@bdsecure

vulnerability researcher | full-time learner

 Vienna, Austria
ninjas.zip
Joined June 2017
  • Tweets918
  • Following5.3K
  • Followers855
32Media
Behnam retweeted
Hexacon@hexacon_frOct 17
Tonight's event is canceled due to the protests taking place just outside the bar. We are really sorry to end the event this way, but it's safer for everyone
1
9
6
135
19,697
Behnam retweeted
TrendAI Zero Day Initiative
@thezdiOct 16
We’re happy to return as a sponsor for @hexacon_fr. ZDI’s @MaliciousInput and @hosselot are in attendance and are always up for a good chat (if you can find them)
1
25
6,158
Behnam retweeted
Calif
@calif_ioOct 16
Demos we presented at Hexacon in Paris today. Everything will be released in due time. 1/ Signal 1-click
152
532
108
4,548
580,126
🔥 The first Three Buddy Problem from Offensive AI Con is live! Audio only. IBM X-Force’s Valentina Palmiotti (@chompie1337) walks us through the autonomous Windows kernel exploit pipeline she built on older Claude models, which landed within a hair of Mythos for about $180 a chain. Plus, the Pwn2Own bug Claude called unexploitable, why her Pwn2Own bugs still sit unpatched, disappearing exploit techniques, the dread of being a defender, and how Phrack found its way back into print. open.spotify.com/episode/2wE…
3
39
3
168
11,118
BWA HA HA HA HA Samsung Pwned Pixel tomorrow :)
TrendAI Zero Day Initiative
@thezdiOct 7
1 bug wonder! With an Confused Deputy (CWE-441) bug Dimitrios Valsamaras (@Ch0pin), Ken Gannon / 伊藤 剣 (@yogehi) using Djini.ai from Mobile Hacking Lab, Tenia Valsamara (@ir3l14) from CENSUS Labs PwN'ed the Samsung Galaxy S26 #Pwn2Own
8
17
1
212
7,020
All vendors should have a plan for rapid remediation in the case of active exploitation. Here’s some emergency fix strategies we’ve seen over the years: projectzero.google/2026/10/e…

How to fix a bug in a fix

Project Zero often works with software vendors to remediate the vulnerabilities we report and pro...

projectzero.google
7
41
3
188
14,275
🍎🐛 I got Claude making this, maybe it's useful for others as well. Every Apple security advisory since 2002 - parsed, indexed, charted. With links to writeups, POCs and presentations. apple-cve.com/

APPLE·CVE — every Apple security advisory, indexed

Search, filter and chart every CVE in Apple's security release notes since 2002.

apple-cve.com
13
54
5
295
25,508
The official IDA MCP Server is here. It's free, open source, and works with any LLM. Your agent writes IDAPython, uses ~20% fewer tokens, and can share an IDB with you in real time. 𝚞𝚟𝚡 𝚒𝚍𝚊-𝚑𝚌𝚕𝚒 𝚖𝚌𝚙 𝚒𝚗𝚜𝚝𝚊𝚕𝚕 hex-rays.com/blog/hex-rays-i… (copy-paste: uvx ida-hcli mcp install)
33
219
16
1,414
144,306
To find a $113,337 Linux kernel bug may be regarded as a fortune. To have your Cisco RCE silently patched the next day looks like the universe is trolling you specifically. Two blog posts today. 🧵
3
29
212
17,920
Enjoy folks.
watchTowr
@watchtowrcyberSep 23
F5, BIG-IP, a 20-year-old primitive, a security appliance, an "authentication" mechanism - and a CISA promise ring. Yes, it's CVE-2026-94127. Give us strength. Speak soon xo labs.watchtowr.com/is-this-a…

Is This A Joke? In The Auth Header? (F5 BIG-IP UnAuth Heap-Overflow to RCE CVE-2026-94127)

Well, well, well, well, well, well, well, well, well, well, well, well, well, well, well. We're back. Sorry. We've been watching the onslaught of vulnerabilities flood the internet. Every man, dog,...

labs.watchtowr.com
2
30
2
298
40,144
I finally got around to the writeup for my 2nd $20,000 bounty from @Apple here: github.com/petermalone/CVE-2… @gergely_kalman I know you had specifically asked for this so here you go. I learned so much playing around with this. I'll document the first later this week. Enjoy! Thanks again to @Apple - the bounty announcement took just 11 days for this one. Crazy.

GitHub - petermalone/CVE-2026-84543: Technical disclosure and PoC for CVE-2026-84543, a macOS SMB...

Technical disclosure and PoC for CVE-2026-84543, a macOS SMB kernel vulnerability - petermalone/CVE-2026-84543

github.com
slinafirinne
@slinafirinneMay 15
Thanks again Apple for another accelerated bug bounty payment. 🎯🎯
6
51
528
31,186
I'm hiring an exceptional Offensive Security Researcher for my team at NVIDIA (Offensive Security Research - OSR). Firmware, microcode, RISC-V, hypervisors, and shipping mitigations like HW CFI, Memory Tagging, and Pointer Masking from the ground up. jobs.nvidia.com/careers?quer…

Careers at NVIDIA Corporation

Jr2026488 jobs in NVIDIA Corporation

jobs.nvidia.com
11
84
7
468
45,820
In July, Microsoft fixed CVE-2026-50343, a Windows privilege escalation bug reported by Calif and 9 others, dubbed “Dark Elevator”. But was it really fixed? Ask @tiraniddo projectzero.google/2026/09/w…

Windows Exploitation Techniques: Dangling COM Object Registrations

This short blog post is about abusing a privilege escalation bug that Microsoft recently fixed in...

projectzero.google
3
46
2
214
17,409
iOS 27 App Sandbox Escape Photos... App Containers Submitted as a low impact bug a few days ago, but after a closer review today escalated it to an app sandbox escape
21
59
2
654
69,413
Behnam retweeted
johnny
@0xjohnnySep 14
To celebrate iOS 27’s release, why not release a sandbox escape? Announcing airlift: a PoC abusing a media sync path for out-of-scope access across much of /var/mobile via macOS↔iOS pairing. No MobileGestalt edits yet; looking into it. github.com/0xjohnnydev/airli…

GitHub - 0xjohnnydev/airlift: AirLift — paired-Mac AirTraffic/ATAirlock sandbox escape for iOS 27.0

AirLift — paired-Mac AirTraffic/ATAirlock sandbox escape for iOS 27.0 - 0xjohnnydev/airlift

github.com
8
127
9
953
85,926
Behnam retweeted
matteyeux@matteyeuxSep 13
Debug iBoot for studio display running in QEMU
3
9
138
7,117
Behnam retweeted
Hexacon@hexacon_frSep 11
The wait is over! 🚀 The talks for Hexacon 2026 are officially out, and the lineup is absolute fire 🔥 hexacon.fr/conference/speake…

Hexacon - Conference – Speakers

Discover the accepted talks for this edition!

hexacon.fr
2
23
5
53
17,565
Last month at Black Hat I sat through a cool talk by Natalie Silvanovich (@natashenka) and Ivan Fratric (@ifsecure) from Google Project Zero. Did anyone else catch it? At a high level, they walked everyone through the bug they found in the Dolby Unified Decoder and how they proceeded to turn it into a 0-click exploit chain on a Pixel 9 and 10. What I very much appreciated was how they shared insights and details about the various interactions between team members as they went through the process of trying to build a working exploit for the bug. It was actually really cool (and helpful) to get a “peek behind the curtain” and I wish more talks did this. Highly recommend checking out this talk when the video drops. Until then though, you can read the blog post here: projectzero.google/2026/01/p…

A 0-click exploit chain for the Pixel 9 Part 1: Decoding Dolby

Over the past few years, several AI-powered features have been added to mobile phones that allow ...

projectzero.google
5
44
2,807
Today, Project Zero is releasing MAccConc, a tool by @tehjh that enables deterministic testing of race conditions on Linux. It can be used for fuzzing, ad-hoc exploration, regression tests and more! projectzero.google/2026/09/m…

Testing race conditions with memory access tracing and stack-based delay injection

Many security bugs are race conditions, where multi-threaded execution has to occur with the righ...

projectzero.google
4
114
4
448
40,470
Project Zero is hiring! google.com/about/careers/app… Please share with anyone you think would be great for the role. DMs are open for questions.

Staff Security Engineer, Security Research

Our Security team works to create and maintain the safest operating environment for Google's users and developers. Security Engineers work with network equipment and actively monitor our systems for...

google.com
10
106
5
573
60,994
Load more