Andreas Schmidt @_znow

Security Researcher, Author of WATOBO siberas.de Germany Joined December 2009

Tweets

1K
Followers

636
Following

930
Likes

3K

DHH @dhh

3 weeks ago

THE ANNOUNCEMENT: We’re going to make the prophecy of The Year of Linux on the Desktop come true. All the pieces are now in place. Time to go all in! omarchy.org/news/2026/08/o…

580 1K 13K 2.8M 2K

View Details

Microsoft’s signed Windows Defender Boot-Time Removal driver (BTR.sys) is a one-shot kernel component that decrypts an RC4-encrypted transaction list from an Alternate Data Stream and performs Ring-0 operations. An attacker with SeLoadDriverPrivilege can craft a valid encrypted config and load it early via a transient “Boot Bus Extender” service, abusing it as a trusted kernel primitive to bypass Tamper Protection, delete EDR/AV components before they start, drop malicious drivers, and gain persistence, without any vulnerability or BYOVD. No in-the-wild abuse has been observed. research.checkpoint.com/2026/btr-refor…

6 166 682 141K 440

View Details

Ruby on Rails @rails

4 weeks ago

Agents on Rails: We ran 8 models against 21 atomic tasks to see which were best at writing Rails code. 3 runs each: a bug report, a security finding, a feature request. The first benchmark report with findings is now live. So: what did we discover? As of August 2026: - Most accurate: @claudeai Opus 5 by @AnthropicAI (by a hair). Solved 92% of runs (58 of 63). (But for a little more than half the cost, you get almost the same accuracy with @Kimi_Moonshot.) - Cheapest: @OpenAI GPT-5.6 Luna. 73% of runs solved at default medium reasoning effort, and all 63 of its runs cost 90 cents combined. - Fastest: Luna again, at a median of 3.3 minutes per run task. - Best combination of all three: @OpenAI GPT-5.6 Sol. 84% accuracy, costing $0.52 and 5 minutes per run. Read all the findings in the first full benchmark report from @evilmartians here: rubyonrails.org/2026/8/13/agen…

37 116 619 158K 222

View Details

V4bel @v4bel

2 months ago

💥 Introducing "Januscape" (CVE-2026-53359) A Guest-to-Host Escape in KVM/x86 exploiting a UAF in the shadow MMU. Triggerable on both Intel and AMD hosts. Threatens x86 public clouds (GCP, AWS) that expose nested virtualization. "16 years" latent. Successfully used as a 0-day exploit in "Google kvmCTF". To the best of public knowledge, the first KVM exploit research triggerable on both Intel and AMD. Details: januscape.io

7 104 450 62K 218

View Details

Kevin Gosse @KooKiz

3 months ago

Ok security twitter, I'm very confused by MS' response to my report. I have a way for an unelevated user to get SYSTEM to run arbitrary code by planting a file in a public folder then waiting for an event that *will* always happen. How does that not qualify for an EoP?

50 54 595 66K 96

View Details

guyru @guyru_

3 months ago

We're mostly an IDA shop at @CellebriteLabs, but I decided to play around with Ghidra. My main motivation was to experiment with agentic reverse engineering techniques. The result is an agent skill for Ghidra, which we are releasing publicly: github.com/cellebrite-lab… >>

7 103 425 65K 378

View Details

Dino A. Dai Zovi @dinodaizovi

3 months ago

This is really good, @AnthropicAI posted a document on how to apply the principles behind Zero Trust to AI Agents: claude.com/blog/zero-trus…

4 39 140 14K 174

View Details

Moritz @m_r_tz

5 months ago

The FLARE team now freely distributes its quality reverse engineering and malware analysis educational content at github.com/mandiant/flare…. Launched with: - Malware Analysis Crash Course - Go Reversing Reference - Intro to TTD

6 396 1K 66K 1K

View Details

shubs @infosec_au

6 months ago

We got frustrated with dealing with vendor dependencies when reverse engineering large applications. @ITSecurityguard from @SLCyberSec’s Sec Research Team built Hyoktesu to solve this problem forever: github.com/assetnote/hyok… - releasing this today! Blog: slcyber.io/research-cente…

4 69 304 42K 268

View Details

Patrik Grobshäuser @ITSecurityguard

6 months ago

I finally let Claude do my pentest this week. Full 5-day engagement, zero human input. Here's what the client got: 😏 clawd.it/posts/10-repla… #bugbounty #pentesting #AI #cybersecurity #infosec #claudeai

43 205 944 117K 945

View Details

Dan Guido @dguido

8 months ago

@mattshumer_ The @trailofbits security auditing skills! Teach Claude to be an expert bug hunter: github.com/trailofbits/sk…

0 5 55 5K 97

View Details

Florian Roth ⚡️ @cyb3rops

8 months ago

Oracle RCE Vulnerability CVSS 10.0 - affecting Weblogic Server Proxy Plug-in for Apache HTTP Server, Weblogic Server Proxy Plug-in for IIS nvd.nist.gov/vuln/detail/CV… oracle.com/security-alert…

6 74 245 32K 118

View Details

chrisrohlf @chrisrohlf

8 months ago

When asked about LLM memory corruption exploit generation in the 2023-era of models I would often say that they were getting better at code generation but lacked understanding of how that code would execute at runtime, and that was a prerequisite for exploit generation. This requires reasoning and observation of code transformations through compilation steps, context and understanding of specific details of modern operating systems, memory allocators, caches, file formats etc. and how they affect program runtime. These are all details exploit developers obsess over with surgical precision out of necessity because you must be right every single time or your exploit just won't work. Since that 2023-era we have seen significant advancements in AI through RL/scaling but also a lot of agentic development. This has allowed the models to not just explore code better but also observe its runtime as it reasons through and builds exploitation primitives. The section on mitigation bypasses in Sean's writeup demonstrates why these capabilities are so hard to achieve without these advancements. They require the ability to reason not just about the code itself, but about how it will behave at runtime, and observe those behaviors as the primitives in the vulnerability, and the state space they create, are explored. A javascript interpreter is really a best case scenario for this kind of experiment because the attacker can run arbitrary code to shape the runtime in a way that is conducive to reliable exploitation. But conversely, a javascript interpreter is complex with many APIs that are reenter the Javascript runtime and lead to things like use-after-free vulnerabilities. This a very exciting time in program analysis and software security. Anyone who doubts this technology as a game changer is not paying attention. github.com/SeanHeelan/ana…

3 11 77 9K 32

View Details

Josef Strzibny @strzibnyj

9 months ago

Ruby received a beautiful website redesign 💎 ruby-lang.org/en/

23 54 658 98K 148

View Details

DHH @dhh

9 months ago

"Shopify is the patron saint of Ruby on Rails. Its infrastructure team is the backbone of our ecosystem, and its continued success the best case study of how far you can take this framework and language. They deserve a gawd damn parade for all they do." world.hey.com/dhh/six-billio…

23 59 960 81K 91

View Details

Graham Neubig @gneubig

10 months ago

Big news! We made the basic tier of the OpenHands Cloud FREE! This means that you can call state-of-the-art coding agents from your computer, phone, github, gitlab, slack, etc. for just the price of API credits or hosting your own language model! 🧵👇

1 10 42 4K 14

View Details

Dirk-jan @_dirkjan

12 months ago

I've been researching the Microsoft cloud for almost 7 years now. A few months ago that research resulted in the most impactful vulnerability I will probably ever find: a token validation flaw allowing me to get Global Admin in any Entra ID tenant. Blog: dirkjanm.io/obtaining-glob…

138 900 3K 480K 1K

View Details

CODE WHITE GmbH @codewhitesec

a year ago

Ten days left. The warm-up fades. Maultaschen were soft. Bean Beats were dark and burnt. But the beats of #ULMageddon will be brutal! #applyIfYouCan

0 14 27 5K 5

View Details

mufinnnnnnn @mufinnnnnnn

a year ago

blog.ret2.io/2025/04/23/pwn… this is so sick. i'm confident if i had the bug i would not have exploited it.

2 27 141 9K 64

View Details

joernchen @joernchen

a year ago

Today I have a more serious topic than usual, please consider reposting for reach: My wife and I are urgently looking for a specialist in neuropediatrics or a similar field for our autistic child with a diagnosed, but not further specified, movement disorder [1/3]