Mykola Grymalyuk

Stuff at Fruit Co. Formerly OpenCore Legacy Patcher.

[Mykola Grymalyuk @khronokernel]

Forgot to mention, I’ll be at Black Hat/DEF CON for the first time this year. Feel free to reach out! Should be around most of next week

[Csaba Fitzl @theevilbit]

If you would like to kinda work with me :D - this is the place

[Mykola Grymalyuk @khronokernel]

@thedawgyg No remote, in-person in Seattle required

[Mykola Grymalyuk @khronokernel]

Our team for Apple's Bug Bounty is hiring! If you love working on overly complicated vulnerability reports at scale, this is the role for you:
https://t.co/Kx47KSHvTM

[Mykola Grymalyuk @khronokernel]

@D0rkerDevil Correct, in-person in Seattle required

[Mykola Grymalyuk @khronokernel]

I'm genuinely honored to have worked with Dhinak for so long, and super proud of how far you've come! Very excited to see what you do next at Apple!

[Dhinak G @dhinakg]

I'm thrilled to announce that I'll be interning at Apple this summer, starting in a week!

To the friends I've made and the people I've learned from along the way: thank you. This wouldn't have happened without you.

https://t.co/8YFQDAzwTy

[Blacktop @blacktop__]

I’m pumped to be joining the team! This is going to be a great adventure 🦾🤖🍎

[Mykola Grymalyuk @khronokernel]

@blacktop__ God damn, congrats! Please make sure to annoy Bruce for me if you get the chance 😛

[thaidn @XorNinja]

We have some exciting news to share: @blacktop__ is joining Calif to work on a range of R&D projects focused on Apple and AI security.

If you work in the Apple security ecosystem, he’s already a household name. He’s the creator of:

* ipsw – the ubiquitous Apple firmware analysis tool: https://t.co/S763637ijE
* darwin-xnu-build – reproducible XNU kernel builds: https://t.co/Mel4PcLgQs
* ipsw-diffs – automated diffing of Apple releases: https://t.co/96A0D1Zu1Y
* The only public deep-dive on Apple’s Lockdown Mode: https://t.co/bCzLZrDlIM

His tooling is so good that even Apple engineers use it. If you do reverse engineering, chances are you’ve touched his Rust headless IDA MCP server: https://t.co/kkWMn4sGRX.

People have literally collected CVEs and bug bounties just by digging through the diffs produced by his tools.

With @brucedang, @Little_34306 and now @blacktop__, we're building a serious Apple security force at Calif. We’ll have more announcements in this space soon!

If you're interested in Apple security, AI, automated bug discovery, reverse engineering, or hacking, we’re hiring: https://t.co/6EjxrXKetQ.

[Mykola Grymalyuk @khronokernel]

@sharvil @northpolesec @PeteMarkowsky Congrats! Excited to see what’s to come 🎉

[Ivan Krstić @radian]

🔺NEW: iPhone and iPad are now the first and only generally-available devices to meet the exacting security requirements for handling classified NATO information. https://t.co/sKOHGeqaoD

[Mykola Grymalyuk @khronokernel]

@morrisinlife Congrats!

[Gergely Kalman @gergely_kalman]

Come take our training if you're around. Csaba and I have been working on delivering the best macOS vulnerability training we could

[Mykola Grymalyuk @khronokernel]

@m1thr1da @speedyfriend433 I work on the bug bounty team… and I very much promise you real people are on the other side and not “AI”.

[Mykola Grymalyuk @khronokernel]

@speedyfriend433 @m1thr1da I promise you this, several people read each of your reports. There is no LLM making magical decisions on the other end

[Ivan Krstić @radian]

🔺New security-focused developer event on March 5 at Apple Park: featuring sessions on Memory Integrity Enforcement, new tools in Enhanced Security in Xcode, Apple’s defensive security engineering approach, Swift adoption in security-sensitive code, and how to apply all these techniques to protect apps. Sign up: https://t.co/RBLfFQR6zQ

[Ivan Krstić @radian]

🔺This is the first talk I've given in 6 years – featuring formal verification of post-quantum cryptography, the evolution of the Secure Page Table Monitor, a view into Memory Integrity Enforcement, updates to Apple Security Bounty… and a personal note.

[Csaba Fitzl @theevilbit]

The slidedeck to our talk, Crash One: A Starbucks Story - CVE-2025-24277, with @gergely_kalman from @hexacon_fr and @objective_see #OBTS is available from the link below.

It was a macOS vulnerability impacting the crash reporting process where we could achieve LPE and sandbox escape.

https://t.co/FpOf67MBEP

[Mykola Grymalyuk @khronokernel]

Heading out shortly to Ibiza for #OBTS v8.0 🏝️

[Josh Avraham @josh_avraham]

Very excited to see interesting Gatekeeper research!
https://t.co/WpjEjlMM1w