Security Engineer | Occasional security researcher | Opinions are my own.

Joined June 2021
Introducing: GhostKatz! 🐱 A Cobalt Strike BOF that lets you dump LSASS via exploitation of vulnerable drivers that offer physical memory read primitives. Written by @EricEsquivel123 and I!! :) github.com/RainbowDynamix/Gh…
2
47
172
11,538
Julian Peña retweeted
Let’s set the record straight: @lcfr_hax was the first to discover php2shell and develop a working exploit. See his August 5 tweet: xitter.cf/lcfr_hax/status/208503… His work convinced the PHP Foundation to invest in fixing this entire bug class. He then worked around the clock to review, test, and retest the patches.
d935be023a55b04681eccd1d2b8385b4b295e141a5df108e5e979d8d5d7124ac
55
400
89
3,021
374,493
opsec level: take a selfie!
1
62
What models are y'all using to dev exploits these days?
51
The report is a really good read. My belief is that not a lot of people are in university "to learn." At the end of the day, they want the degree which unlocks job potential. Of course, this is not the case for every degree program.
MIT published a brutally honest report on what AI is doing to students. A committee of professors and students spent five months studying how AI changed learning on campus, and the findings read like a warning to every university on the planet. Study groups are disappearing. Office hours are emptying out. Problem sets and take-home exams no longer prove anything, because AI can produce credible solutions to almost any written assignment in the undergraduate curriculum. Students who lean on chatbots lose mastery and confidence, and some slip into what the report calls cognitive surrender, reaching for AI at the first hint of struggle. The numbers are rough. 46 percent of surveyed MIT undergrads use LLMs daily. 90 percent worry about their own overreliance. Undergrads who feel AI makes them replaceable now outnumber those who feel it makes them capable. The committee's answer surprised me. They refused to fight AI with surveillance. The report calls AI detectors unreliable, says lockdown browsers feel like spying, and warns that policing students builds a classroom atmosphere of mutual distrust. Instead, MIT wants to rebuild education around the things AI can't replace. That means oral exams, semester portfolios, in-person project work, and a required social component in every subject. The report even floats the idea of rethinking grades entirely, since without a GPA to optimize, much of the incentive to cheat with AI evaporates. The committee warns professors against replacing undergrad research assistants with AI agents just because they're cheaper, because a university exists to grow people, not output. The most famous tech school on earth admitted the machines broke its way of teaching. Its answer is more humans, not more software.
140
Insane find for $4.49…
2
157
It’s not hard to spot AI slop write-ups. Writeups by humans will always be better than AI slop. Use AI to brainstorm, but don’t let it replace the joys of writing a high quality blog post.
As I’ve read more and more LLM output, I’ve grown to appreciate even poorly written human writing
1
167
YES!!
Totally agree, that's why I am planning to do this year's #FlareOn without using AI (unless there is a task where it's specifically required). The competitive side of the challenge may be dead, but we still can choose to have fun. Just like existence of a mountain lift doesn't have to kill the pleasure of climbing.
113
Julian Peña retweeted
Join us next Friday, September 18th at 11AM PT for the next @offby1security stream with the great Pavel Yosifovich (@zodiacon) for a session on, "Breaking Windows: Exploring Security Through Kernel Drivers!" youtube.com/watch?v=3tP1HVwA…
1
12
1
42
6,830
"Even if you removed the csagent.sys process callbacks, WESP blocks the malware afterwards." Just remove the WESP callbacks?? 🤔
1
9
874
we're so back...
20
1,569
New blog post! In this one, I dive into an untrusted pointer dereference bug in FortiClient's FortiShield driver (CVE-2015-5736). This was a fun exercise! Enjoy! julian-pena.com/2026-09-09-f…
2
149
We identified a cluster of WHQL-signed Windows kernel drivers that all contain the same Authenticode metadata reference: SpcSpOpusInfo=Autel Intelligent Technology Corp., Ltd. Taken together, the drivers provide a surprisingly complete set of ring0 primitives: arbitrary process and kernel memory access, manual kernel PE loading, DKOM-based hiding, pointer hooks, keyboard and mouse injection, WFP/NDIS traffic interception, browser traffic manipulation and physical-memory access. Some samples go further, with self-deletion, covert userland-to-kernel communication, embedded shellcode and explicit security-product targeting. Several appear purpose-built for privileged control and concealment. We published the full sample list, SHA-256 hashes, family grouping and per-driver analysis notes in our IOC repository: github.com/NextronSystems/io…
32
2
106
8,103
Releasing PLATINUMPICK, a Windows kernel-mode shellcode development framework written in C++20. github.com/winterknife/PLATI…
34
202
9,357
Julian Peña retweeted
Just released ttd-capa, a tool used with CAPA to extract capabilities from Time Travel Debugging (TTD) traces. On top of that, you can create timelines of the extracted capabilities that you can navigate to in your traces! github.com/HullaBrian/ttd-ca…
1
3
13
1,101
I’m tired of infosec larp :(
1
177
Julian Peña retweeted
I don’t know who needs to hear this but your research is your IP not the vendors IP. You can do whatever you want with that IP. Reporting it, publishing it, selling it to a third party or putting it in a box under your bed 🙄
This is *quite* a post. I honestly don't know offhand: Has Microsoft as a company ever before suggested in any official statement that it might seek to have criminal charges brought against security researchers who drop 0days? microsoft.com/en-us/msrc/blo…
6
32
1
190
14,820