🌐 Security Researcher | 🤖 AI Enthusiast | 🎙️ BlackHat ASIA/EU/USA. 𝕏s are my own.
Joined November 2018
- Tweets65
- Following431
- Followers860
- Likes424
Pinned Tweet
Our #BHUSA talk — Tool Part 1/3: Instead of fighting QL syntax, we let LLMs relax official queries by removing conservative pruning.
github.com/P1umer/QL-Relax
P1umer retweeted
A few years ago I had a weird thought: does ETH have a theoretical price ceiling?
It came from living through the FOMO cycles — USDC depeg, BSC mania — and watching L2s explode. Gas got so expensive I started wondering: is ETH's price actually capped by its own gas fees?
I could only test it properly recently, with Claude. here's what I found
P1umer retweeted
I've uploaded the slides of my recent talk "JS Engine Security in 2025": saelo.github.io/presentation…. I think there'll also be a recording available at some point (otherwise I can make one as not everything's in the slides).
Thanks for the fantastic conference @POC_Crew!
P1umer retweeted
🔎 How do sink-aware fuzzing + LLMs uncover Java vulns under pressure? See how Atlantis-Java did it.
👉 team-atlanta.github.io/blog/…
#AIxCC #Cybersecurity #CTF #AI #LLM #GenAI #AICyberChallenge #DARPA #DEFCON #Security #Vulnerability
P1umer retweeted
icymi: CodeQL can now scan C/C++ without needing to build 🙌 github.blog/changelog/2025-0…
P1umer retweeted
New blog out now! We’re answering the top questions from the DEFCON audience and sharing the behind-the-scenes story of our victory. team-atlanta.github.io/blog/… #AIxCC
P1umer retweeted
"AI Agents for Offsec with Zero False Positives" by @moyix, a journey on how we managed to get 0 FPs with XBOW. You can find the slides for his BH talk here: cdn.prod.website-files.com/6…
P1umer retweeted
Today, we announced the official release of OSV-SCALIBR, Google's software composition analysis library. If you are working in vuln management / security scanning, SCALIBR is for you! SCALIBR is powering most of Google's vuln scanning. Please RT
security.googleblog.com/2025…
P1umer retweeted
Our slides about WASM bugs in browsers are now available.
Thanks to everyone who helped with the talk.🫡
Hope we can do better next time.
1. BH USA 2024: i.blackhat.com/BH-US-24/Pres…
2. GeekCon Shanghai 2024: geekcon.top/js/pdfjs/web/vie…
cc my partners (@p1umer @xmzyshypnc1 @q1iqF)
Maybe there's a potential hiccup with AFL's custom mutator post process design. If the post process happens in `write_to_testcase` and saves the sample afterward, it seems to go against the "before executing the target" guideline in the docs.
P1umer retweeted
During #BHUSA Briefing "Achilles' Heel of JS Engines: Exploiting Modern Browsers During WASM Execution" we will discuss some of the interesting vulnerabilities we found on attack surface of WebAssembly and demonstrate how to exploit them >> bit.ly/3yXSpfD
P1umer retweeted
Thanks to events like Pwn2Own or our V8CTF (~= exploit bounty program), we now have more data about the types of bugs exploited in V8. Based on that, we've gathered some basic statistics: docs.google.com/document/d/1…
Since returning from BH Asia last year, we have made further progress in the exploiting and eagerly anticipate sharing it with you all #BHUSA #BlackHatEvents
Luck enough that our submission was accepted by Black Hat USA 2024 last week.
We (@p1umer @xmzyshypnc1 @q1iqF) will share our bug hunting trip in WASM of Modern Browsers.
[⛳️] Unlocked BlackHat Asia/USA/Europe and DEFCON during one year finally.
#BHUSA @BlackHatEvents
P1umer retweeted
Thanks to the fine folks at @nautilusinstitute the #defcon32 #ctf quals are in the books - you can read all about it at quals.2024.nautilus.institut…. There's also a veritable feast of JSON dumps for the curious. Congrats to the winners, thank you to everyone who suited up and we'll see you in Las Vegas!
#defcon
P1umer retweeted
A short but happy trip at Blackhat Aisa 2024.
Our slide is available now: i.blackhat.com/Asia-24/Prese…
Hope you like it and hope we can do it better next time.
Thanks to everyone who helped with this talk.
And also thanks @darkfloyd1014 's gifts, I like them so much.
P1umer retweeted
(CVE-2024-2606)[1879237]Passing invalid data could have led to invalid wasm values being created, such as arbitrary integers turning into pointer values.
hg.mozilla.org/mozilla-centr…
@p1umer
P1umer retweeted
Had a good time at Blackhat Europe 2023.
The release version of our slide is available now: i.blackhat.com/EU-23/Present…
Hope you like it.
Thanks to everyone who helped with this talk!!🥳🥳
