AndrewMohawk⁽ⁿᵘˡˡ⁾

Sec/Madness

@privy_io principal security , @_seal_org technical council

prev: HoS @uniswap, D&R/IR @RobinhoodApp, IR @BitMEX, Built @Paterva Maltego with RT

[AndrewMohawk⁽ⁿᵘˡˡ⁾ @AndrewMohawk]

Fun react bug, (CVE-2025-55183) if you have a server side component and it explicitly or implicitly exposes a stringified argument you can get the source code for that function. Also found DoS, but reported it to vercel instead of meta and some else reported the next day 🙃

[AndrewMohawk⁽ⁿᵘˡˡ⁾ @AndrewMohawk]

@tuckner Even more upsetting

[AndrewMohawk⁽ⁿᵘˡˡ⁾ @AndrewMohawk]

Please stop suggesting companies rewrite all their dependencies in house. It adds such overhead, it turns one problem into many and there is no guarantee of any security benefit.

[Privy @privy_io]

At Privy, defense in depth has always been central to how we build.

As AI changes how software is developed and attacked, we're continuing to invest in the systems and practices that keep our infrastructure secure. https://t.co/Xe2Tz9cwLo

[XBOW @Xbow]

A $6.3 billion crypto heist 💸

@AndrewMohawk joins @fede_k on the latest episode of Offense Taken to discuss how this happened + how offensive security teams should deal with situations like these.

https://t.co/DFxKe64V2Z

[AndrewMohawk⁽ⁿᵘˡˡ⁾ @AndrewMohawk]

@sean_a_cassidy Both good questions, why not just do everything in the HSM. My guess like all things is that there was a huge deadline and this *just worked*

[AndrewMohawk⁽ⁿᵘˡˡ⁾ @AndrewMohawk]

eMudhra report is out on bugzilla ... "a single line in that read‑back truncated the private value to its leading byte, so the re‑created object held a scalar below 256"

😅

https://t.co/DhNUYmGsnU

[AndrewMohawk⁽ⁿᵘˡˡ⁾ @AndrewMohawk]

This is awesome!

[Pushmeet Kohli @pushmeet]

Announcing a major milestone achieved by my team @GoogleDeepMind: we have proven key security properties of the machine code underlying the Signal messaging protocol. This is the first time the actual production code of a widely deployed protocol has been formally verified – by any method, with or without AI – and at this depth.

More than a research breakthrough, it’s a prime example of how frontier AI can be a force multiplier to counter the speed and scale of modern cyber threats.

Formal verification offers a higher standard of security; however, it’s extremely complex and time consuming, which is why in many cases it’s considered to be impractical. Similar efforts could take teams decades of combined effort. We did it in a month’s time.

Using AlphaProof Code, Google DeepMind's new agentic framework for formal verification that runs on LLMs including Gemini Carbon, we verified the Signal protocol down to the actual code running on devices.  This milestone lays the groundwork for a future in which vital systems, from medical device firmware to power grid software, ship with mathematical proof that their protections work.

Reaching that future will take continued research from our community. In that spirit, we're open-sourcing our formal specifications and verification artifacts so others can build on this work.

On a personal note, this moment is of deep significance to me. I started my own research journey more than two decades ago as an intern working on checking the consistency of complex software systems. Seeing this grand challenge made practical with modern AI is extraordinary.

I'm extremely proud of my team members: Swarat Chaudhuri, Andrew Ferraiuolo, Anton Kovsharov, Tej Chajed, Sam Schlesinger,  Karn Seth, Jonathan Katz, and Charles Sutton for taking on this grand challenge and delivering, and grateful to the Signal team for their partnership.

https://t.co/kN1eRYQ8fF

[AndrewMohawk⁽ⁿᵘˡˡ⁾ @AndrewMohawk]

https://t.co/8heetFjR9U

[AndrewMohawk⁽ⁿᵘˡˡ⁾ @AndrewMohawk]

https://t.co/E7js24yJRM

Found a bug in WiFiman from unifi that let me get RCE
CVE-2026-119249
CVE-2026-119250

remote access->file write->shell

[AndrewMohawk⁽ⁿᵘˡˡ⁾ @AndrewMohawk]

Fun react bug, (CVE-2025-55183) if you have a server side component and it explicitly or implicitly exposes a stringified argument you can get the source code for that function. Also found DoS, but reported it to vercel instead of meta and some else reported the next day 🙃

[AndrewMohawk⁽ⁿᵘˡˡ⁾ @AndrewMohawk]

https://t.co/tO1KIjdHIx

[AndrewMohawk⁽ⁿᵘˡˡ⁾ @AndrewMohawk]

I really do think harnesses are falling away, but mines still going for now, forgot to add this to the list from Aug 04 CVE-2026-15830 -- https://t.co/hZA0s5nzZR

[AndrewMohawk⁽ⁿᵘˡˡ⁾ @AndrewMohawk]

https://t.co/E7js24yJRM

Found a bug in WiFiman from unifi that let me get RCE
CVE-2026-119249
CVE-2026-119250

remote access->file write->shell

[AndrewMohawk⁽ⁿᵘˡˡ⁾ @AndrewMohawk]

If only I had that daybreak red access :'(

[OpenAI @OpenAI]

Introducing GPT‑6 Cyber: a major advance in security research that pairs stronger capabilities with better model alignment.

The model powered the Linux kernel research we announced yesterday, and security teams at companies like Mozilla, Palo Alto Networks, Calif, and Cisco—alongside our own at OpenAI—are already putting it to work.

GPT-6 Cyber is available to select Daybreak Red customers and we are expanding access over time.

https://t.co/Nzab3Z1Td6

[AndrewMohawk⁽ⁿᵘˡˡ⁾ @AndrewMohawk]

I'm glad everyone is having fun posting SHA hashes, but seriously, what are they for after its released, cause I havent seen anyone mention what they reference.

637ab2808704d851a93ba9a6de8c6b957c5b7e30d4c16bb767df4fb37ff4ddae

[Gabe @Gabeincognito]

AI can reverse engineer binaries, but how do we trust that analysis if we can't see the evidence?

@milenkowski and I wrote a standard and open-sourced VerifiedIDA to make analysis at scale something we can verify and improve.

https://t.co/M9NEAjbrpd

[AndrewMohawk⁽ⁿᵘˡˡ⁾ @AndrewMohawk]

Definitely a good read for those interested

[Security Alliance @_SEAL_Org]

Our profile of TraderTraitor - the DPRK group behind Binance, Bitget, AFX and LayerZero - with the fake company domains we’ve seen in 2026.

https://t.co/932DaP7mIw

[AndrewMohawk⁽ⁿᵘˡˡ⁾ @AndrewMohawk]

@kultekin What does the hash correlate to exactly?

[AndrewMohawk⁽ⁿᵘˡˡ⁾ @AndrewMohawk]

https://t.co/13mEIpbcAV

meh

[Railway Status @railway_status]

Access remains affected from some networks that are blocking Railway IP addresses. We have submitted review requests to security vendors and continue working with network operators to restore legitimate access.

The scanning traffic us…

Status: Identified https://t.co/JfRzjRmGt7

[AndrewMohawk⁽ⁿᵘˡˡ⁾ @AndrewMohawk]

Wow thats really great, wish we saw more of this!

[Shweta Kukreja @ShwetaKukreja_]

Canva is laying off 22% of its workforce which is 1271 employees, and this is what their CEO said.

We need more founders like thissss.

[AndrewMohawk⁽ⁿᵘˡˡ⁾ @AndrewMohawk]

Go blue team!

[Security Alliance @_SEAL_Org]

Um, hello.