new vulns every week 😅 My stats from the last months confirm my "capacity": ~2 RCEs per month. [contains quote post or other embedded content]13 May 2025 09:59 +0000at://did:plc:qq3avcx6txafxkhgncoxqwol/app.bsky.feed.post/3lp27yku5ms2lhttps://bsky.app/profile/yu5k3.bsky.social/post/3lom4hv6roc2gJust noticed @elastic.co shipped a bunch of CVEs for the 0-days I reported. Threading them here for memory and tipping my hat to the Elastic Security Team ❤️ top-tier BBP and meticulous triage. Highly recommended for Bug Hunters 😎 #bugbounty #0day #rce07 May 2025 19:19 +0000at://did:plc:qq3avcx6txafxkhgncoxqwol/app.bsky.feed.post/3lom4hv6roc2ghttps://bsky.app/profile/yu5k3.bsky.social/post/3llu2ke3wfc2c🫡 2025 YTD #BugBounty stats update, March: 📄 7 issues Reported (2 Crit, 1 High, 4 Medium) 💰 2 issues Paid Reported 2 RCEs and some "collateral damage" for March. Still investigating new targets and developing my own tools. [contains quote post or other embedded content]02 Apr 2025 18:50 +0000at://did:plc:qq3avcx6txafxkhgncoxqwol/app.bsky.feed.post/3llu2ke3wfc2chttps://bsky.app/profile/yu5k3.bsky.social/post/3liyqivte722i😵‍💫 2025 YTD #BugBounty stats update, Week 8: 📄 2 issues Reported (1 Crit, 1 Medium) As you can see, the stats became even worse this week 😆 One RCE got classified as Medium for the first time in my life 🤯 Trying to negotiate and explain its impact, let's see how it goes... [contains quote post or other embedded content]25 Feb 2025 11:18 +0000at://did:plc:qq3avcx6txafxkhgncoxqwol/app.bsky.feed.post/3liyqivte722ihttps://bsky.app/profile/yu5k3.bsky.social/post/3lifbf6ybd224😐 2025 YTD #BugBounty stats update, Weeks 6-7: 📄 2 issues Reported (2 Crit) Reported 2 RCEs and sticking to my plan of focusing on Criticals. Not too much for two weeks, but chaining vulns takes more time than expected. [contains quote post or other embedded content]17 Feb 2025 17:27 +0000at://did:plc:qq3avcx6txafxkhgncoxqwol/app.bsky.feed.post/3lifbf6ybd224https://bsky.app/profile/yu5k3.bsky.social/post/3lhjyibwhzk22🚀 2025 YTD #BugBounty stats update, Week 5: 📄 0 issues Reported I took the last days of my parental leave in Jan and spent most of the time with kids and family. No reports, no vulns, just quality time 👨‍👩‍👧‍👦06 Feb 2025 21:06 +0000at://did:plc:qq3avcx6txafxkhgncoxqwol/app.bsky.feed.post/3lhjyibwhzk22https://bsky.app/profile/yu5k3.bsky.social/post/3lfsjfb2v4c2tNow's the time to vote for the Top 10 Web Hacking Techniques of 2024! I'm excited to see my research "Exploiting the Unexploitable Insights from the Kibana Bug Bounty" nominated this year! 😎 [contains quote post or other embedded content]15 Jan 2025 19:39 +0000at://did:plc:qq3avcx6txafxkhgncoxqwol/app.bsky.feed.post/3lfsjfb2v4c2thttps://bsky.app/profile/yu5k3.bsky.social/post/3lecvr6ggks2o🎄 2024 YTD #BugBounty stats update, Week 51: 📄 12 issues Reported (5 Crit, 3 High, 4 Medium) 💰 4 issues Paid ⚪ 1 Informational 🔴 1 OOS Reported Prompt Injection, so I'm in the club now, bro 😎 [contains quote post or other embedded content]27 Dec 2024 21:13 +0000at://did:plc:qq3avcx6txafxkhgncoxqwol/app.bsky.feed.post/3lecvr6ggks2ohttps://bsky.app/profile/yu5k3.bsky.social/post/3ldg7am3qic2r🫡 2024 YTD #BugBounty stats update, Week 50: 📄 11 issues Reported (5 Crit, 3 High, 3 Medium) 💰 4 issues Paid ⚪ 1 Informational 🔴 1 OOS Keeping my promise to report something every week, even if it's not super critical or exciting. [contains quote post or other embedded content]16 Dec 2024 11:15 +0000at://did:plc:qq3avcx6txafxkhgncoxqwol/app.bsky.feed.post/3ldg7am3qic2rhttps://bsky.app/profile/yu5k3.bsky.social/post/3lczpisjnik2v✌️ Bug Bounty Tip: If you don't have time to watch the full video, just check out this slide! If you find a very restricted Prototype Pollution where you can only add empty objects or arrays to the prototype, but the gadget requires properties with payloads.. #bugbounty #bugbountytips #bugbountytip [contains quote post or other embedded content]11 Dec 2024 12:02 +0000at://did:plc:qq3avcx6txafxkhgncoxqwol/app.bsky.feed.post/3lczpisjnik2vhttps://bsky.app/profile/yu5k3.bsky.social/post/3lcuj3kjyak2x🤒 2024 YTD #BugBounty stats update, Week 48-49: 📄 9 issues Reported (5 Crit, 3 High, 1 Medium) 💰 4 issues Paid ⚪ 1 Informational 🔴 1 OOS me: Starting full-time BB 😎💻✨ Universe: Here, have the flu and a fever for a week 😜 me: Cool... not quite the "hot start" I had in mind 🥲 [contains quote post or other embedded content]09 Dec 2024 10:23 +0000at://did:plc:qq3avcx6txafxkhgncoxqwol/app.bsky.feed.post/3lcuj3kjyak2xhttps://bsky.app/profile/yu5k3.bsky.social/post/3lcg6pedo4s2sDevelopers: “Finally…” Bug Hunters: “We had a good run, old friend!” [contains quote post or other embedded content]03 Dec 2024 17:40 +0000at://did:plc:qq3avcx6txafxkhgncoxqwol/app.bsky.feed.post/3lcg6pedo4s2shttps://bsky.app/profile/yu5k3.bsky.social/post/3lbw7atit322oIf you missed it, my #DEFCON talk "Exploiting the Unexploitable: Insights from the Kibana Bug Bounty" is now live on YouTube! youtu.be/H-bhmSwnRdY https://youtu.be/H-bhmSwnRdY27 Nov 2024 09:08 +0000at://did:plc:qq3avcx6txafxkhgncoxqwol/app.bsky.feed.post/3lbw7atit322ohttps://bsky.app/profile/yu5k3.bsky.social/post/3lbrrosntqs24🫡 2024 YTD #BugBounty stats update: 📄 7 issues Reported (4 Crit, 2 High, 1 Medium) 💰 4 issues Paid ⚪ 1 Informational 🔴 1 OOS25 Nov 2024 14:54 +0000at://did:plc:qq3avcx6txafxkhgncoxqwol/app.bsky.feed.post/3lbrrosntqs24https://bsky.app/profile/yu5k3.bsky.social/post/3lbk5otajhk24Most common question for freshly defended PhDs: What's next? Honestly... I'd love to know too! God, give me a sign! God: Your defense will be in room 1337. me: Say no more. I shall become a Bug Hunter! Full-time Bug Hunter! God: 😳22 Nov 2024 14:08 +0000at://did:plc:qq3avcx6txafxkhgncoxqwol/app.bsky.feed.post/3lbk5otajhk24https://bsky.app/profile/yu5k3.bsky.social/post/3lbhvyxuslk2a🎓 Major November Update: I successfully defended my Ph.D. thesis, "Code-Reuse Attacks in Managed Programming Languages and Runtimes"! 📖 Full text: https://github.com/yuske/PhD_Thesis/blob/main/Mikhail_Shcherbakov_PhD_Thesis.pdf Check it out if you're interested in attacks based on Prototype Pollutions, Object Injection Vulnerabilities, and want to...21 Nov 2024 16:45 +0000at://did:plc:qq3avcx6txafxkhgncoxqwol/app.bsky.feed.post/3lbhvyxuslk2a