Pinned Tweet
New #CodeXplorer v2.1 [IDA7 Edition] released! Changelog: multiple bugfixes, added gcc Virtual Tables and RTTI parsing, improved Linux and macOS support. github.com/REhints/HexRay… #REhints
2
98
189
REhints retweeted
30 years ago today, Phrack 49 published Aleph One’s “Smashing the Stack for Fun and Profit”.
A legendary paper that inspired generations of hackers and helped shape modern exploit development.
Still an essential reading.
phrack.org/issues/49/smas…
Phrack 73 is coming soon!
A legendary paper that inspired generations of hackers and helped shape modern exploit development.
Still an essential reading.
phrack.org/issues/49/smas…
Phrack 73 is coming soon!
13
220
820
22,304
REhints retweeted
Many people have a shallow understanding of what Rust actually guarantees. The borrow checker is great for ensuring memory safety *within an application*, the guarantees for multi-process interaction (and even interaction with shared libraries etc.) aren't the same thing.
People are asking how you corrupt memory in a sandbox written in Rust. 🦀🔥
The spark came from an unsafe block: mmap(MAP_FIXED) failed after unmapping a guest-RAM page. KVM kept pointing there; Firecracker reused it. Guest writes became VMM writes. 🏴☠️
13
15
176
7,909
REhints retweeted
Good news! We've wrapped our initial "Lights Out" research into out-of-band management devices and BMCs. The final advisories are live and OOBscan now includes detections for all issues. The bad news: many of these issues still have no patch:
github.com/runZeroInc/oob…
github.com/runZeroInc/oob…
7
49
106
10,999
REhints retweeted
Slides from the talk @mlippautz and I gave at the recent @offensive_con in Tokyo: saelo.github.io/presentations/…
Blog post for the Fuzzing vs. AI part: projectzero.google/2026/10/fuzzin…
Blog post for the Fuzzing vs. AI part: projectzero.google/2026/10/fuzzin…
3
57
223
18,705
REhints retweeted
Code-execution flaw in UEFI firmware affects most servers on planet Earth: arstechnica.com/security/2026/…
Great work by Alex Matrosov (Anthropic) and Dan Holmes-Mitra (Google)!
Great work by Alex Matrosov (Anthropic) and Dan Holmes-Mitra (Google)!
4
23
59
7,893
REhints retweeted
I have just noticed that my Scudo internals paper (released while at L3Harris Trenchant) can't be (easily?) found anymore due to website changes... here is a link to a pdf copy for those that need it: github.com/rrbranco/Scudo…
3
12
79
4,143
REhints retweeted
this blog shows some of the worst bugs claude found, including a zero-click rce on the linux networking stack that roots a server over the network with no creds or interaction, and tens of full rce chains in chrome (recording below is the one in the blog): anthropic.com/research/disco…
9
52
504
102,996
REhints retweeted
LLMs are great at finding bugs, but so are fuzzers. @5aelo compared the vulnerabilities found in V8 by BigSleep, an agentic system, with those found by the Fuzzilli fuzzer.
projectzero.google/2026/10/fuzzin…
projectzero.google/2026/10/fuzzin…
13
109
445
42,637
REhints retweeted
Submit to the CFP! We close in 5 daysssssss
Our CFP is still open! Submit your talks on
-bizarre reverse engineering projects
-tool releases
-exploits and vulnerabilities
-Non-technical and policy talks on cyberz
districtcon.org/cfp
1
5
7
1,168
REhints retweeted
📢 IDA 9.5 is here: more platforms, more agentic power.
→ 3 new decompilers: Android Dalvik, Infineon TriCore and Qualcomm Hexagon
→ IDA MCP and Assist for AI-driven reverse engineering
→ Recursive decompilation across call graphs
→ IDA Home now includes 11 cloud 2, at the same price
→ And much, much more
It’s one of our biggest releases yet. Active license holders can download it now from the Download Center.
hex-rays.com/blog/ida-9.5-r…
→ 3 new decompilers: Android Dalvik, Infineon TriCore and Qualcomm Hexagon
→ IDA MCP and Assist for AI-driven reverse engineering
→ Recursive decompilation across call graphs
→ IDA Home now includes 11 cloud 2, at the same price
→ And much, much more
It’s one of our biggest releases yet. Active license holders can download it now from the Download Center.
hex-rays.com/blog/ida-9.5-r…
11
56
400
20,353
REhints retweeted
AI-assisted research is killing embargoes. Coordinated disclosure will never be the same.
The industry used to have the luxury of testing or sitting on a fix for months. Not anymore. When everyone's using the same tools and the same intelligence to find vulnerabilities, you're not the only one finding that bug.
Product security and PSIRT need a serious rethink: less gatekeeping, more proactive evaluation of security posture, and shipping fixes continuously at scale.
The biggest impact will be in firmware and hardware, where disclosure timelines have historically stretched past 12 months. That mindset is a leftover from outdated processes and slow testing and bring-up environments.
The industry used to have the luxury of testing or sitting on a fix for months. Not anymore. When everyone's using the same tools and the same intelligence to find vulnerabilities, you're not the only one finding that bug.
Product security and PSIRT need a serious rethink: less gatekeeping, more proactive evaluation of security posture, and shipping fixes continuously at scale.
The biggest impact will be in firmware and hardware, where disclosure timelines have historically stretched past 12 months. That mindset is a leftover from outdated processes and slow testing and bring-up environments.
7
20
71
6,633
REhints retweeted
All the details including the slides are now available at quentinkaiser.be/security/2026/…
3
31
101
6,223
REhints retweeted
My presentation at Hexacon is done ! Time for public disclosure.
Pictured below: remote unauthenticated code execution over-the-air (including the shell) on Proximus BBOX 3V+
Pictured below: remote unauthenticated code execution over-the-air (including the shell) on Proximus BBOX 3V+
6
57
269
16,477
REhints retweeted
Exciting work from @willzhou97 (Fellow, now full time!) and @bucketofkets on the Frontier Red Team. One of the cool parts of the job is seeing a future world early. We think this one is ~pretty underpriced.
"We should aim to harden our systems to make it difficult for such replicators to spread, but also prepare to deal with a world where they are here to stay."
"We should aim to harden our systems to make it difficult for such replicators to spread, but also prepare to deal with a world where they are here to stay."
Anthropic's Frontier Red Team believes small AI models may now be months away from being capable of self replicating without access to a datacenter.
Quoting from the blog:
'The capabilities that make AI models generally powerful coding agents also generalize to cyber tasks, plication. Like coding agents in 2024, we’re seeing signs of life for AI worms. We don’t yet have a full rogue replicator, but agents are becoming increasingly capable of completing the individual steps in the replication chain (and passing on their adaptations to future copies of themselves).
At the same time, increasing amounts of inference compute are now available both inside and outside of datacenters (see Appendix D). It’s uncertain exactly what form autonomous AI replication will take. It could be a slow, distributed “digital slime mold,” living on relatively insecure compute. It could also be a powerful cyber model that breaches datacenters at a high pace, or a model that scams people for compute credits.
As a prediction that goes beyond our experiments, we expect a future awash with agents running on all types of hardware, including some that aren’t under human control. While it’s true that IoT devices have been vulnerable for a long time, lightweight agents may be much more willing than human attackers to put in the effort to compromise large fractions of the world’s IoT compute. The rise of slow replicators would also be a bellwether for more aggressive, faster ones that can breach more hardened machines or be effective API key thieves. We should aim to harden our systems to make it difficult for such replicators to spread, but also prepare to deal with a world where they are here to stay.'
23
28
238
28,489
REhints retweeted
Very excited to share details on the bugs used in our full chain Chrome exploit! We used three bugs (V8 corruption, V8 sandbox escape, and renderer sandbox escape via Crashpad). The third bug is my favorite!
7/ Read more on the blog: xbow.com/labs/research/…
15
55
255
16,815
REhints retweeted
📚 Slide decks from OB1 2025 & 2026 are live!
Catch up on talks you missed, revisit top sessions, or dive into the technical breakdowns. Most slides are up on GitHub:
👉🏻 github.com/star-sg/OBO
Huge thanks to all our speakers, sponsors, activity partners, and attendees!
Catch up on talks you missed, revisit top sessions, or dive into the technical breakdowns. Most slides are up on GitHub:
👉🏻 github.com/star-sg/OBO
Huge thanks to all our speakers, sponsors, activity partners, and attendees!
0
24
80
4,949
REhints retweeted
Agenda for OffensiveCon Tokyo 2026 is live!
Explore the talks and plan your schedule now:
offensivecon.jp/agenda/2026.ht…
#OffensiveCon #Tokyo
Explore the talks and plan your schedule now:
offensivecon.jp/agenda/2026.ht…
#OffensiveCon #Tokyo
0
22
39
9,748
REhints retweeted
Honestly impressed with Claude Opus 5.5 on this one.
We made an anime about SBOMs (with a lot of help from @claudeai). Then shipped v0.3.0 🎉
CBOMs now get checked against CNSA 2.0 + post-quantum rules, and if sbom-tools can't tell what an algorithm is.
github.com/sbom-tool/sbom…
0
3
24
3,074
REhints retweeted
The Phrack 73 prophile of @halvarflake
A must-read from one of the legends of vulnerability research.
archives.phrack.org/dl/73/halvar-f…
A must-read from one of the legends of vulnerability research.
archives.phrack.org/dl/73/halvar-f…
3
74
301
20,330