Jon Gaines

Head of Offensive Security @ Anduril; Adjunct Instructor at HCC by day. Hacker & Founder by night. 50 CVEs. Husband. Father. Skateboarder. Posts are my own.

[Jon Gaines @GainSec]

On September 16, 2026, @WIRED and @404mediaco reported on leaked Flock Safety LPR firmware, later distributed through DDoSecrets. I reviewed the supplied Falcon/Sparrow image to verify remediation of my previously disclosed vulnerabilities. The results may or may not shock you.

Paper: https://t.co/cc2e9hTNPO

[Vincent @VincentVentalon]

Ils ont vibecodé le panneau de l’aéroport de Sicilie???

[ramona @ramonable]

found the coolest website where you can find suppliers for virtually any american company 👀

https://t.co/Cg4jGx2jlp

[Jon Gaines @GainSec]

@MosheTov Most general CNAs (MITRE), VINCE, take much longer to respond. I think that’s a part of it.

[Jon Gaines @GainSec]

@IceSolst https://t.co/pPajMjSWV7 💪

[Jon Gaines @GainSec]

@HermesWatcher https://t.co/36GyfV5uje 👀

[TechVerser @realfxw]

乐鑫（Espressif）官方开源了一款非常亮眼的嵌入式利器：基于 Rust 编写的 esp-emulator，无需任何实体开发板，就能在本地终端乃至浏览器中直接模拟运行 ESP32 系列 SoC 固件。

这次更新与功能覆盖相当全面，直击嵌入式开发者和 CI 自动化测试的痛点：

广泛的芯片支持：全面覆盖 RISC-V 架构的 ESP32-C3、C5、C6、H2、P4、S31，以及 Xtensa LX7 双核的 ESP32-S3。不仅模拟 CPU 指令集与 FPU，还还原了 PMP/PMA 权限控制、MMU 与加密加速器。

完整的无线协议栈仿真：
Wi-Fi：内置 Soft AP，支持 WPA2/WPA3 握手、企业级 802.1X 以及 DHCP 服务。
用户态免配置网络（User-mode NAT）：无需 sudo 或 TAP 网卡，开箱即用实现 TCP/UDP 转发；更自带 mDNS 记录重写，支持无缝调试 Matter / HomeKit 配网。
BLE & Thread：BLE 支持配合 Google Bumble 进行纯软件仿真；ESP32-C6 和 H2 支持通过 UDP 桥接两台仿真器，组成两节点的 802.15.4 Thread 真实 Mesh 网络。

无缝嵌入现有开发工作流：
支持 --uart-tcp 桥接，https://t.co/30rBOeGbe1、https://t.co/j5my1es0HO 和 https://t.co/bRnwvwpoOK flash 可以直接通过 socket:// 烧录固件与 eFuse。
内置 GDB 远程调试存根（--gdb），并提供 --trace 输出 Perfetto/Chrome 跟踪文件，无需在固件内插桩即可精确观察 FreeRTOS 任务调度与 CPU 耗时。

零安装体验：官方构建了 WebAssembly 版本并直接部署在 GitHub Pages，只需把编译合并好的 merged-binary.bin 拖拽到网页中，就能实时查看控制台输出、GPIO 状态、寄存器与内存。

单行脚本一键安装体验： curl -fsSL https://t.co/Ysryjs2l2A | sh

做固件 CI/CD、网络协议栈验证或手头没有板子时的救急调试，推荐务必收藏体验！

#ESP32 #Espressif #RustLang #IoT #Embedded #OpenSource

[Jon Gaines @GainSec]

@readswithravi

[LunchAndVR @LunchAndVR]

Skate in your living room with AR/Mixed Reality!

[Jon Gaines @GainSec]

@GAMEBORO What is the chipset of the pcb I’m looking at. And show me its data sheet

[Jon Gaines @GainSec]

I gave my Hermes Agent a body.

RealHermes puts a voice driven AI companion in AR/VR on the Steam Frame (and any WebXR browser). Hold the trigger, talk, it answers out loud. It can see what you see. Ask for a paper and it hangs the PDF in your room.

Available 👇
https://t.co/KvqP0t6lIO

[s1r1us @S1r1u5_]

10 different fucking threads running in my head all the time, its lively but also very toiling.

1. security stuff: keep up with everything happening in security, especially frontier labs, new research, you miss a week you miss 3 months of progress.

2. security research: direct and do security research with my team, keep up with everything they're breaking, figure out what interesting things we should go after next.

3. security harness: direct and build security harnesses with my team, keep up with every new model capability, and constantly figure out how to improve our harnesses.

4. evals: direct and build evals with my team, figure out what models are actually capable of, and make sure we have the best harnesses out there.

5. writing blogs: thinking about things to write on https://t.co/yurLspaabx. there are like 100 different things i want to write about, but actually sitting down and writing them takes a lot of time.

6. twitter shitposting: i fucking love this, but it takes a ridiculous amount of time. keeping up with trends, the zeitgeist, figuring out what i think, putting it into decent english with llms (which doesn't come naturally to me), shitposting and replying to people. it also helps me improve my thinking and the direction of everything above.

7. sales: i do sales in my own weird way. pretty much all the big contracts we've got came from unconventional approaches, usually planning security research, doing interesting things, and building relationships for months before they convert.

8. future of hacktron: constantly thinking about where hacktron should go, and tinkering with multiple ideas with different collaborators, what we should build, what bets we should make, and how the world is going to change.

9. recruiting: finding good researcher can't be automated, its a effort you need to put in by roaming around discord, blog writeups, vulnerability disclosure and find the right one for your mission. i love finding one cracked person who mogs me in every possible way

the list goes on and on, product and engineering, engagement with clients, building networking and relationships, etc

[Jon Gaines @GainSec]

@S1r1u5_ Thought I was the only one

[International Cyber Digest @IntCyberDigest]

‼️ BREAKING: Security firm Calif unveiled an untethered iPhone 18 Pro jailbreak on stage in Paris.

Its Hexacon demo shows the phone on iOS 27.0.1, Apple's latest, giving up a root shell within 2 minutes of boot.

[Ryan Nystrom @ryannystrom]

one of the best improvements to how i communicate is to always delete "i think" from anything i write

[Fav @favwontmiss]

Apps shouldn’t be allowed to call themselves free on the app store when the moment you open them, they hit you with a subscription paywall before you can even use anything. that’s not a free app, that’s false advertising.

[Jon Gaines @GainSec]

@TheAhmadOsman Peep it https://t.co/pPajMjSp5z

[International Cyber Digest @IntCyberDigest]

Regarding the Danfoss refrigeration systems hacked in France:

The username is `admin`, and the password automatically changes every day to... the current date.

Yes, today's date.

The French supermarkets affected in today's attacks had exposed all its refrigeration controllers directly to the internet.

Every single device reportedly used the same password: today's date...

There's also a documented authentication bypass: sending a POST request to /xml.cgi can bypass the login entirely.

Via: GossiTheDog

[Jon Gaines @GainSec]

I just updated TreeHouse Defense System (TDS) to include Steam Frame XR/VR support if you don’t want to use the 3D dashboard.

What if you could step INSIDE your RF environment?

WiFi, BLE, ADS-B, IoT, and much more, all visualized in an interactive 3D world.

Explore it:
https://t.co/mjxjcLUBut

Source:
https://t.co/qxF1Lll5X4

[Chaofan Shou @shoucccc]

I bought a Fable dataset from one of the top Chinese LLM routers yesterday.

With just 6TB data, I can take over 7 Chinese/CIS gov entities & 19 top Chinese firms like Xiaomi, Huawei, NIO, Minimax using SSH keys, VPN configs, Aliyun keys, GitLab tokens sent to the router.

[Jon Gaines @GainSec]

@natashenka @dcuthbert