Hayk Andriasyan

Lead Security Researcher @hexens | web, crypto, java, codeql, zk, fhe | OSWE

[hexens @hexens]

1/
we found a bug in the Aptos Move VM that put up to $70B at systemic risk. type confusion at the execution layer. a ~90% success rate across hundreds of simulated runs on a 30+ validator cluster. cost to build the attack infrastructure: $3,000.

Conducted by @kemmio , to our knowledge this is the first public research that showcases how to land a sophisticated multi-block attack in real-world environments. It includes mempool feng shui, block production specifics and about a dozen of other primitives and tricks chained to get to near-perfect exploitation results.

Nonetheless, Aptos called it "extremely low exploitability."

[https://t.co/vjeLaENYn0]

[FHE.org @fhe_org]

New resource added to @fhe_org resources :

"Awesome FHE Attacks: A curated list of research, articles, tools, and resources focused on attacks against FHE" by Hexens

https://t.co/jVTPv6V0hq

Know of an FHE resource that should be shared? Let us know below!

#FHE #homomorphicEncryption #security

[hexens @hexens]

The ETHSecurity badges distribution from @thedaofund is finished now.

We are proud to share that members of Hexens team are part of this important initiative:

@andykoo — Lead Security Researcher
@p0wn4j — Lead Cryptography Security Researcher
@kemmio — CTO & Co-Founder

TheDAO's mission is to make Ethereum safer, and ETHSecurity is how they vet the researchers capable of contributing to that work.

[Davit @davwwwx]

Can you remotely MITM ? Turns out you can 😅 A while ago we were able to with a cache poisoning vulnerability, with @0xdln
https://t.co/zdLWZ2e02I

[hexens @hexens]

Building a RAG pipeline or semantic search system? Your vector database probably has no real cryptographic security and "encrypted" embeddings aren't as safe as they seem.

The cryptographically sound approach is approximate distance-comparison-preserving encryption.

Here is a deep-dive into how it works, what the security guarantees actually mean, and why the approximation is a feature rather than a limitation.
https://t.co/hWl0sqS9I6

[FHE.org @fhe_org]

New resource added to @fhe_org /resources:

"Tutorial: Accelerating Private Cloud Computing with FIDESlib" by Carlos Agulló-Domingo, Óscar Vera-López, and José L. Abellán.

#FHE #homomorphicEncryption #FIDESlib

[hexens @hexens]

Where AI/ML, Cryptography and Blockchain meet.

Federated Learning keeps data local but that doesn’t make it secure.

A deep dive into secure FL using MPC, FHE, and zero-knowledge proofs, with real deployments in healthcare and finance.
https://t.co/gGpTY2cnH0

[ℏεsam @Hesamation]

fuck ML courses.

this repo lists 300+ real world battle tested case studies of how 80 companies designed their ML systems including Spotify, Netflix, Microsoft, etc. practical understanding of systems is a valuable skill you can work on.

some of these case studies are now outdated, but the technical details don’t matter. what matters is the decision making processes that lead to the designs:
— how to identify bottlenecks
— how to spot systems failures
— translating business needs to systems

take a look at it and thank me later.
https://t.co/aSJckXCEd7

[hexens @hexens]

A practical guide to attacks on threshold schemes implementation bugs from missing checks to oracle attacks.

Keep your eyes peeled for Part 2 https://t.co/S9l5JGv1h1

[Wiz @wiz_io]

💥 Wiz Research has uncovered a critical Redis vulnerability that's been hiding for 13 years

We found RediShell (CVE-2025-49844): an RCE bug in Redis that affects every version of Redis out there. It's rated CVSS 10 - the highest severity possible.

The vulnerability lets attackers send a malicious Lua script, escape the sandbox, and execute code on the host.

About 330,000 Redis instances are exposed to the internet right now. 60,000 have no authentication. Over 75% of cloud environments are running Redis.

Redis released a patch this weekend and we responsibly disclosed everything upon discovery. Huge thanks to the Redis team for their fast response and collaboration ❤️

If you're running Redis: update immediately.

Our blog has the full technical breakdown and security recommendations >> https://t.co/ymPuRl7DyQ

[ezzer @ez_z3r]

Made a writeup on a critical CVSS 10.0 vulnerability I've recently found. Check it out, maybe you'll manage to make into a full config independent RCE.
https://t.co/jQoTvtZ5Oe

[CODE WHITE GmbH @codewhitesec]

We've added a new demo to NewRemotingTricks that makes deploying a MarshalByRefObject (e.g., WebClient) even easier: System.Lazy<T> creates an instance of T on serialization, which is probably more likely to be allowed than a XAML gadget getting through. https://t.co/JhxnpXPDa5

[Hayk Andriasyan @p0wn4j]

@_marvyCodes @tpiliposian @TheWavexyz Yeah me too 😁, no I use a standart Butterfly racquet )))

[Deedy @deedydas]

Huge computer science result:

A Tsinghua professor JUST discovered the fastest shortest path algorithm for graphs in 40yrs.

This improves on Turing award winner Tarjan’s O(m + nlogn) with Dijkstra’s, something every Computer Science student learns in college.

[JFrog @jfrog]

🚨 A critical remote code execution flaw has been found in the #MCP tool used by developers to manage #cloud apps, with a 9.6/10 CVSS score.

Attackers don’t need authentication. A single POST request is all it takes.

👉 Get the details: https://t.co/nd6dNcs6KN

#CyberSecurity #DevSecOps #RCE #CloudSecurity

[Rohan Paul @rohanpaul_ai]

This “stunning” proof by MIT computer scientist, is the first progress in 50 years on one of the most famous questions in computer science.

Space complexity vs Time complexity.

New idea proves, that any algorithm that runs in T steps can be re-engineered to use about √T memory cells, establishing that memory (RAM) is a much stronger resource than earlier theory allowed.

A computer spends time (i.e. time complexity) running steps and spends memory (i.e. space complexity) holding data.

Memory is the list of numbered slots inside RAM where a program keeps facts it will soon need again. Space complexity counts the largest number of slots in use at one moment. Time complexity counts the total steps the processor performs before the answer appears.

Think about sorting 1 M email addresses. A quick sort touches each address many times but only needs a handful of extra slots, so its time cost is high and its space cost is low. A counting sort can finish in fewer steps but must open a huge table in memory, so its space cost is high and its time cost is lower. Designers pick the mix that fits their hardware limits.

Ryan Williams of MIT showed that a program needing T steps can be rebuilt to need about √T cells of memory,

So, clever reuse of a tiny memory region (i.e. space in RAM) can replace the need to run for a very long time. In raw computational power, space is the heavier lever.

So following Ryan Williams's new idea, he rewrites the program so it grabs a much smaller block of RAM, then keeps reusing that block, wiping and refilling it over and over.

Each wipe-and-refill adds extra steps, so the total run time balloons. In plain terms he trades speed for memory.

---
wired. com/story/for-algorithms-a-little-memory-outweighs-a-lot-of-time/

[tpiliposian @tpiliposian]

I’m doing philosophy again, but I’m 1000% sure this 1-2 min read will help you.

This is something that works everywhere, in web3 security, in development, in sports, in life.

Yesterday during the morning BJJ session, a white belt guy showed up. i remembered him from about 2 years ago when i was just starting, also a white belt back then. the first thing i thought was: maybe he wasn’t as consistent, maybe he trained on and off, took breaks, and that’s why he’s still a white belt. that was the logical guess.

But then, when we started to roll, he began asking stuff like:
“how do you escape from here?”
“how do you do this?”
and i noticed something, he just wanted a final answer, a quick theory, not the details, not the grind, just what to do.
And then I realized, there are two types of people.
The first type is like him, always asking, always looking for shortcuts. and i don’t mean this in a bad way, because even this type can become black belts eventually, really, it may take 15 years, but they get there.
Then there’s the second type, the ones who try, fail, try again, fail again, realize they’re missing a small detail, go find it, try again, and only after all that, maybe ask a question. but even when they get an answer, they try to do it their way, make it their own. that’s when you start seeing signatures in people’s game, you watch them roll or work and instantly know, yeah, that’s them.

Here’s the conclusion, it seems like asking someone saves time, like you’ll learn faster, but it’s not true (of course, i don’t mean stuff like asking how to make a new folder, obviously ask that).

But if you’re doing something that requires deep understanding, asking right away actually slows you down.

The one who asks about X knows only X. The one who discovers X on their own knows X with all the details, plus Y, and plus Z!

Nothing good comes for free. you want to be good at something? then you need to pay for it. and that payment is your time and effort in the beginning.

If it was just about asking and getting answers, everyone would be elite by now.

And that’s the scary part of this AI era, people are starting to ask everything and stop thinking for themselves.

Be cautious with this, you gotta recognize when it’s time to stop asking and start thinking and doing, even if it feels uncomfortable.

[ZK Hack @__zkhack__]

🔔 Time for #ZKMeshMini, join us as we unpack the top developments from this past week in the zk-space.

👾 @QuangVDao, @SuccinctJT, @Ingo_zk coauther a paper speeding up Sum-Check

👾 @CiaraNightingal releases a course on developing in @NoirLang

👾 @hexens writes an article on a common subgroup pitfall in ZK

👾 @RiscZero issues a security disclosure

👾 @zksecurityXYZ explains Greyhound lattice-base SNARK

🧵👇

[hexens @hexens]

One missing subgroup range-check let attackers duplicate proofs & double-spend:

When curves, fields, and circuits misalign - duplicated keys, reused proofs, and broken soundness follow.

Hexens breaks it down 👇

https://t.co/odamogql4e

[hexens @hexens]

Everyone says “just add randomness” to make STARKs zero-knowledge.

Without structured entropy, your witness leaks through LDE, DEEP queries, and FRI folds.

Hexens breaks it down: https://t.co/GBC36N8Dl9