Matthew Kienow

hacks for fun and profit / software engineer / security researcher

PGP: 9DCD 23A2 0181 B684 C21C 0ED2 9903 D880 6069 F788

[runZero, Inc. @runZeroInc]

🚨 New runZero 4.9: We got you, defenders!

📈 Attack path mapping
👁️ Multi-homed detection
🗺️ 2D/3D topology maps
🧠 Deep OT intel + field-level discovery
✅ Protocol exposures
🔥 Risk prioritization
💻 UI/UX updates

👉️ Release info: https://t.co/mGPx7WJynr

#OTsecurity

[Matthew Kienow @HacksForProfit]

GNU Inetutils telnetd pre-auth RCE within LINEMODE suboption SLC (Set Local Characters) handling
https://t.co/CX6IVEeCbO

[Matthew Kienow @HacksForProfit]

Veeam Backup & Replication authenticated domain user multiple RCE
https://t.co/7SFne75GYX

[Matthew Kienow @HacksForProfit]

HPE Aruba Networking AOS-CX authentication bypass (CVE-2026-23813) and more.
https://t.co/NgykQOrYOG

[runZero, Inc. @runZeroInc]

Tracking unsupported edge devices just got easier!

CISA’s BOD 26-02 requires agencies to identify internet-exposed EOS edge devices by May 5, 2026.

Our new Findings tab surfaces them automatically.

👉 Read more from @todb & @HacksForProfit
https://t.co/HXITuQol0e

[runZero, Inc. @runZeroInc]

EOS edge devices exposed to the internet = a 'please hack me' sign on your front door. CISA agrees. And that's what BOD 26-02 is all about.

In our latest blog, @todb, @HacksForProfit & Colin Dupreay break down how runZero customers can get ahead.

👉 https://t.co/WODNt7x3tN

[Stephen Fewer @stephenfewer]

An unauthenticated RCE PoC for the React vuln (CVE-2025-55182) is now public. Confirmed to work on my test setup (Next.js 16.0.6 with React 19.2.0).

[Matthew Kienow @HacksForProfit]

@SipeedIO Thank you

[Matthew Kienow @HacksForProfit]

@SipeedIO Thanks for the quick reply. Hopefully there is better engagement from upstream soon. Are you able to provide sample rates that are possible when using the device in a Linux VM?

[Matthew Kienow @HacksForProfit]

@UjlakiMarci It appears the initial CVSS score for CVE-2025-36636 doesn't align with the description. "Authenticated user" yet the CVSS vector has privileges required (PR) none. The initial CVSS record went through as a 10 for some reason and has not been updated yet.

[runZero, Inc. @runZeroInc]

🎥 Missed runZero Hour live? Catch it on demand!

We recap Hacker Summer Camp highlights:

✅ @hdmoore on SSH vulns + SSHamble updates
✅ Akheron Proxy w/ @HacksForProfit & @Percent_X
✅ @todb unveils EPSS Pulse
✅ OT protocol insights from Rob King

👉 https://t.co/eytRgoTcou

[runZero, Inc. @runZeroInc]

🎙 Hacker Summer Camp recap drops today on runZero Hour!

✅ @hdmoore on SSH vulns + SSHamble
✅ Akheron Proxy w/ @HacksForProfit & @Percent_X
✅ @todb unveils EPSS Pulse
✅ Rob King on OT detection across protocol gateways.

📅 Aug 20 | 10AM PT
🔗 https://t.co/DzJoUdjF4q

[runZero, Inc. @runZeroInc]

🗣️ Happening today at Black Hat Arsenal!

Join @HacksForProfit & @Percent_X at 11am PDT for a live demo of Akheron Proxy, a tool for bridging, capturing, replaying, and manipulating UART inter-chip communications.

📍 Business Hall, Arsenal Station 9
🔗 https://t.co/MSLRhZ6RlU

[HD Moore @hdmoore]

I'm excited to announce our "Out-of-Band" series; focused on the security risks of management devices like BMCs, serial servers, and KVMs. "Out-of-Band, Part 1: The new generation of IP KVMs and how to find them" is now live at:
https://t.co/aiRRT8k54a

[HD Moore @hdmoore]

A PSA for why you should probably not use Postman (it can leak secrets to them): https://t.co/9gV3bt0eU0

[Deral Heiland @Percent_X]

I spoke with @robertvamosi on ErrodCode podcast
awhile back on "Hacking Cellular-Enabled IoT Devices" We had a fun conversation. The podcast was just published so please check it out - https://t.co/PlkTmIF4KY

[Stephen Fewer @stephenfewer]

We have just published our AttackerKB @rapid7 Analysis for CVE-2024-47575, the recent FortiManager 0day, aka FortiJump 🔥 Read our full technical analysis; detailing firmware decryption, protocol analysis, and unauthenticated RCE 🚀 https://t.co/axuhj0kMuN

[Caitlin Condon @catc0n]

CVE and vendor advisory now available on the #FortiManager 0day that's been knocking around the rumor mill (and evidently some Fortinet customers' email inboxes) for a while. Mitigate immediately, but IOCs need investigating, too. https://t.co/3DfN94S78O

[Matthew Kienow @HacksForProfit]

@evilsocket Open Source is Magic!