Embedded device security researcher / VR / Pwn2Own
Joined September 2018
- Tweets1.6K
- Following818
- Followers1.3K
- Likes6.7K
Pinned Tweet
The story of how I almost pwned the Lexmark Postscript stack for Pwn2Own 2025... And I would have gotten away with it too, if it hadn't been for those meddling firmware updates!
boredpentester.com/pwn2own-2…
Josh retweeted
Name another conference where the main stage turns into a rock concert during lunch break. 🤘 Only at #TheSAS2026! 🔥
Proctored / offline might be the only way🤞#theSAS2026
Watch these brilliant people breaking a system without Googling a single thing.
No internet, no shortcuts. Just skill and increasingly personal relationships with the debugger.
That’s why this offline #CTF might be our favorite attraction at #TheSAS2026.
A few from Bali ahead of speaking at #theSAS2026 on attacking IVIs over Bluetooth later this week 🪲🔥
One of mine and my team (once they update/correct the credits)🔥. You may want to patch 👀
We have issued immediate guidance for CVE-2026-107406 in NetScaler ADC and NetScaler Gateway: bit.ly/4rWRBz4
We strongly urge affected customers to review the advisory and upgrade impacted NetScaler instances to the recommended versions as soon as possible.
Josh retweeted
I work with cool people 🔥 @boredpentester
Exploit Confirmed! @BoredPentester successfully exploited Lexmark CX532adwe in the Printers category with 1 collision and 2 zero-days for a net total of $4250 and 1.25 Master of Pwn points #Pwn2Own
Josh retweeted
Exploit Confirmed! @BoredPentester successfully exploited Lexmark CX532adwe in the Printers category with 1 collision and 2 zero-days for a net total of $4250 and 1.25 Master of Pwn points #Pwn2Own
Josh retweeted
Very impressive that this is a memory corruption issue.
BTW I'm curious about the bounty. We've got a wormable RCE in a similar APP with hundreds of millions of users, and their SRC's bounty is like ~$500 for that 🤡
Today we published WeWorm, the first zero-click worm to spread through WeChat calls across iOS and Android.
We call you on WeChat and, without you answering or doing anything, take over your account within seconds. Then we use your phone to call your friends.
Story and demos: calif.io/research/weworm
Josh retweeted
We received an overwhelming number of amazing proposals for @TheSAScon this year, which made choosing the talks really hard. But we’re excited to announce the first batch and honestly, it might be our best lineup yet! 🔥 Get your tickets while you can!
Josh retweeted
So .. when doing 0-day exploitation with LLM, it's kind of tough. You can clearly see that one 0-day works fine for one device, but fails for the other, even with the same DA Loader and same chipset. That clearly shows the current issue with LLM, it works around a problem, it doesn't solve a problem yet.
Yeah ima need two of these
yo. anyone else tired of the murky UX of GNU screen and other terminal multiplexers I won't call out here!? so were me and my boy Claudio!
so we sat down for a week and reward-hacked and dogfed a new terminal multiplexer into existence: slosh
I am standing on the shoulders of giants of course; massive shoutout to @mitchellh and the rest of the contributors of libghostty-vt!
below you will find a small preview teaser for slosh I recorded the other day. slosh makes the mouse a first-class citizen again and introduces the concept of terminal "shaders". these shaders can be applied to the chrome or the contents of a terminal pane. and you can (ab)use them for all sorts of useful things: dimming inactive panes, drawing attention to panes that got a BEL, visualizing scrollback with fades, and many other interesting things.
I have battle-tested it a fair bit, and the full development/clank seshes were streamed on sl0p dot foo. if there's enough interest, I will carry on, start properly packaging it, and try to be a good maintainer for this new toy.
so just to be clear; everything you see in the video is rendered inside of a single "native" (somewhat modern) terminal. you can `ssh` into a box, `slosh` to attach/spawn and get this experience.
there's more cool stuff not demo'd in the video! random example: responsive layouts. if your terminal window becomes too narrow it'll start rendering the pane grids as a single "stack" instead. so managing your slosh working env from an iPhone (example) becomes chill. (also expands to original grid layout again once terminal grows again, etc.)
RT for reach would be welcome! 🙏
P.S. soundtrack has been composed by `tristan` from Kakiarts, and is featured in their 64KiB demo "Vortex 2" :)
Trust @rdjgr to successfully nerd snipe me down the AoE2 obfuscation rabbit hole. Awesome work 👏👏
Josh retweeted
As far as we can tell, no. There is only anecdotal evidence, along with claims from AI pentesting vendors.
If a strong model can do everything by itself, then what exactly have these vendors been building? It is understandable that people would prefer a story in which the harness, workflow, and surrounding infra matter a great deal. It's also why people keep flexing "0-days" in OpenSSL, FFmpeg, or nginx, despite limited real-world impact.
That said, Niels Provos was not trying to sell anything, and he and several people have reported good results with IronCurtain despite using relatively weak models.
Most importantly, what Google achieved with Chrome suggests that a good harness may be quite valuable. Google does not appear to have access to anything more capable than Mythos, which means they likely scanned Chrome using Mythos itself or something less powerful. Yet they still uncovered hundreds of bugs.
There is, however, another explanation. Google may simply have better Chrome/V8 experts who can extract more value from Mythos. This remains our preferred hypothesis.
What provides a real advantage: domain knowledge accumulated over many years, or a harness vibe-coded in an afternoon? We think the answer is fairly obvious.
