
Explorer of weird machines. Founder/CEO @bynar_io Prev: Immunity Inc
Joined July 2011
- Tweets144
- Following124
- Followers243
- Likes174
Here's what happened last month at Bynario:
- @daisyydaisy_ joined us 👀
- Company retreat in beautiful Franciacorta, Italy 🇮🇹
- 12 new vulns disclosed (CVE-2026-80795, CVE-2026-80794, CVE-2026-91945, ...) 😮💨
Find more information about our disclosures here bynar.io/disclosures
Alfredo Pesoli retweeted
Time to take a twitter break again for a few hours and do useful work.
Please, can we stop assuming AI will not be subject to 2nd law of thermodynamics, cost of information acquisition, noisy channels, measurement errors, etc. etc. etc.
Alfredo Pesoli retweeted
MURIÓ ANDRÉS BLANCO, REFERENTE DEL HACKING ARGENTINO
Tenía 44 años y era especialista en seguridad de redes Wi-Fi. Trabajó en Core Security y presentó investigaciones en conferencias internacionales como DEF CON y Black Hat. Además, descubrió vulnerabilidades en chips utilizados por Apple, Samsung y Motorola.
También tuvo una fuerte participación en Ekoparty, donde presentó trabajos y preparó desafíos para enseñar seguridad informática. Colegas, amigos y alumnos lo recordaron como un mentor generoso y destacaron su disposición para compartir conocimientos.
Los mensajes de despedida
“Hay gente a la que 'grande' le queda chico, Andrés era de esos. Tenía un corazón abierto, con ganas de enseñar, acompañar y por sobre todo ayudarte a ser tu mejor versión” — Federico Kirschbaum.
“Nuestra comunidad perdió un hacker con todas las letras, de los que la curiosidad y la capacidad hacen que quienes lo rodean crezcan y aprendan con él” — Ezequiel Gutesman.
“Nos enseñaste a defendernos. Nos enseñaste puntualidad. Nos enseñaste a perder muchos miedos. Confiaste en nosotros y en lo que éramos capaces, tanto en lo personal como en lo profesional” — Joel Noguera y Florencia Ortelli.
“Fue un gran mentor en lo profesional, un hacker puro y duro, hecho a los cachetazos, que supo dar charlas extremadamente técnicas en los mejores escenarios del mundo” — Lautaro “LeFF” Fain.
(+) en Clarín: clar.in/4y4bJBu
Alfredo Pesoli retweeted
Muy lindo artículo para honrar a Andrés Blanco:
clarin.com/tecnologia/murio-…
#qepd
You will be deeply missed, Andrés. We lost an incredible human being, a great hacker, and a friend.
I will cherish your memory, and everything I learned from you. The stoicism lesson is a difficult one at the moment.
Che la terra ti sia lieve, Andrés
Tengo la triste noticia que Andrés Blanco @6e726d falleció el día de hoy. Se nos fue un gran hacker, amigo y mentor. Memento mori solía decirme, Memento Mori.
QEDP
If you were curious about the FreeRDP pre-auth RCE, @sam4k1 did an incredibile job in documenting the entire chain here
Check out @sam4k1's latest write-up: a technical deep dive on how three vulnerabilities we reported in FreeRDP can be used to achieve pre-auth RCE by popping a remote shell with some old school memory corruption shenanigans 🐧
bynar.io/blog/linux-has-scre…
Following our recent screensharingd disclosure, a separate pre-auth issue has also been highlighted; fortunately, it's also patched!
You can find the technical details for our bug on our blog, essentially it uses the RFB Security Type 2 (VNC Authentication) which requires legacy VNC password access to be enabled. This in contrast to the pre-auth vulnerability which uses a separate authentication path, likely patched by one of the other screensharingd fixes in 26.6.
As we've stated from day one, our vulnerability discovery and validation solutions at @bynar_io are autonomous.
We use this capability to automate our internal research, at scale, on a variety of systems and targets, as a small team.
Our goal is pretty simple: find genuine security issues and get them fixed.
We're all passionate about security research, but as a small team, and with over 50 bugs in the queue that need to be reviewed and submitted, we don't always get to spend as much time as we'd like on each surface. Instead, once we've determined something's a genuine security issue, our priority is getting it fixed.
It's certainly not a flawless approach, but it aligns with our mission and for us beats sitting on bugs while users remain vulnerable.
Apple patched an incredible number of bugs in this July release (26.6). We like our CVEs served with a side of PoC, especially those that provide a shell and not just a crash.
We believe this one is of particular interest because, well, it gives you a root remote shell on the latest Apple M5!
That's right, a root remote command exec in macOS, in 2026?! Well, before anyone gets too excited: it's post-auth, and legacy VNC is disabled by default. But when it's enabled and you have the VNC password... root from remote 🤓
For some reason its description and severity were _slighty_ understated, but we demonstrate two bugs that lead to root RCE... No MIE/PAC bypass necessary, these are logic bugs.
This is CVE-2026-43760, found by @__rev with Bynario Atlas and GPT 5.5.
bynar.io/blog/a-root-remote-…
My team is hiring! 🙌 Check out the link below for more details, feel free to ping me if you have any Qs :)
We're hiring a vulnerability researcher! If you're interested in working at the intersection of security research & AI, check out the role below or reach out to @sam4k1 if you have any questions.
wellfound.com/jobs/4424689-v…
Alfredo Pesoli retweeted
Discovery & Validation in the Linux Kernel
Three-part article by @sam4k1 about analyzing two vulnerabilities (in CAN sockets and FUSE) and attempting to use local LLMs to rediscover the bugs.
Final part: bynar.io/blog/discovery-vali…
We got curious about those kernel bugs we found last month and decided to test them on sub-70B local models (qwen/gemma). Same context the original model (Opus 4.6) that found the bug used and pointed them at the subsystems. Fancy graphs included.
To wrap-up the series, @sam4k1 puts local models running on a Mac Studio head-to-head with Opus 4.6 on the kernel bugs, CVE-2026-31532 & CVE-2026-31694, from parts 1 & 2.
bynar.io/blog/discovery-vali…
Alfredo Pesoli retweeted
Here's the PoC for Nginx CVE-2026-42945 which works against vanilla Ubuntu (and any other distro?) + Nginx with ASLR enabled. I have included all iterations of the PoC the LLM was kicked to improve.
TL;DR: We can use an LFI/file-read primitive to leak enough details from /proc//mem to bypass ASLR and achieve reliable RCE, in most cases at first shot.
There are still other ways to make it work, with even less subtle primitives. If you ask Geppetto nicely, he will help you ;)
github.com/Hamid-K/nginx-rif…
Continuing the series: @sam4k1 digs into CVE-2026-31694, a page cache overflow in the kernel's FUSE subsystem that our pipeline surfaced and validated with an LPE on Ubuntu 26.04 using Opus 4.6.
bynar.io/blog/discovery-vali…
In the first of a three-part series, @sam4k1 does a technical deep dive on CVE-2026-31532: a race condition in the Linux kernel's SocketCAN subsystem discovered, validated, and patched by our pipeline.
bynar.io/blog/discovery-vali…
So happy to welcome @sam4k1!
I worked with Sam during my final years at Immunity. Just a few weeks after joining, he found a remote stack overflow in the Linux kernel.
Plenty of (pre-AI ;)) bugs later, I am thrilled to see him join @bynar_io.
He’s cooking already ;)
We're excited to welcome @sam4k1 as Head of Vulnerability Research.
With AI reshaping the cybersecurity landscape, our focus is making sure defensive capabilities keep pace - without getting lost in noise.
At Bynario, our goal is to combine autonomous approaches with domain expertise, reducing the gap between discovery and remediation.
The goal is simple: less guessing, more fixing.
Great to have Sam onboard!
Link to our blog below:
Defense needs to scale, we are building that.
Everyone is talking about Mythos, we were already finding vulnerabilities in one of the most complex closed software ecosystems out there - last year.
Proud to be building this with @lcavallaro and the rest of the team!
We launched Bynario in Nov. 2025, an AI system designed to:
- Analyze software at the binary level and surface unknown vulnerabilities
- Anticipate and validate risk before exploitation
- Bring true prevention into production environments
We validated our solution last August when we identified and reported 7 vulnerabilities in macOS, iOS, and iPadOS.
Our goal is to restore trust and control over the software you run, here's why:













