Speaker | Trainer - AppSec | OSWE | OSCP | CISSP. Tweets or likes are my bookmarks to access those on PC, mobile or in transit. https://xitter.cf/t.co/pzKHcVpNhD

NY/ NJ transit / NJ
Joined October 2012
Replying to @security_sesha
One more awesome cert from OffSec #OSWE #offsec
3
15
Shesha retweeted
0-Click RCE on the Tesla Infotainment Through Cellular Network cc @_p0ly_ @vdehors synacktiv.com/sites/default/…
3
53
4
433
24,235
What a rollercoaster. 7 weeks, 5 RCEs on Pixel 10 & 11, all officially patched by Google today. Chuffed to bits. The bounty won’t have us popping champagne, but popping Chrome? That we can do all day. The real payout was always the patch. Demo 👇
5
18
2
132
13,624
Shesha retweeted
CryptSn0w is now open source! An obsolete untethered #jailbreak for iOS27 and devices up to A20 Pro, exploiting a rare Apple server-side TSS/Cryptex bug. 🔥
4
20
1
274
55,617
Shesha retweeted
Demos we presented at Hexacon in Paris today. Everything will be released in due time. 1/ Signal 1-click
150
528
107
4,522
573,102
We at @ai4bharat, with @NVIDIA, are releasing open data and evals to build frontier LLMs for all 22 Indian languages. - 2.8T tokens of synthetic Indic pretraining data - Audited, native-speaker-verified benchmarks - Open recipes 📖 Tech Report: tinyurl.com/4rpt383x (1/6)
30
126
7
1,118
33,561
Shesha retweeted
We’re publishing a full Android kernel exploit chain built on CVE-2023-20938, a use-after-free in Binder, on a Pixel 6 running Android 12. 🔗 eshard.com/blog/kernel-uaf-1…
1
24
133
6,482
Shesha retweeted
The best practitioner (not lab) AI evals for offensive cybersecurity I follow myself: 1) The @dreadnode dreadindex. Evals al the way down to the vuln category level, and refusals accounting dreadnode.io/research/dreadi… 2) @AikidoSecurity white-box but i've confirmed that it extends to dynamic testing well aikido.dev/aikido-arena 3) BArena by @mdp_sec focused on bounty-like black box bugs. blackboxarena.ai/ 4) @mindfort 's nexbench has info downto the config of a model including thinking or effort setting, and cost per finding, which many omit. mindfort.ai/blog/introducing…
16
65
4
339
158,909
‼️ BREAKING: Security firm Calif unveiled an untethered iPhone 18 Pro jailbreak on stage in Paris. Its Hexacon demo shows the phone on iOS 27.0.1, Apple's latest, giving up a root shell within 2 minutes of boot.
91
600
82
8,112
581,216
Shesha retweeted
New 2 unauth RCE affecting Next.js! nextjs.org/blog/nextjs-secur…
5
44
1
316
13,115
Shesha retweeted
Gemini 4 Argon has arrived! The era of super intelligence in cyber security has begun, excited to share more on how we use it to secure the world - and we are just getting started 🌎 youtu.be/ftkic7Tdpcg?si=3QxA… deepmind.google/blog/introdu…
15
17
1
195
17,462
Shesha retweeted
Introducing PwnEscape 🦉: a full KVM guest-to-host escape via a Linux kernel networking flaw affecting industry standard hypervisors. CVE-2026-99999 went from untrusted VM code to host-kernel memory reads, controlled writes, and root command execution. More below:
🤖 Made with AI
16
221
46
1,258
380,241
New Google VRP writeup "Hacking Google with A.I. for $500,000" for a bounty of $500,000 by @brutecat: brutecat.com/articles/hackin…
1
6
116
5,736
Shesha retweeted
7/ Read more on the blog: xbow.com/labs/research/zero-…
3
22
4
89
23,046
The OAIC keynote video is live! Thank you to David Brumley for an excellent keynote, “AI Exploitation, Quantified,” and for giving us plenty to think about as frontier labs push AI’s cyber capabilities forward. Watch here: youtu.be/HY4_9o2xPvk
17
2
36
7,415
As an AI Engineer. Please learn: > Harness engineering, not just prompt engineering > Context engineering, not just long prompts > Prompt caching vs. semantic caching tradeoffs > KV cache management, eviction, reuse, and memory pressure at scale > Prefill vs. decode latency and why they optimize differently > Continuous batching, paged attention, and throughput optimization > Speculative decoding vs. quantization vs. distillation tradeoffs > INT8, INT4, FP8, AWQ, GPTQ, and when quantization hurts quality > Structured output failures, schema validation, repair loops, and fallback chains > Function calling reliability, tool contracts, argument validation, and idempotency > Agent guardrails, loop budgets, tool budgets, and termination conditions > Model routing, graceful fallback logic, and degraded-mode UX > RAG architecture: chunking, embeddings, hybrid search, reranking, and freshness > Retrieval evals: recall, precision, grounding, attribution, and citation quality > Evals: golden sets, regression tests, adversarial tests, LLM-as-judge, and human evals > LLM observability as a first-class discipline: traces, spans, tokens, latency, errors, and drift > Cost attribution per feature, workflow, tenant, and user journey, not just per model > Safety engineering: prompt injection defense, data leakage prevention, and permission boundaries > Multi-tenant isolation, cache safety, and cross-user context contamination prevention > Fine-tuning vs. in-context learning vs. RAG vs. distillation, and when each is the wrong tool > Latency, quality, cost, and reliability tradeoffs across the full inference stack > Production failure modes: hallucinated tool calls, malformed JSON, stale retrieval, runaway agents, and silent eval regressions > Shipping LLM systems as reliable infrastructure, not demos wrapped around prompts aiengineeringfromscratch.com
2
51
2
332
12,898