Marina

I'm a young programmer, cybersecurity researcher, and bug hunter.

[Marina @dejamarina]

@VRChat waited NEARLY THREE WEEKS to tell affected users that their information had been exposed in a third-party breach.

Canny, the website VRChat uses for its feedback website, sent out a notice to all affected parties on August 28th, 2026. And VRChat KNEW.

#breach #vrchat

[Marina @dejamarina]

Latest X86 Aluminum OS Image booted FULLY under QEMU (with the help of Cuttlefish). Working with mouse, keyboard, internet, and more! Source being released at the end of this month. Thanks to the help of #mysticgsi ❤️

#android #desktop

[Marina @dejamarina]

stubbed my toe and it hurt so i blocked Nintendo of America on twitter

[Marina @dejamarina]

@loop0420 LMAO they ghosted me after I gave them a proof of concept of my work. Thankfully it was only an exe and not the actual source code

[Gezine @gezine_dev]

I created switch 1/2 userland exploit that is not webkit or save exploit

"But we already have userland exploit from day 1"
The difference is existing userland exploit is based on save exploit which can't be used without save transfer using Nintendo Online Service

Which forces you to be at latest fw
So even if kexploit or some sw based privilege escalation is found 99% people can't use save exploit.

But this one works without any restriction and works at all fw

Why not hack the webkit?
Switch 2 webkit has Arm PAC(Pointer Authentication Code) that prevents ROP code execution
So I avoided it as there was more easy one to exploit it

[Marina @dejamarina]

@irazz2745 No, entire repository Metadata. Not just branch name.

[Marina @dejamarina]

@VortexXzy I will release the poc when I get the all clear from github

[Marina @dejamarina]

@0day_ninja More victims and plenty more unsecure lol

[Marina @dejamarina]

@4D4J_ Yes, once they say I can disclose I'll disclose

[Marina @dejamarina]

Is this aura?

[FluxerPreviews @FluxerPreviews]

Is Fluxer as private and open source as it claims? We've found evidence of the platform fingerprinting users and developing behind closed doors.

https://t.co/f8WITJ6ctW

#fluxerapp #fluxer

[Marina @dejamarina]

Eden is now out! Check the README for both how to run it and how to build it https://t.co/ouQ6aX3FcH

#cybersecurity #windows

[Jawad Momani 🇯🇴 @pwnedl0l]

I am exposing the systematic failure of their triage process, the proof of a critical BOLA, and how leadership prioritized vendor PR over security.

Read the full disclosure here: https://t.co/Iart9ff2N0
#bugbounty #cybersecurity #infosec

[Marina @dejamarina]

@0xmadvise @67_throwaway @C2IRIS https://t.co/NX7bZuZrtu

[Marina @dejamarina]

Eden is going public in a week or so.

I will also look into responsibly disclosing ITrustYouDLL. ITrustYouDLL is sort of a let down. It runs as the same user and same permissions but oh well.

[Marina @dejamarina]

@0xmadvise @67_throwaway @C2IRIS Where else would I put it lol

[Marina @dejamarina]

@Klonolan @girlsbian_ Humans don't have scales. If you're talking softness, skin cells respond to sex hormones. More estrogen means softer skin. More testosterone means rougher skin.

[Marina @dejamarina]

@ChaoticEclipse0 Doesn't seem like you can. The closest thing I could find is that defender adds:

<OperationParam path="\ProgramData\Microsoft\Windows Defender\Offline Scanner\OfflineScannerShell.exe <-Threshold -AutoScan -Inbox -UpdateSugs -ConsoleUi %gt;"/>

But that doesn't offline scan