Paolo Stagno (VoidSec)

Director of Research @Crowdfense.
Windows Vulnerability Researcher and Exploit Developer, ex-@XI_Research

[Paolo Stagno (VoidSec) @Void_Sec]

I originally prepared this bug for Pwn2Own Berlin. A few days before the contest, a CVE got assigned. So, here is my technical analysis and exploitation strategy for CVE-2026-40369: a 12-byte kernel increment, exploitable both as an LPE and SBX.
https://t.co/agxyuR2AjE

[Paolo Stagno (VoidSec) @Void_Sec]

Love the timing of MSRC alienating the entire vuln research community while AI makes finding/exploiting bugs cheaper than a Netflix subscription. What a truly visionary threat model

[Paolo Stagno (VoidSec) @Void_Sec]

@aionescu Was a nice bug though

[Paolo Stagno (VoidSec) @Void_Sec]

@f_roncari @justandrijana @offensive_con Lol, cannot resist this incredible offer

[Paolo Stagno (VoidSec) @Void_Sec]

@TheRaildex1 @justandrijana @offensive_con Thanks, appreciated!

[Paolo Stagno (VoidSec) @Void_Sec]

@cogitoergor00t @justandrijana @offensive_con Than I failed miserably xD

[Paolo Stagno (VoidSec) @Void_Sec]

@justandrijana @offensive_con @f_roncari 😮

[Paolo Stagno (VoidSec) @Void_Sec]

@orinimron123 @M4x_1997 Ah man, we collided on this one. Was a great vuln while it lasted :/

[Paolo Stagno (VoidSec) @Void_Sec]

@conduit0x00 @S1r1u5_ @udunadan @malltos92 100%

[Paolo Stagno (VoidSec) @Void_Sec]

@S1r1u5_ The monetary incentives for p2o are pretty bad compared to the bonuses any VR boutique will compensate the researcher for a Chrome RCE

[Paolo Stagno (VoidSec) @Void_Sec]

@DrapGreg It is, the focus was only for vuln research. The automation that can be done with it are innegable.

[Paolo Stagno (VoidSec) @Void_Sec]

423 Firefox bugs fixed in a month with AI. Impressive throughput.
But I've seen this pattern before.
It's the fuzzer era all over again. Here's why:

[Paolo Stagno (VoidSec) @Void_Sec]

@SYNLabs_SG That's my expectation and also what I hope, to be honest :)

[Paolo Stagno (VoidSec) @Void_Sec]

@uglybyte Thx, appreciated

[Paolo Stagno (VoidSec) @Void_Sec]

@malltos92 If we had scheduled them, we couldn’t have done any better. Always interesting to read your takeaways on the industry

[Paolo Stagno (VoidSec) @Void_Sec]

Bug count != exploitable bug. Finding != chaining.
LLMs are exceptional at pattern recognition on known bug classes. They are not reasoning about novel failure modes in complex multi-component systems.
The hard bugs still require humans. https://t.co/RISinVDT3d

[ς๏гєɭคภς0๔3г ([email protected]) @corelanc0d3r]

The wait is over! mona v3 is now available.

Supports Python 2 & 3,
32- and 64-bit targets,
WinDBG/WinDBGX.

Faster, leaner, broader built for modern Windows debugging and exploit development.

#mona #corelan

https://t.co/8tkCp0wD0C

Sharing is caring 💛

[Paolo Stagno (VoidSec) @Void_Sec]

100%, true experience

[Paolo Stagno (VoidSec) @Void_Sec]

Red team friends, show some love!

[Electroxero @knifesec]

Finally back to the forge. ⚒️

I revisited an old friend, #CaddyWebServer, and forged kCaddy: a malleable Caddy redirector for #RedTeam ops.

New post: proxying and obfuscating #Evilginx with M365, Google, and Okta phishlets.

https://t.co/TFCOXdx1Hr