Hacker. Founder. Advisor. Researcher. Ex CTO@MindedSec. I love lateral thinking.

Florence
Joined January 2010
Stefano Di Paola retweeted
One tap was enough to bypass a Chrome for iOS security check. We found a way to use shortcuts to reach tel: or facetime: without Chrome applying its normal user-interaction checks to the final URL. The issue, CVE-2026-13795, has been fixed. Details 👇 blog.doyensec.com/2026/09/24… #appsec #doyensec #security #ios
🤖 Made with AI
5
6
20
1,435
Stefano Di Paola retweeted
New blog post! Extending Scapy for Hardware Reverse Engineering voidstarsec.com/blog/scapy-s… In this post we use Scapy to reconstruct a SPI flash image from a logic capture, with an introduction to QSPI!
1
58
229
11,050
Stefano Di Paola retweeted
Introducing Altar-1, our first open-weight security model. Frontier-grade defensive AI, built to deploy. Own your own security.
85
201
57
1,538
517,308
~ Personal news ~ I left TechCrunch. I will now focus on finishing my book about Hacking Team and the history of government spyware. After that, and in the meantime, I will be freelancing. Contact me: [email protected] or Signal @ LorenzoFB.1337 (+1 917 257 1382)
46
68
11
686
41,637
Stefano Di Paola retweeted
This is unpopular but correct. Modern bug bounty participants have gotten spoiled by super chill responses to CFAA violations (like this one) and the whole edifice is a house of cards. Wanna know why OpenAI asked for detailed logs? Google “Sullivan + Misprision of a Felony”
1/ Unpopular opinion: When you find a 0-day in a public service, you do RD (Responsible Disclosure), not LM (Lateral Movement). The GitHub PR in the @OpenAI repo was a bridge too far (IMHO)
12
17
3
161
88,270
I really can’t stand this fake "BREAKING/JUST IN" communication style on X. In particular in my "For you" feed. Most of the time the story is days old or even months, but people still slap urgency labels on it like newspaper hawkers. Just give the damn source date! </rant> :D
11
216
Stefano Di Paola retweeted
We escaped Docker's hypervisor with three lines of bash. CVE-2026-77179: A container gets complete read and write access to the host filesystem. When you mount a folder into a container, Docker's VMM uses virtio-fs, and the file server runs on the host. Because of a TOCTOU bug, if a container opens a file, deletes it while holding its file handle open, and replaces the parent folder with a symlink, the kernel will follow the symlink to anywhere on the host. Full technical breakdown: accomplish.ai/blog/escaping-…
Readers added context they thought people might want to know
This affects Docker Sandboxes on macOS and Docker Desktop only if the new Docker VMM (beta, not default) is enabled; it is a virtio-fs shared workspace symlink/TOCTOU issue, not a general container or hypervisor escape. docs.docker.com/security/secur… cve.org/CVERecord?id=C… docs.docker.com/ai/sandboxes/r…
26
158
27
1,280
100,309
Stefano Di Paola retweeted
A name that has shaped how the world connects is joining Hardwear.io Netherlands 2026. We’re pleased to welcome @Cisco as a Silver Sponsor. 📍 Amsterdam Marriott Hotel | 16–20 November 2026 Register now: hardwear.io/nl-2026/register… #HardwearNL2026 #SilverSponsor
1
2
412
Stefano Di Paola retweeted
Today we published WeWorm, our zero-click worm that spreads across iOS and Android. All it takes is one phone call. You don't have to answer. Seconds later, your WeChat account is compromised, calling your friends and spreading the attack. We reported the bug to Tencent, and it's now mitigated for all users. We hope this sets an example. The US and China disagree on plenty, but keeping billions of people safe online shouldn't be one of them. AI gives us a chance to find and fix these bugs faster than ever. We should work together to make the world safer for everyone. Our story and demos: calif.io/research/weworm
40
296
64
1,451
232,337
So, most mainstream LLMs down, means a single point of failure given by , I guess, a single data center provider going down? That’s what’s the world is actually standing on?
1
206
Once it was whatsapp/slack/ig/fb etc now it's openai or anthropic...go local anyone? 🙄
198
Stefano Di Paola retweeted
The interactive mode makes things easier if you are just looking for stuff.
1
6
29
3,698
Stefano Di Paola retweeted
The blog that hosted the 2011 to 2015 Top 10 Web Hacking Techniques lists is gone. So are hundreds of the articles those lists cite. I rebuilt all of it. Every nominee since 2006, all 1,136 of them, plus 351 more the nomination rounds missed. webhacklist.com
10
26
2
99
12,639
Stefano Di Paola retweeted
Unbelievably embarrassing for Google that Gemini hasn’t committed any cybercrimes yet
261
1,148
149
18,118
832,814
Stefano Di Paola retweeted
I was a PM on Google Books Know quite a bit about the history here Interesting to see it play out --- PS - if pubs and rightsholders hadn't been so anti-fair-use and gone scorched earth on lawsuits, might have been a less crazy outcome here but they went nuts so now anyone touching this data is being extremely conservative (Imagine a world where they could acquire the book, digitize it thoughtfully, then donate it to a rare book collection for public access etc! "Google Editions" could have enabled something like this)
🦔AI companies are bulk-buying rare books, scanning them through high-speed machines that cut the spines off, and shredding the originals. A service called ISBNdb facilitates orders of up to a million books and keeps buyers anonymous. Pre-2022 books are premium because they're free of AI-generated text. A federal judge ruled the practice is fair use because eliminating the original means only one copy exists at a time. Anthropic hired the former head of Google Books partnerships to obtain "all the books in the world." My Take This got to me. A bookseller told 404 Media that rare books with almost no surviving copies are being fed into this pipeline. Books that survived wars, fires, and centuries of handling are being shredded so an AI can learn to write a better marketing email. ISBNdb's website literally says "'AI company destroys two million books' is not a headline that generates sympathy," and they still built an entire business around making it happen quietly. They offer NDAs as a feature. They coach clients to call it "digital preservation." I've covered AI companies scraping the internet, torrenting libraries, and stealing music. This is worse because it's irreversible. You can re-upload a website. You can reprint a bestseller. You can't replace the last three copies of an 18th-century botanical text once someone shreds them for training data. And the judge said it's legal. So it's going to accelerate. "We shred rare books and offer NDAs so nobody finds out" is a legitimate business model in 2026. What a timeline. Hedgie🤗
70
137
32
1,238
112,103
I've always been fascinated by text adventures, and by Infocom games in particular, worlds made of words: parser, puzzles, humor, literature, and imagination. So I had this idea about Z-Babel: an AI layer that helps people play classic interactive fiction in a more natural way.
1
264
You can type or speak commands in your own language, and Z-Babel translates them into commands the original Z-machine interpreter understands. The game logic stays deterministic. AI only helps with language, translation, speech, and accessibility.
1
121
It's a BYOK project, so the only caveat is to have a google API Key. Made with AI, of course, but what isn't nowadays? ¯\_(ツ)_/¯ ;P Try it: wisec.github.io/z-babel/ Repo: github.com/wisec/z-babel/ IFFiles: github.com/BYU-PCCL/z-machin… Looking forward to your feedback.
97
Stefano Di Paola retweeted
I'm 33 and I think Claude Code is melting my brain. For 6 months straight I've had 5-6 terminals open at once, waiting on responses just to smash "enter" 90% of the time. That's the whole job now. And it's doing something to me. A few friends and I keep circling back to the same thing in conversations: none of us feel as sharp as we used to. Maybe it's just us. But I keep wondering how many other people in their 30s feel it too. (And yeah: this is a me problem, how I lean on the tool, not the tool itself. Doesn't make the effect any less real.)
Readers added context they thought people might want to know
This is directly plagiarised from a viral post from @astnkennedy, with the only change being the age. x.com/astnkennedy/st…
2,140
581
459
12,532
1,845,876