Creative minds breaking your Apps. Our team of security experts will plan and execute controlled attacks and help you improve the security of your applications.
USA
Joined January 2011
- Tweets240
- Following200
- Followers213
- Likes167
¡Te invitamos a participar de nuestro CTF en la @ekoparty! 🔓
El primer participante en resolverlo ganará un Swag exclusivo con nuestra mochila, remera, vaso térmico y otros regalos. ¿Tendrás la destreza (y el attacker mindset) suficiente para triunfar?
Más detalles. 👇
En Kulkan, somos sponsors de la @ekoparty 2026, la conferencia de seguridad informática más grande de LATAM. 🌎🛡️
Si estarás en el evento y te interesa conocer a un equipo de pentesters que piensan como verdaderos atacantes, ¡te esperamos en nuestro stand!
¿Nos acompañas? 👇
📝 New blog post: Matias Fumega documents the process of obtaining a root shell on a Xiaomi L09G smart speaker.
The post covers how he went from an interactive U-Boot shell to patching BL33 in Ghidra, bypassing signature verification, and booting a fully custom kernel image. 👇
The process involved bootloader analysis, runtime memory patching, Secure Boot bypass, and custom kernel image injection. None of these steps required chip-off, JTAG, or soldering beyond the UART connection itself.
👉 Dive into the full research: blog.kulkan.com/u-boot-as-an…
📝 New blog: @nahueldsanchez_ analyzes vulnerable GitHub Actions workflows.
Looking into TeamPCP's exploitation of GitHub repositories, he found the method in one of those cases was simple, yet very effective: inject malicious code via a comment in a newly created issue. 👇
From that starting point, Nahuel analyzed thousands of packages from PyPi, NPM, and Rust Crates at scale, uncovering how this attack class works and reporting several vulnerabilities along the way.
👉 Dive into the full research: blog.kulkan.com/analyzing-gi…
Kulkan Security retweeted
¡Bienvenido @kulkansecurity a la EKO Buenos Aires 2026! Gracias por acompañarnos como Vendor 🚀
🎯 Kulkan es un equipo experto en penetration testing y seguridad ofensiva. Piensan y actúan como atacantes para identificar vulnerabilidades de alto impacto, entregando assessments con contexto real, reportes orientados al cumplimiento normativo y soporte en la remediación para asegurar entornos Web, Mobile y Cloud / On-Premise.
Con +25 años de experiencia en la industria, incorpora AI en su metodología y cuenta con un modelo de 3 tiers, para que elijas la opción que mejor se adapte a tu organización.
✅ El enfoque de Kulkan incluye:
- Testing de lógica de negocio: Escenarios de ataque diseñados a medida según los casos de uso específicos de cada organización, para descubrir vulnerabilidades profundas y difíciles de detectar.
- Cumplimiento normativo: Assessments especializados para PCI DSS, SOC 2, ISO 27001 y otros estándares de Compliance.
- Testing manual: Potenciado con tecnología de vanguardia para identificar vulnerabilidades explotables más allá de las capacidades del escaneo automatizado.
📌 Conocé más >> kulkan.com/es/
📅 Ekoparty Buenos Aires | 7, 8 y 9 de octubre 2026
🎫 Comprá tu entrada ahora en ekoparty.org
Kulkan is heading to @BlackHatEvents and @defcon!
We bring our attacker mindset to the most influential events shaping global cybersecurity, sharing what we've learned across 25+ years in pentesting so more businesses can raise their security bar. 🛡️
Will you be there? 👇
Our team will be in Vegas connecting with security leaders and practitioners from the US and beyond, and of course, handing out free stickers to anyone lucky enough to cross our path! 🐉✨
Are you attending? Send us a DM and let's connect.
About Kulkan: kulkan.com/?utm_source=X&utm…
📝 Our latest blog covers a vuln our team reported in pyzipper, a Python library recommended by LLMs for creating AES-encrypted Zip files.
A single-character typo in the library silently downgraded AES encryption and left a CRC32 checksum in plaintext.
How did we find it? 👇
The article walks through the actual vulnerability, the class of bug it belongs to, and builds a reproducible PoC that recovers the contents of small files by brute force, without ever attacking the password.
👉 Dive into the full research: blog.kulkan.com/cve-2026-447…
Smart devices at home are more vulnerable than you think, and Matias Fumega demonstrates it once again!
📝 In our latest blog post, he analyzes how a commercial weather station's RF protocol was decoded and how tampered data was successfully injected and read by the station. 👇
Matias walked through capturing the signal with an RTL-SDR, decoding the protocol, and crafting arbitrary frames with a HackRF One.
Want to see how you can inject arbitrary readings with just an SDR, and a bit of patience bruteforcing the Device ID?
👉 medium.com/@kulkan-security/…
Kulkan Security retweeted
“Vibing w/Caution: A deep dive into a logic vulnerability introduced via incorrect operator use” by Lucas Lavarello from the @kulkansecurity team | Sponsors Track | #EKOMIAMI2026 💪✈️
-
“Vibing w/Caution: A deep dive into a logic vulnerability introduced via incorrect operator use” dictada por Lucas Lavarello del equipo de @kulkansecurity | Sponsors Track | #EKOMIAMI2026 💪✈️
Announcing our second talk at @ekoparty Miami! 🎙️🛡️
@veryhumansortof will break down how a single misplaced operator silently broke encryption in a library recommended by frontier LLMs, and why every SAST tool missed it.
🗓️ May 22, 1:40 PM
📍 Sponsor Track
Let's connect! 💪
Kulkan takes the stage at @ekoparty Miami! 🎙️🛡️
Matias Fumega will be diving into hardware security and showing how smart devices in your home are more vulnerable than you think, using nothing but cheap tools and open-source software.
Learn more. 👇
🤖 Made with AI
Matias will walk through how two real targets were hacked from scratch: a smart display and a commercial weather station.
Want to start your journey in the hardware hacking world?
🗓️ May 21, 10:45 AM
📍 @physsec Space
Will you be there? Send us a DM and let's connect! 💪
The challenge is officially closed. 🔒
We want to congratulate everyone who cracked it, and thank all those who had the honor of meeting Eliza!
Soon we'll be announcing the winners for the conference tickets for @ekoparty Miami. 🎟️
Stay tuned!
