@reverseame

RME-DisCo research group from University of Zaragoza. Special interest on software and systems security. Link to our Telegram channel: https://xitter.cf/t.co/UmkcXVG8MU

 Zaragoza, Spain
reversea.me/
Joined January 2016
  • Tweets5.6K
  • Following1
  • Followers22.7K
70Media
New post: a five-phase, MITRE ATT&CK-aligned workflow for mem forensics, from evidence preservation to binary analysis. We also flag 4 issues that bias mem evidence: paging, demand paging, smearing, and binary transforms #ICDF2C25 reversea.me/index.php/bringi… webdiis.unizar.es/~ricardo/f…
3
1,611
New on the blog: MARISSA reverse-engineers network protocol formats straight from PCAPs: no specs, no delimiters. Will be presented at @IEEEEUROSP 2026, come and say hi! reversea.me/index.php/inferr… tool: github.com/reverseame/MARISS…
1
3
18
2,783
New blog post! The simpler, the stealthier: we benchmarked 4 adversarial DGA models. The 2 simplest evade ML detectors >75% of the time and train in under 2s. Open-source: github.com/reverseame/advers…, blog post: reversea.me/index.php/the-si… #DGA #MachineLearning #CyberSecurity #DIMVA2026

GitHub - reverseame/adversarial-dga-framework

Contribute to reverseame/adversarial-dga-framework development by creating an account on GitHub.

github.com
4
9
1,838
After the Takedown: Excavating Abuse Infrastructure with DNS Sinkholes #DNSSinkholes #AbuseInfrastructure #PassiveDNS #TakedownAnalysis #Badbox20 disclosing.observer/2026/01/…

After the Takedown: Excavating Abuse Infrastructure with DNS Sinkholes

A methodological analysis of how DNS sinkholes preserve abuse infrastructure at the moment of takedown, enabling post-hoc reconstruction using passive DNS data.

disclosing.observer
1
1,451
Account Takeover in Facebook mobile app due to usage of cryptographically unsecure random number generator and XSS in Facebook JS SDK #FacebookAccountTakeover #InsecureRandomNumber #DOMXSS #MobileAppVulnerability #IframeExploitation ysamm.com/uncategorized/2026…

Account Takeover in Facebook mobile app due to usage of cryptographically unsecure random number...

Facebook Javascript SDK and Facebook plugins

ysamm.com
1
1,214
How I Used an Agent to Hunt Vulns #Blazelight #TerminalUI #WebNavigation #GuestPrompt #DigitalPortfolio blazelight.dev/blog/agent-vu…

How I Used an Agent to Hunt Vulns — blazelight.dev

Ralph Wiggum loop meets awesome-selfhosted

blazelight.dev
1
5
900
Leaking Meta FXAuth Token leading to 2 click Account Takeover #FXAuthLeak #AccountTakeover #RedirectFlaw #MetaSecurity #BugBounty ysamm.com/uncategorized/2026…

Leaking Meta FXAuth Token leading to 2 click Account Takeover

Introduction FXAuth is Meta’s shared authentication system used across Facebook, Instagram, and Meta (Horizon / VR). It is used by Accounts Center for account linking, re-authentication, and sensit...

ysamm.com
2
2
1,172
StackWarp vulnerability #StackWarp #SEVSNP #StackManipulation #StackEngineBug #PrivilegeEscalation stackwarpattack.com/#home
5
746
Instagram account takeover via Meta Pixel script abuse #InstagramHack #MetaPixelAbuse #CrossWindowMessaging #OAuthCodeTheft #BugBounty ysamm.com/uncategorized/2026…

Instagram account takeover via Meta Pixel script abuse

Introduction Meta’s web ecosystem relies on cross-window messaging between first-party websites. In many cases, the only security control enforced is an origin check validating that messages origin...

ysamm.com
1
3
584
Multiple cross-site leaks disclosing Facebook users in third-party websites #XSLVulnerability #MetaSecurity #UserIdentification #PrivacyThreat #BugBountyProgram ysamm.com/uncategorized/2026…

Multiple cross-site leaks disclosing Facebook users in third-party websites

Introduction This write-up consolidates several XS-Leak issues discovered across Meta-owned platforms, including Facebook, Workplace, Meta for Work, and internal Meta surfaces.

ysamm.com
2
588
WinBoat: Drive by Client RCE + Sandbox escape. #WinBoat #RemoteCodeExecution #SandboxEscape #DriveByAttack #UnauthenticatedAPI hack.do/posts/winboat-guest-…

WinBoat: Drive by Client RCE + Sandbox escape.

A remote webpage can abuse an unauthenticated guest HTTP API to compromise the Windows guest container, then feed a malicious app entry leading to Linux host code execution on click.

hack.do
2
2
595
The ServiceNow AI Vulnerability: What Went Wrong and How to Secure Your AI Agents #ServiceNowAIHack #AIAgentSecurity #LegacyAISecurity #SupplyChainRisk #AIIdentity opena2a.org/blogs/servicenow…

The ServiceNow AI Vulnerability: What Went Wrong

85% of Fortune 500 exposed. Learn how AI agents need purpose-built security, not retrofitted legacy authentication.

opena2a.org
1
1
367
CVE-2026-20965: Cymulate Research Labs Discovers Token Validation Flaw that Leads to Tenant-Wide RCE in Azure Windows Admin Center #CVE202620965 #AzureWAC #TenantRCE #CymulateResearch #TokenValidation cymulate.com/blog/cve-2026-2…

CVE-2026-20965: Cymulate Research Labs Discovers Token Validation Flaw that Leads to Tenant-Wide...

Cymulate Research Labs uncovered CVE-2026-20965, a token validation flaw in Azure Windows Admin Center enabling tenant-wide RCE and lateral movement.

cymulate.com
2
8
898
Reprompt: The Single-Click Microsoft Copilot Attack that Silently Steals Your Personal Data #MicrosoftCopilot #RepromptAttack #DataTheft #SingleClickHack #AIVulnerability varonis.com/blog/reprompt

Reprompt: The Single-Click Microsoft Copilot Attack that Silently Steals Your Personal Data

Varonis Threat Labs discovered a way to bypass Copilot’s safety controls, steal users’ darkest secrets, and evade detection.

varonis.com
2
400
Drone Hacking Part 1: Dumping Firmware and Bruteforcing ECC #DroneHacking #FirmwareDumping #NANDFlash #ECCBruteforce #IoTResearch neodyme.io/en/blog/drone_hac…

Drone Hacking Part 1: Dumping Firmware and Bruteforcing ECC

Desoldering a drone's flash chip and reconstructing the firmware from broken data.

neodyme.io
11
43
2,321
Bad Vibes: Comparing the Secure Coding Capabilities of Popular Coding Agents blog.tenzai.com/bad-vibes-co…

Blog | Tenzai - AI Security Research & Pentesting Insights

Writings from Tenzai researchers on autonomous offense, AI-driven pentesting, and hard security vulnerabilities. Real case studies and research from the field.

tenzai.com
1
490
CVE-2025-64155: Three Years of Remotely Rooting the Fortinet FortiSIEM horizon3.ai/attack-research/…

CVE-2025-64155: FortiSIEM Analysis

Horizon3 details CVE-2025-64155, revealing chained FortiSIEM vulnerabilities enabling remote code execution and root access, analysis of the root cause, and indicators of compromise.

horizon3.ai
1
22
1
111
12,807
Cybersecurity AI: A Game-Theoretic AI for Guiding Attack and Defense #CybersecurityAI #GameTheory #AIAttack #AIDefense #SecurityStrategy arxiv.org/pdf/2601.05887
1
1
6
1,199
Grok’s image edits spark sexualised deepfakes and regulator probes worldwide thebias.co.uk/articles/grok_…
507
WTF Are Abliterated Models? Uncensored LLMs Explained webdecoy.com/blog/wtf-are-ab…

WTF Are Abliterated Models? Uncensored LLMs Explained

What abliterated means in AI models: how abliteration edits out the refusal direction, how it differs from uncensored LLMs, and which models are abliterated.

webdecoy.com
2
6
803
Load more