Andreas Schmidt

Security Researcher, Author of WATOBO

[guyru @guyru_]

We're mostly an IDA shop at @CellebriteLabs, but I decided to play around with Ghidra. My main motivation was to experiment with agentic reverse engineering techniques. The result is an agent skill for Ghidra, which we are releasing publicly:
https://t.co/mPrNFR8mOq >>

[Dino A. Dai Zovi @dinodaizovi]

This is really good, @AnthropicAI posted a document on how to apply the principles behind Zero Trust to AI Agents:

https://t.co/bli719l9M4

[Moritz @m_r_tz]

The FLARE team now freely distributes its quality reverse engineering and malware analysis educational content at https://t.co/bGCIjBfD3C. Launched with:
- Malware Analysis Crash Course
- Go Reversing Reference
- Intro to TTD

[shubs @infosec_au]

We got frustrated with dealing with vendor dependencies when reverse engineering large applications. @ITSecurityguard from @SLCyberSec’s Sec Research Team built Hyoktesu to solve this problem forever: https://t.co/rQM2ypLLuW - releasing this today! Blog: https://t.co/KCPSTnFjVN

[Patrik Grobshäuser @ITSecurityguard]

I finally let Claude do my pentest this week. Full 5-day engagement, zero human input. Here's what the client got: 😏

https://t.co/1PPuxhs4V9

#bugbounty #pentesting #AI #cybersecurity #infosec #claudeai

[Dan Guido @dguido]

@mattshumer_ The @trailofbits security auditing skills! Teach Claude to be an expert bug hunter: https://t.co/vI4amorZrc

[Florian Roth ⚡️ @cyb3rops]

Oracle RCE Vulnerability CVSS 10.0 - affecting Weblogic Server Proxy Plug-in for Apache HTTP Server, Weblogic Server Proxy Plug-in for IIS

https://t.co/jHJ1Ogvz68
https://t.co/KDO1wGrm7C

[chrisrohlf @chrisrohlf]

When asked about LLM memory corruption exploit generation in the 2023-era of models I would often say that they were getting better at code generation but lacked understanding of how that code would execute at runtime, and that was a prerequisite for exploit generation.

This requires reasoning and observation of code transformations through compilation steps, context and understanding of specific details of modern operating systems, memory allocators, caches, file formats etc. and how they affect program runtime. These are all details exploit developers obsess over with surgical precision out of necessity because you must be right every single time or your exploit just won't work.

Since that 2023-era we have seen significant advancements in AI through RL/scaling but also a lot of agentic development. This has allowed the models to not just explore code better but also observe its runtime as it reasons through and builds exploitation primitives.

The section on mitigation bypasses in Sean's writeup demonstrates why these capabilities are so hard to achieve without these advancements. They require the ability to reason not just about the code itself, but about how it will behave at runtime, and observe those behaviors as the primitives in the vulnerability, and the state space they create, are explored.

A javascript interpreter is really a best case scenario for this kind of experiment because the attacker can run arbitrary code to shape the runtime in a way that is conducive to reliable exploitation. But conversely, a javascript interpreter is complex with many APIs that are reenter the Javascript runtime and lead to things like use-after-free vulnerabilities.

This a very exciting time in program analysis and software security. Anyone who doubts this technology as a game changer is not paying attention.

https://t.co/p3va1uUjs0

[Josef Strzibny @strzibnyj]

Ruby received a beautiful website redesign 💎

https://t.co/4uNJy92C6D

[DHH @dhh]

"Shopify is the patron saint of Ruby on Rails. Its infrastructure team is the backbone of our ecosystem, and its continued success the best case study of how far you can take this framework and language. They deserve a gawd damn parade for all they do." https://t.co/QuRCRgZW8K

[Graham Neubig @gneubig]

Big news! We made the basic tier of the OpenHands Cloud FREE!

This means that you can call state-of-the-art coding agents from your computer, phone, github, gitlab, slack, etc. for just the price of API credits or hosting your own language model!

🧵👇

[Dirk-jan @_dirkjan]

I've been researching the Microsoft cloud for almost 7 years now. A few months ago that research resulted in the most impactful vulnerability I will probably ever find: a token validation flaw allowing me to get Global Admin in any Entra ID tenant. Blog: https://t.co/jD6EaGtsn3

[CODE WHITE GmbH @codewhitesec]

Ten days left. The warm-up fades. Maultaschen were soft. Bean Beats were dark and burnt. But the beats of #ULMageddon will be brutal! #applyIfYouCan

[mufinnnnnnn @mufinnnnnnn]

https://t.co/hSran2yGNW this is so sick. i'm confident if i had the bug i would not have exploited it.

[joernchen @joernchen]

Today I have a more serious topic than usual, please consider reposting for reach:

My wife and I are urgently looking for a specialist in neuropediatrics or a similar field for our autistic child with a diagnosed, but not further specified, movement disorder [1/3]

[CODE WHITE GmbH @codewhitesec]

We've added a new demo to NewRemotingTricks that makes deploying a MarshalByRefObject (e.g., WebClient) even easier: System.Lazy<T> creates an instance of T on serialization, which is probably more likely to be allowed than a XAML gadget getting through. https://t.co/JhxnpXPDa5

[TrendAI Zero Day Initiative @thezdi]

Announcing #Pwn2Own Ireland for 2025! We return to the Emerald Isle with our new partner @Meta and a $1,000,000 WhatsApp bounty. Yes - one million dollars. Plus new USB attack vectors on phones and more. Check out the details at https://t.co/dgHvL8QC2R

[Khoa Dinh @_l0gg]

Blog for ToolShell
Disclaimer: The content of this blog is provided for educational and informational purposes only.
https://t.co/gT0aoKXkig
#SharePoint #ToolShell

[Marcell Ujlaki @UjlakiMarci]

oh no

🟥 CVE-2025-32463, CVSS: 9.3 (#Critical)

#Sudo version 1.9.14 to 1.9.17

#Vulnerability allows local users to gain root access via the --chroot option due to improper handling of /etc/nsswitch.conf.

#CyberSecurity #CVE #PrivilegeEscalation

https://t.co/nYZy5HjHkh

[Florian Roth ⚡️ @cyb3rops]

PoC Exploit for the NTLM reflection SMB flaw CVE-2025-33073

https://t.co/tkgfd5UnEp