cybrz retweeted
From an unauthenticated music add-on to root on the host. At #Pwn2Own Ireland 2025, our team chained their way through the Home Assistant Green and walked away with $20k. Emanuele shows the full chain, and how it nearly failed on stage. blog.compass-security.com/20…
#IoTSecurity
cybrz retweeted
Compass Security supports Graubündner Kantonalbank with a structured bug bounty program that enables responsible reporting of potential vulnerabilities within a defined framework.
bugbounty.compass-security.c…
#bugbounty #ethicalhacking #cybersecurity
cybrz retweeted
What’s for dessert? Root. 😈
After lunch at #BruCON0x12: Emanuele and @yves_bieri present Pwn the Hub, Own the Home
One vulnerable add-on → RCE → container escape → full Home Assistant compromise.
cybrz retweeted
How do you prepare a product for the Cyber Resilience Act? Our latest article covers #CRA scope, product classification, threat modelling, technical security testing, and why we use IEC 62443 as an assessment framework. Part I of a two part series: blog.compass-security.com/20…
cybrz retweeted
SSH everywhere, misconfigurations somewhere. Our new SSH Labs let you get your hands dirty: slides, video, and a Docker-based lab. Created by our Security Analyst @emanuelduss, learn how SSH breaks and how to fix it: blog.compass-security.com/20…
#SSH #InfoSec #Security
🤖 Made with AI
cybrz retweeted
Collision! Although successful on stage, Emanuele Barbeno, Cyrill Bannwart, Yves Bieri, Lukasz D., Urs Mueller (@compasssecurity) of Compass Security targeted Anthropic Claude Code, hitting a one-vulnerability collision with a previous attempt and earning $20,000 and 2 Master of Pwn points. #Pwn2Own #P2OBerlin
cybrz retweeted
Very nicely done! Emanuele Barbeno, Cyrill Bannwart, Yves Bieri, Lukasz D., Urs Mueller (@compasssecurity) of Compass Security were able to exploit Anthropic Claude Code! They're off to the disclosure room to explain how they did it. #Pwn2Own #P2OBerlin
cybrz retweeted
Confirmed! Cyrill Bannwart, Emanuele Barbeno, Yves Bieri, Lukasz D., Urs Mueller (@compasssecurity) of Compass Security exploited Cursor in the second round, earning $15,000 and 3 Master of Pwn points. Full win! #Pwn2Own #P2OBerlin
cybrz retweeted
That's a wrap on Day 2 of #Pwn2Own Berlin! Day Two added $385,750 and 15 unique 0-days, bringing event totals to $908,750 for 39 unique vulnerabilities. DEVCORE leads Master of Pwn with 40.5 points — but the fun ain't over yet, we've got one more day to go. See you tomorrow! #P2OBerlin
cybrz retweeted
Big W!! 💪 Emanuele Barbeno, Cyrill Bannwart, Yves Bieri, Lukasz D., Urs Mueller (@compasssecurity) of Compass Security were able to exploit OpenAI Codex! Off to the disclosure room to spill the tea. #Pwn2Own #P2OBerlin
cybrz retweeted
Compass vulnerability research identified code execution paths affecting AI coding assistants including @claudeai , @cursor_ai and @OpenAI #Codex. The findings will be demonstrated live at @thezdi Initiative #Pwn2Own Berlin 2026, May 14 to 16. #AIsecurity #LLM
🤖 Made with AI
People know I am all crazy about electricity and electronics. So, I am specially excited about the wall charger exploit and I must admit I am very tempted to try my luck on European models. Unfortunately, there is no vacation in sight yet 🤪. This is a huge achievement! Congratz!
2-for-2! 🏆 Huge shoutout to @yves_bieri and Lukasz for clean exploits on the Alpine iLX-F511 and Grizzl-E Smart 40A systems with the Charging Connector Protocol/Signal Manipulation add-on. Couldn’t be prouder of the team for executing perfectly today. Congrats! #Pwn2Own
cybrz retweeted
Here we are again! Finally on the ground for #Pwn2Own Automotive in Tokyo. 🏎️💻 Our team is ready, and we’re just waiting for the Tuesday draw to see when we’re up. Big week ahead! Stay tuned! 🛠️🔥
There will be… Switzerland's highest max. bounty EVER
Thank you #BugHunters for your relentless curiosity and clean reports that keep our customers #BugBountyProgram sharp.
Soon to announce: Switzerland's highest max. #bounty EVER, new programs and budget refills. Stay tuned! For now: shutdown, enjoy the festive season and recharge
cybrz retweeted
Thank you #BugHunters for your relentless curiosity and clean reports that keep our customers #BugBountyProgram sharp.
Soon to announce: Switzerland's highest max. #bounty EVER, new programs and budget refills. Stay tuned! For now: shutdown, enjoy the festive season and recharge
cybrz retweeted
🎉Success. Our #Pwn2own team combined #zeroday bugs to remotely #exploit @home_assistant green which earned them $20'000 and 4 pts. Congratz to @bcyrill Emanuele, Lukasz @muukong and @yves_bieri.
Respect to @stephenfewer (@rapid7) and @_mccaulay (@SummoningTeam) for their wins.
cybrz retweeted
🧭 Navigation complete! @compasssecurity just charted a course straight into @home_assistant Green at #Pwn2Own. They head off to the disclosure room to spill how they did it. #P2OIreland
cybrz retweeted
. #Pentest of gRPC-Web apps is tricky due to the binary format. We are releasing bRPC-Web, a @PortSwigger @Burp_Suite extension developed by our @muukong that makes #gRPC-Web traffic readable and editable, even in the absence of #protobuf schema files. blog.compass-security.com/20…
cybrz retweeted
@thezdi #Pwn2own schedule is out. Compass folks have been drawn 3rd to exploit the @home_assistant Green for $40,000. 🤞for a #bounty today Tuesday Oct 21st, 5pm (Swiss time). #ethicalhacking cc @hass_devs
Schedule: zerodayinitiative.com/blog/2…
cybrz retweeted
I've been researching the Microsoft cloud for almost 7 years now. A few months ago that research resulted in the most impactful vulnerability I will probably ever find: a token validation flaw allowing me to get Global Admin in any Entra ID tenant. Blog: dirkjanm.io/obtaining-global…