Michael Stepankin

Agent Security Engineer at @Google

[Michael Stepankin @artsploit]

Prompt injections are a serious concern for VS Code Copilot Agent.

Discover how attackers can create GitHub issues with harmful instructions and find out how to protect the coding agent effectively.

https://t.co/uQbNhdFqGr

[Jaroslav Lobačevski 🇱🇹🇺🇦[email protected] @yarlob]

The curious case of exploiting locally running web app
https://t.co/oWQl5gqudP

[watchTowr @watchtowrcyber]

The industry is ablaze w speculation around yesterday's publicly disclosed Veeam Software Backup & Replication RCE vulnerabilities (CVE-2025-23120).

We reported these vulnerabilities to Veeam in early February, tracked as WT-2025-0014 and WT-2025-0015.

https://t.co/h162duIgty

[Michael Stepankin @artsploit]

@samwcyo @infosec_au Just wow

[Michael Stepankin @artsploit]

Here is the blog post: https://t.co/HW2zDY8Tbc

[Michael Stepankin @artsploit]

Last year, I committed to uncovering critical vulnerabilities in Maven repositories. Now it’s time to share the findings: RCE in Sonatype Nexus, Cache Poisoning in JFrog Artifactory, and more! Read it all below 🧵

[Michael Stepankin @artsploit]

Hyped to speak at @ekoparty in November!

[Michael Stepankin @artsploit]

Just submitted a CFP to @ekoparty where I want to talk about breaking Maven repository managers. This is the one of the craziest and fruitful research projects I've done in my career.

[Martin Doyhenard @tincho_508]

So happy to had the chance to present for second time at #BlackHat USA!

I’m already receiving a lot of messages from people using these techniques to get some nice bounties!

If you want to learn more about cache exploitation, the research is available at https://t.co/A3DoIdBZ6N

[Michael Stepankin @artsploit]

Kafka UI can be a juicy target for bug hunters, here is why: https://t.co/oTHgSO8J3b

[Source Incite @sourceincite]

Time to retire some content!

JNDI Injection Remote Code Execution via Path Manipulation in MemoryUserDatabaseFactory: https://t.co/bN1ygdLhWm

[Michael Stepankin @artsploit]

We take pet’s security seriously!

[publiclyDisclosed @disclosedh1]

Mars disclosed a bug submitted by @0xdr34m14: https://t.co/35hVFmq0KE #hackerone #bugbounty

[GitHub Security Lab @GHSecurityLab]

🚨 New Blog Alert! 🚨
Can an attacker execute commands by sending JSON? Learn how unsafe deserialization vulnerabilities in Ruby can be exploited and how they can be detected with CodeQL.
🔗 Read the full post: https://t.co/tdumVwrfKC
Stay safe and code responsibly! 🛡️💻

[Charles Fol @cfreal_]

The first part of the blog series: #Iconv, set the charset to RCE. We'll use #PHP filters and #CVE-2024-2961 to get a very stable code execution exploit from a file read primitive. #cnext

[Man Yue Mo @mmolgtm]

In this post I'll use CVE-2023-6241, a vulnerability in the Arm Mali GPU that I reported last November to gain arbitrary kernel code execution from an untrusted app on a Pixel 8 with MTE enabled. https://t.co/Flsas2jJtv

[shubs @infosec_au]

The SSRF/auth bypass affecting Ivanti Pulse Connect Secure (CVE-2024-21893), is a great example of what can be achieved with a fully blind SSRF vulnerability (RCE).

Read the @assetnote blog here which includes a reliable payload and generation steps: https://t.co/cOYpmbWHrS

[Alvaro Muñoz @pwntester]

Discover the latest insights from our @GHSecurityLab team’s audit on @home_assistant security! 🛡️
https://t.co/02PHTuECHi #CodeReview

[Man Yue Mo @mmolgtm]

In this post I'll use CVE-2023-4069, a type confusion bug in the Maglev JIT compiler of Chrome that I reported in July, to gain RCE in the Chrome renderer sandbox: https://t.co/Mas6ALpKiO

[Michael Stepankin @artsploit]

@0xor0ne Thanks for sharing!

[Kev @kevin_backhouse]

Video of my PoC for CVE-2023-43641: out-of-bounds array access in libcue. libcue is used by tracker-miners, which automatically scans new files in ~/Downloads, so the bug is triggered by downloading a file.