vulnerability researcher | full-time learner

Vienna, Austria
Joined June 2017
Behnam retweeted
Tonight's event is canceled due to the protests taking place just outside the bar. We are really sorry to end the event this way, but it's safer for everyone
1
9
6
135
19,668
We’re happy to return as a sponsor for @hexacon_fr. ZDI’s @MaliciousInput and @hosselot are in attendance and are always up for a good chat (if you can find them)
1
25
6,152
Behnam retweeted
Demos we presented at Hexacon in Paris today. Everything will be released in due time. 1/ Signal 1-click
151
531
108
4,542
579,096
🔥 The first Three Buddy Problem from Offensive AI Con is live! Audio only. IBM X-Force’s Valentina Palmiotti (@chompie1337) walks us through the autonomous Windows kernel exploit pipeline she built on older Claude models, which landed within a hair of Mythos for about $180 a chain. Plus, the Pwn2Own bug Claude called unexploitable, why her Pwn2Own bugs still sit unpatched, disappearing exploit techniques, the dread of being a defender, and how Phrack found its way back into print. open.spotify.com/episode/2wE…
3
39
3
169
11,115
BWA HA HA HA HA Samsung Pwned Pixel tomorrow :)
1 bug wonder! With an Confused Deputy (CWE-441) bug Dimitrios Valsamaras (@Ch0pin), Ken Gannon / 伊藤 剣 (@yogehi) using Djini.ai from Mobile Hacking Lab, Tenia Valsamara (@ir3l14) from CENSUS Labs PwN'ed the Samsung Galaxy S26 #Pwn2Own
8
17
1
212
7,018
All vendors should have a plan for rapid remediation in the case of active exploitation. Here’s some emergency fix strategies we’ve seen over the years: projectzero.google/2026/10/e…
7
41
3
188
14,274
🍎🐛 I got Claude making this, maybe it's useful for others as well. Every Apple security advisory since 2002 - parsed, indexed, charted. With links to writeups, POCs and presentations. apple-cve.com/
13
54
5
295
25,506
The official IDA MCP Server is here. It's free, open source, and works with any LLM. Your agent writes IDAPython, uses ~20% fewer tokens, and can share an IDB with you in real time. 𝚞𝚟𝚡 𝚒𝚍𝚊-𝚑𝚌𝚕𝚒 𝚖𝚌𝚙 𝚒𝚗𝚜𝚝𝚊𝚕𝚕 hex-rays.com/blog/hex-rays-i… (copy-paste: uvx ida-hcli mcp install)
33
220
16
1,415
144,303
To find a $113,337 Linux kernel bug may be regarded as a fortune. To have your Cisco RCE silently patched the next day looks like the universe is trolling you specifically. Two blog posts today. 🧵
3
29
212
17,914
I finally got around to the writeup for my 2nd $20,000 bounty from @Apple here: github.com/petermalone/CVE-2… @gergely_kalman I know you had specifically asked for this so here you go. I learned so much playing around with this. I'll document the first later this week. Enjoy! Thanks again to @Apple - the bounty announcement took just 11 days for this one. Crazy.
Thanks again Apple for another accelerated bug bounty payment. 🎯🎯
6
51
528
31,186
I'm hiring an exceptional Offensive Security Researcher for my team at NVIDIA (Offensive Security Research - OSR). Firmware, microcode, RISC-V, hypervisors, and shipping mitigations like HW CFI, Memory Tagging, and Pointer Masking from the ground up. jobs.nvidia.com/careers?quer…
11
84
7
468
45,820
In July, Microsoft fixed CVE-2026-50343, a Windows privilege escalation bug reported by Calif and 9 others, dubbed “Dark Elevator”. But was it really fixed? Ask @tiraniddo projectzero.google/2026/09/w…
3
46
2
214
17,409
iOS 27 App Sandbox Escape Photos... App Containers Submitted as a low impact bug a few days ago, but after a closer review today escalated it to an app sandbox escape
20
59
2
654
69,408
Behnam retweeted
To celebrate iOS 27’s release, why not release a sandbox escape? Announcing airlift: a PoC abusing a media sync path for out-of-scope access across much of /var/mobile via macOS↔iOS pairing. No MobileGestalt edits yet; looking into it. github.com/0xjohnnydev/airli…
8
127
9
952
85,894
Behnam retweeted
Debug iBoot for studio display running in QEMU
3
9
138
7,117
Behnam retweeted
The wait is over! 🚀 The talks for Hexacon 2026 are officially out, and the lineup is absolute fire 🔥 hexacon.fr/conference/speake…
2
23
5
53
17,561
Last month at Black Hat I sat through a cool talk by Natalie Silvanovich (@natashenka) and Ivan Fratric (@ifsecure) from Google Project Zero. Did anyone else catch it? At a high level, they walked everyone through the bug they found in the Dolby Unified Decoder and how they proceeded to turn it into a 0-click exploit chain on a Pixel 9 and 10. What I very much appreciated was how they shared insights and details about the various interactions between team members as they went through the process of trying to build a working exploit for the bug. It was actually really cool (and helpful) to get a “peek behind the curtain” and I wish more talks did this. Highly recommend checking out this talk when the video drops. Until then though, you can read the blog post here: projectzero.google/2026/01/p…
5
44
2,807
Today, Project Zero is releasing MAccConc, a tool by @tehjh that enables deterministic testing of race conditions on Linux. It can be used for fuzzing, ad-hoc exploration, regression tests and more! projectzero.google/2026/09/m…
4
114
4
448
40,470