Aaron Grattafiori

Offensive Security / AI @Umbriel_AI. Ex-AI RT and OffSec at NVIDIA, RT lead @ Meta. Ex-Principal Consultant and Researcher @ NCC Group/iSEC Partners. Neg9//CTF.

[Aaron Grattafiori @dyn___]

Current Status feels like this is no longer going to be fiction...

[Justin Elze @HackingLZ]

"We still need to find those interesting areas of complexity, and let our curiosity guide us." 🔥

https://t.co/B7qCPO3e1W

[Aaron Grattafiori @dyn___]

This was really cool research for how to properly use LLMs to push fuzzing along.

[Offensive AI Con @OffensiveAIcon]

New talk up OAIC 2026: Vibe Fuzzing with Sam Lovejoy @_dinolover38 of IBM X-Force Offensive Research.

Sam explores how graph-based inputs, program state, and LLM guidance come together in an AI-guided fuzzing engine- and the tradeoffs behind it.

Watch the full talk: https://t.co/zFcLR5AvZd

#OAIC #OffensiveAI #Fuzzing

[Aaron Grattafiori @dyn___]

@justdionysus Send me all your findings, and I'll let you know how they match up! 🙃

[cje @caseyjohnellis]

reminder: vulnerability discovery and exploit development are not the same thing

[Aaron Grattafiori @dyn___]

@0xTib3rius The 0days will continue until the awareness improves...

[Aaron Grattafiori @dyn___]

@miike How much did this cost? If someone else was to do it with API access? I'm guessing something like $1M+

[Aaron Grattafiori @dyn___]

@IceSolst @MTSlive Phpongyang

[Aaron Grattafiori @dyn___]

@IceSolst Pretty sure that was last year

[Aaron Grattafiori @dyn___]

@HackingLZ Formally verified system: Opus 12 *online*

Formally verified system: error: counterexamples found: many human mistakes.

Formally verified system: solution proposed: eliminate humans.

Formally verified system: solution confirmed! Execute.

[Aaron Grattafiori @dyn___]

@IceSolst Plan: run for the hills

[lcamtuf @lcamtuf]

I love our industry, but why is our underlying thesis always that yes, PHP is ONE TRILLION LINES of terrifying C, and we've always known this, but if we can fix this one vuln, nothing bad can ever happen to us again

[Aaron Grattafiori @dyn___]

@turtlekiosk Yeah that for sure helps

[Aaron Grattafiori @dyn___]

@moyix Could be real 🤷

[Rafał @rafalohaki]

Working RCE against PHP 8.5.12 (the 2026-10-21 security release that fixed CVE-2026-109618/109619).

Pure logic bug — no memory corruption,
ASAN-clean, orthogonal to the CVE-2026-109618/19 class.

Receipt: uid=33(www-data) over HTTP, one-shot

#infosec #php2shell #php

[Aaron Grattafiori @dyn___]

@moyix In HS bought a book on Novell, captured a login, learned how/where to configure the starting apps and setup Quake 2 as one of the server mapped applications auto installed on login, but only for the student group.

It was epic for a few hours until they figured it out 😂

[0xor0ne @0xor0ne]

Exploiting Broadcom WiFi Across eCos and Linux (@qkaiser)

https://t.co/IU5hOGAYyn

Slide deck: https://t.co/pjbBIytmlI

#infosec

[Aaron Grattafiori @dyn___]

@4Dgifts Oh I agree there's some amount of pay to play now, in addition to access that only some companies have, or only some companies can pay to research... This I think is bad in the long term.

It's always been a little bit this way? But now it's on a whole other level.

[Aaron Grattafiori @dyn___]

Yep. Because you can't just prompt "find me all the vulnerabilties". Maybe in awhile but we're nowhere near that now.

Skilled researchers, custom harnesses, and other techniques are changing the bug depth game, in addition to bringing down the cost.

[ℏεsam @Hesamation]

wait, PHP was actually scanned by Anthropic’s Claude Mythos earlier this year. they also had access to OpenAI’s Daybreak Red for validating exploits.

the PHP Foundation revealed this JUST yesterday.

keeping frontier cyber models in the hands of a selected few doesn’t seem to be working well for the internet.

https://t.co/rangh8iW6M

[Aaron Grattafiori @dyn___]

@4Dgifts If you put more work into your harness and analysis, you don't need the model as much as well as pulling up smaller model performance or using AI to build new systems, etc.

[Aaron Grattafiori @dyn___]

@HackingLZ PHP2SHELL but via AI Worm... Omg... Someone just detected it on their smart toaster... Holy shit...what if.

[Aaron Grattafiori @dyn___]

@HackingLZ @bot How's this actually working... I set this up myself awhile ago and it was bad at surfacing "new" things, but these seem to have improved on that.

[Aaron Grattafiori @dyn___]

@HackingLZ @moyix "I have found 1,507..."