Estevam

I like to break stuff / Security at @Microsoft / Sometimes I play CTFs with @GaneshICMC / Personal Account ⟦PT/EN⟧

[Estevam @es7evam]

My 5th M365 Copilot CVE just got released yesterday (CVE-2026-24307), some forums are mentioning it as "Reprompt". That's a different vuln and I have nothing to do with it.

This was the coolest one so far, hopefully I'll be able to talk about it publicly soon :)

[Estevam @es7evam]

I'll be talking to MSRC folks about some of my research process and maybe some of the vulns I've found, come ask questions!

[Microsoft Security Response Center @msftsecresponse]

Are you a security researcher hoping to qualify for Zero Day Quest or looking to level up your research game? MSRC invites you to a two-part series of candid conversations with our internal researchers, designed to help you sharpen your skills and stay inspired during the Research Challenge.

In each session, we’ll explore how security researchers approach their work, from identifying new opportunities to navigating challenges and solving complex problems. Whether you're just starting out or deep into your research journey, you'll gain practical insights and lessons learned.

Featured speakers:
Estevam Arantes (@Es7evam), Security Software Engineer, Microsoft
Santiago Zanella-Béguelin (@xEFFFFFFF), Principal Researcher, Microsoft

Mark your calendars:

Security Chats: Inside the Research Process
🗓️ Part 1: August 26, 2025 | 10–11 AM PT
🗓️ Part 2: September 3, 2025 | 10–11 AM PT

Register now: https://t.co/jgKFYVemcg

#ZeroDayQuest

[Tom Gallagher @secbughunter]

Great talking with the amazing Microsoft Office Security team. #MSFTBlackHat

[Microsoft Security Response Center @msftsecresponse]

Exciting News! 📢 We're boosting our Microsoft 365 Insider Bounty Program, increasing awards up to $30,000 and expanding the scope of eligible vulnerabilities in our Office products and services. Find out more in our blog: https://t.co/w9KwlaXsjD

[Eduardo Vela @sirdarckcat]

And here's the link to apply as a member of the team (as an engineer).

https://t.co/OWyJ9KQ54R

[Estevam @es7evam]

The Office Security team is hiring! Feel free to reach out if you have any questions.
https://t.co/hhelrjG5al

[Estevam @es7evam]

@sabrinaemsurto A vpn da usp funciona como vpn pro Br, dá pra usar de graça com email alumni

[Microsoft Security Response Center @msftsecresponse]

Stop on by the Office Insider Bug Bounty Program and check out the new attack scenario for Microsoft Defender Application Guard for Office with awards up to $15,000!

https://t.co/xPxu2NHFXj

[Estevam @es7evam]

@caioluders @CryptoVillage

[Estevam @es7evam]

Looking forward to seeing some nice research😃

[Tom Gallagher @secbughunter]

Hope everyone enjoys tomorrow's Office symbol release. Thanks to everyone inside of Microsoft for making this happen. It was a bit of work. We look forward to enabling high quality Office research. 😀
https://t.co/vmI6kDSoRB

[Estevam @es7evam]

Happy times :)

https://t.co/OhoCWn5tMn

[Estevam @es7evam]

@yadrieldiaz @camaradacaio @renatavinhaga1 Eu imprimi os dois, acho que entreguei o em inglês no aeroporto mas teoricamente é a mesma coisa, um amigo só imprimiu o em português e foi ok pra ele

[Estevam @es7evam]

@RayltonMelsi N sei se conferiram o QR code pq na hora tava preenchendo outros docs, mas _acho_ que não
Em restaurantes mal mal olham se tem escrito "covid vaccine" no papel

[Estevam @es7evam]

@renatavinhaga1 @camaradacaio Acho que sim, lembro de preencher uns formulários e só perguntava se eu era vacinado, n tinha nenhuma ligação com o tipo de visto
Bom lembrar q precisa fazer teste antes de ir tb (mesmo com vacina) senão a airline n deixa embarcar

[Estevam @es7evam]

After almost 2 years waiting for my visa, today I finally had my first day as a Security Software Engineer at Microsoft!
Happy to be here :)

[Felipe Payão @felipepayao]

Urna eletrônica:

O Teste Público de Segurança 2021 chegou ao fim. Os pesquisadores descobriram algumas vulnerabilidades 'interessantes' na urna, que deverão ser corrigidas pelo TSE até maio.

Acompanhe 👇

[kylebot @ky1ebot]

Wanna learn heap exploitation in the post-safe-linking era? A new release of how2heap is here to help! Check it out! https://t.co/euX2dhhTRe

[Estevam @es7evam]

Para quem tem interesse, vale a leitura técnica em https://t.co/0M8Nw4vAj1

[Diego F. Aranha 🕷️ @dfaranha]

Internet BR celebra "abertura" do código-fonte da urna e ignora que inspeção:
- É reservada a certas instituições
- Acontece apenas em BSB
- É restrita à leitura do código (milhões de linhas)
- Não cobre alterações posteriores
- Acontece assim faz tempo

https://t.co/fdNi50yNKD

[Ariel Garcia @Arl_rose]

Hello Everyone,

Need the Cybersecurity community's help. We need to vote so Twitch has a Cybersecurity category, so we stop using "science and technology". Please enter here and vote: https://t.co/bjuUvb2mwx

@NahamSec @thecybermentor @stokfredrik Would U RT please? Thanks!!!