Giuseppe Calì

I like to take apart stuff to understand how it works. When I'm lucky, it even turns on afterwards. Pwn2Own Tokyo '26

[Giuseppe Calì @_gcali]

Setting up your Pwn2Own target in a capsule hotel and spending the night before the attempt debugging the exploit for fun and profit

[Giuseppe Calì @_gcali]

@howrealsung @typhooncon @SecuriTeam_SSD Congrats buddy 👏🏻

[Paolo Stagno (VoidSec) @Void_Sec]

I originally prepared this bug for Pwn2Own Berlin. A few days before the contest, a CVE got assigned. So, here is my technical analysis and exploitation strategy for CVE-2026-40369: a 12-byte kernel increment, exploitable both as an LPE and SBX.
https://t.co/agxyuR2AjE

[Giuseppe Calì @_gcali]

@hi_im_d4rkn3ss Congrats! 💪

[Giuseppe Calì @_gcali]

My infinite gratitude goes to everyone who went out of their way to help me with this.

Not the outcome I had hoped for, but hey, at least I failed at something incredibly difficult (and learned a ton in the process). 🙃

[TrendAI Zero Day Initiative @thezdi]

Unfortunately, Giuseppe Calì of Summoning Team (@SummoningTeam) could not get their exploit of VMware ESXi working within the time allotted. #Pwn2Own #P2OBerlin

[Thach Nguyen Hoang 🇻🇳 @hi_im_d4rkn3ss]

i did it again 🙏🙏

[Orange Tsai 🍊 @orange_8361]

That's my chain — a full chain w/ logic bugs only! No memory corruption, no AI, and of course no collisions at all 😉

[Giuseppe Calì @_gcali]

I'm thrilled to announce I have achieved a new level of eyebags trying to make this Pwn2Own participation happen

[Paolo Stagno (VoidSec) @Void_Sec]

Bug count != exploitable bug. Finding != chaining.
LLMs are exceptional at pattern recognition on known bug classes. They are not reasoning about novel failure modes in complex multi-component systems.
The hard bugs still require humans. https://t.co/RISinVDT3d

[Giuseppe Calì @_gcali]

@boredpentester You can definitely sit on a full chain for a few days and not hurt people who managed to register 🤷‍♂️

[Josh @boredpentester]

Pretty sure the vendor reports before the competition starts are likely actively hurting the competitors that have flown out just to have their bounty halved as the issues are now considered 'known'. Equally, you can't just sit on a full chain. Far from the ideal situation...

[Giuseppe Calì @_gcali]

@eeyitemi After watching Orange Tsai’s talk on Pulse Secure, I was inspired to take a look myself. I failed pretty hard on the original target, but I did find a TOCTOU bug in the client that led to local privilege escalation. That became CVE-2020-13162. :-)

[h0mbre @h0mbre_]

think i found a bug. which means it’s time to take a break and enjoy the possibility before looking more closely and finding out there’s a check in an upstream code path I missed

[Giuseppe Calì @_gcali]

@qriousec Nice, good luck!

[Giuseppe Calì @_gcali]

@mncoppola Not the case either, but good call!

[Giuseppe Calì @_gcali]

@asert17240 'preciate that 🙏🏻

[Giuseppe Calì @_gcali]

@TheTortillaJ Looking forward to the day they port this to SPARC

[Giuseppe Calì @_gcali]

@mncoppola It doesn't, but it would make no difference in this case. The first thing overwritten is that pointer, and NULL bytes are not allowed, so I can't place a valid pointer there. Nothing interesting seems to be possible via a partial overwrite of said pointer either 🥲

[Giuseppe Calì @_gcali]

@cvewhen They got that one right! They should also use memcpy() instead of sprintf() so I could inject NULL bytes, but clearly they're not interested in doing things well...

[Giuseppe Calì @_gcali]

@DanFromUranus @_ringzer0 Check your DMs

[Giuseppe Calì @_gcali]

If you like VPN exploits as much as us, you're going to love this course Zeroshi is bringing to @_ringzer0!

Marco will walk students into opening up edge devices for research, mapping their attack surface, finding vulns and building full exploit chains.

https://t.co/nYihjiqSls

[SinSinology @SinSinology]

🪲 Registration is Open NOW! (@reconmtl)
https://t.co/AJthH2ptJ2