Alfredo Pesoli

Explorer of weird machines. Founder/CEO @bynar_io

Prev: Immunity Inc

[pam @pamoutaf]

Here’s the demo I showed during my talk. It’s not the best video but unfortunately that’s all I have. This shows the output of the ID command

[Phrack Zine @phrack]

30 years ago today, Phrack 49 published Aleph One’s “Smashing the Stack for Fun and Profit”.

A legendary paper that inspired generations of hackers and helped shape modern exploit development.

Still an essential reading.

https://t.co/qAQ5CWgNj0

Phrack 73 is coming soon!

[bynario @bynar_io]

You've probably seen plenty about PHP2Shell by now: two critical PHP vulnerabilities, potential unauthenticated RCE, and a lot of PoCs flying about.

But what does responding to this actually look like for defenders?

With AI accelerating the path from disclosure to exploit, there's less time to work through thousands of vulnerability findings and figure out what's relevant to your environment.

In our latest post, we walk through how Precog helps triage PHP2Shell in your own environment, from identifying affected workloads and validating vulnerable behaviour against your actual application in a sandbox, through to prioritising fixes and guiding remediation.

https://t.co/4rl5ATSdBQ

[pam @pamoutaf]

@Meta patched my arbitrary code execution on the Meta Ray-Ban 😎
Blogpost or talk?

[bynario @bynar_io]

Here's what happened last month at Bynario:
- @daisyydaisy_ joined us 👀
- Company retreat in beautiful Franciacorta, Italy 🇮🇹
- 12 new vulns disclosed (CVE-2026-80795, CVE-2026-80794, CVE-2026-91945, ...) 😮‍💨
Find more information about our disclosures here https://t.co/15jDb2Y4Hw

[Halvar Flake @halvarflake]

Time to take a twitter break again for a few hours and do useful work.

Please, can we stop assuming AI will not be subject to 2nd law of thermodynamics, cost of information acquisition, noisy channels, measurement errors, etc. etc. etc.

[Clarín @clarincom]

MURIÓ ANDRÉS BLANCO, REFERENTE DEL HACKING ARGENTINO

Tenía 44 años y era especialista en seguridad de redes Wi-Fi. Trabajó en Core Security y presentó investigaciones en conferencias internacionales como DEF CON y Black Hat. Además, descubrió vulnerabilidades en chips utilizados por Apple, Samsung y Motorola.

También tuvo una fuerte participación en Ekoparty, donde presentó trabajos y preparó desafíos para enseñar seguridad informática. Colegas, amigos y alumnos lo recordaron como un mentor generoso y destacaron su disposición para compartir conocimientos.

Los mensajes de despedida

“Hay gente a la que 'grande' le queda chico, Andrés era de esos. Tenía un corazón abierto, con ganas de enseñar, acompañar y por sobre todo ayudarte a ser tu mejor versión” — Federico Kirschbaum.

“Nuestra comunidad perdió un hacker con todas las letras, de los que la curiosidad y la capacidad hacen que quienes lo rodean crezcan y aprendan con él” — Ezequiel Gutesman.

“Nos enseñaste a defendernos. Nos enseñaste puntualidad. Nos enseñaste a perder muchos miedos. Confiaste en nosotros y en lo que éramos capaces, tanto en lo personal como en lo profesional” — Joel Noguera y Florencia Ortelli.

“Fue un gran mentor en lo profesional, un hacker puro y duro, hecho a los cachetazos, que supo dar charlas extremadamente técnicas en los mejores escenarios del mundo” — Lautaro “LeFF” Fain.

(+) en Clarín: https://t.co/3hjNmfnYLn

[Claudio Caracciolo @holesec]

Muy lindo artículo para honrar a Andrés Blanco:

https://t.co/OXZkP3NQMp

#qepd

[Alfredo Pesoli @__rev]

You will be deeply missed, Andrés. We lost an incredible human being, a great hacker, and a friend.

I will cherish your memory, and everything I learned from you. The stoicism lesson is a difficult one at the moment.

Che la terra ti sia lieve, Andrés

[Federico Kirschbaum @fede_k]

Tengo la triste noticia que Andrés Blanco @6e726d falleció el día de hoy. Se nos fue un gran hacker, amigo y mentor. Memento mori solía decirme, Memento Mori.

QEDP

[Alfredo Pesoli @__rev]

If you were curious about the FreeRDP pre-auth RCE, @sam4k1 did an incredibile job in documenting the entire chain here

[bynario @bynar_io]

Check out @sam4k1's latest write-up: a technical deep dive on how three vulnerabilities we reported in FreeRDP can be used to achieve pre-auth RCE by popping a remote shell with some old school memory corruption shenanigans 🐧

https://t.co/GqMp5s6GO4

[Alfredo Pesoli @__rev]

@sam4k1 extending pre-auth RCE support to Linux via GNOME Remote Desktop 🔥

[bynario @bynar_io]

FreeRDP 3.31.0 fixes a number of security issues, including five server-side ones reported by us.

If you use Gnome Remote Desktop, KDE krdp or other software that uses FreeRDP then make sure you update your packages.

Not wanting macOS to have all the limelight, @sam4k1 was able to chain several of these vulnerabilities to achieve pre-auth RCE against a Gnome Remote Desktop server.

Note: only GRD 51 pre-release versions should be affected by the chain we demonstrated (currently used by Fedora 45 & rawhide, CentOS Stream 11 and Arch's gnome-unstable repo); see our oss-security advisory in the comments for more details on impact + exposure.

A technical write-up will follow after folks have had time to get patched!

[Brad Spengler @spendergrsec]

Bas! https://t.co/zzQQRUkqHQ

[bynario @bynar_io]

We're excited to welcome @pamoutaf to the research team! Watch this space 👀

[bynario @bynar_io]

macOS 26.6.1 just patched a critical pre-auth root RCE in screensharingd that we disclosed 🚀

[Alfredo Pesoli @__rev]

@fpietrosanti Happy to. Organizzo internamente e ti aggiorno

[Alfredo Pesoli @__rev]

We released details on a blog for a post-vnc-auth, we got that fixed by disclosing it. A different bug that requires legacy VNC to be enabled AND knowing a password.

You released a pre-auth remote root poc you were sitting on, because you couldn’t remain in bed. Reached so hard to call us out while it was evident the DoS CVE was what got “your” bug patched, not ours. Used a whole lot of crazy words in front of a screen (this one always impresses me) and got mad because “your” bug was patched.

I’m sure the situation is clear.
And you’re going in circle. I’ve clarified what needed clarification here.

[bynario @bynar_io]

Following our recent screensharingd disclosure, a separate pre-auth issue has also been highlighted; fortunately, it's also patched!

You can find the technical details for our bug on our blog, essentially it uses the RFB Security Type 2 (VNC Authentication) which requires legacy VNC password access to be enabled. This in contrast to the pre-auth vulnerability which uses a separate authentication path, likely patched by one of the other screensharingd fixes in 26.6.

As we've stated from day one, our vulnerability discovery and validation solutions at @bynar_io are autonomous.

We use this capability to automate our internal research, at scale, on a variety of systems and targets, as a small team.

Our goal is pretty simple: find genuine security issues and get them fixed.

We're all passionate about security research, but as a small team, and with over 50 bugs in the queue that need to be reviewed and submitted, we don't always get to spend as much time as we'd like on each surface. Instead, once we've determined something's a genuine security issue, our priority is getting it fixed.

It's certainly not a flawless approach, but it aligns with our mission and for us beats sitting on bugs while users remain vulnerable.

[bynario @bynar_io]

Apple patched an incredible number of bugs in this July release (26.6). We like our CVEs served with a side of PoC, especially those that provide a shell and not just a crash.

We believe this one is of particular interest because, well, it gives you a root remote shell on the latest Apple M5!

That's right, a root remote command exec in macOS, in 2026?! Well, before anyone gets too excited: it's post-auth, and legacy VNC is disabled by default. But when it's enabled and you have the VNC password... root from remote 🤓

For some reason its description and severity were _slighty_ understated, but we demonstrate two bugs that lead to root RCE... No MIE/PAC bypass necessary, these are logic bugs.

This is CVE-2026-43760, found by @__rev with Bynario Atlas and GPT 5.5.

https://t.co/GAPb7KLLBq

[sam4k @sam4k1]

My team is hiring! 🙌 Check out the link below for more details, feel free to ping me if you have any Qs :)