Nipun gupta

@zellic_io | Ex @cloudfuzz_io, @zimperium | @infoseciitr

[Zellic @zellic_io]

The core utilities that run every Linux system have been rewritten in Rust. We audited them.

Before shipping uutils coreutils with Ubuntu 26.04, @Canonical commissioned Zellic for an external security audit.

Two rounds, fixes contributed directly upstream.

Full report below.

[cts🌸 @gf_256]

V12 is now live for open beta. It can:

- Find valuable bugs
- Generate working, runnable PoC
- Generate patch and test the PoC against it

In our testing during audits at Zellic, Zenith, and Code4rena we've been consistently impressed.

Best of all: it's free. (Don't abuse it!)

[Zellic @zellic_io]

Bad auditors miss obvious bugs. We built an AI tool that finds them.

Introducing V12: the only autonomous Solidity auditor that actually finds Highs and Criticals.

We'll be releasing it for free.

V12 finds Crits in Zellic audits, High/Mediums in Cantina, and a bug in Pendle.

[Zellic @zellic_io]

We're proud to announce that Code4rena contests will be free (no fees), starting today!

We acquired Code4rena to deliver better security for our clients. Now we want everyone to have that.

Audit contest platforms should exist to serve the ecosystem, not to extract from it.

[Zellic @zellic_io]

How many security considerations are there for non-EVM chains? There's a TON.

Developed by Telegram, @ton_blockchain has a very unique approach to both execution and state.

In this thread, we'll dive into some security considerations unique to TON. ⬇️ 🧵

[Zellic @zellic_io]

Billions of dollars were stolen from DeFi protocols in 2024.

As this number continues to grow each year it can feel impossible to decide which protocol to invest your money in.

We've released a new guide to help out.

These are the key steps we take when looking at a protocol.

[Zellic @zellic_io]

We're proud to announce that we've acquired @code4rena!

Code4rena is the gold standard for competitive audits, and we're thrilled to join forces with them.

We acquired Code4rena for one simple reason: because it enables us to do better audits for our clients.

Here's how. 🧵👇

[Zellic @zellic_io]

SECURITY ADVISORY

Zellic discovered two critical issues in certain forks of Gains Network. We worked with the teams to responsibly disclose these issues.

The issues allowed attackers to create trades that always made 900% profit (the max allowed).

Here’s how the bugs worked:

[Zellic @zellic_io]

Zellic has moved forward to the final voting phase for @arbitrum's Security Council!

We ask delegates to vote for Zellic as the Security Council furthers our mission to maximize TVL and extends our commitment to Arbitrum and its ecosystem.

Vote here: https://t.co/YD9yAisubL

[Zellic @zellic_io]

Collateralized debt positions (CDPs) and lending protocols are at the core of DeFi.

In this thread, we'll

✅ Share common bugs in CDPs and lending protocols
✅ Tour real-life examples that led to major hacks

Let's get started!

[Team zLabs @zLabsProject]

Financially Motivated Mobile Scamware Exceeds 100M Installations https://t.co/vWTrCAsUYA via @zimperium

Great work by @aazim_here and @fsoc_sh!

[Zimperium @Zimperium]

Our zLabs team discovered a spyware aimed at South Korean #Android users. #PhoneSpy hides in plain sight as a regular #application and has stolen thousands of victims' data. Zimperium customers are #protected against PhoneSpy. Click below. #WeSecureMobile 
https://t.co/WwN7WPidIh

[Irene Jarventaus @i_jarven]

New GriftHorse #malware has infected more than 10 million #Android #smartphones. Research by @ZIMPERIUM @aazim_here & @fsoc_sh, via @ZDNet - #mobile #cybersecurity https://t.co/o69joGeLQJ

[Team zLabs @zLabsProject]

Great research by @aazim_here and @fsoc_sh
https://t.co/K9Cq6yb7P1

[Team zLabs @zLabsProject]

Great work by @aazim_here!
FlyTrap Android Malware Compromises Thousands of Facebook Accounts | Zimperium Mobile Security Blog https://t.co/HVgQSaq0kU

[Zimperium @Zimperium]

The Zimperium zLabs team discovered an Android Trojan that has spread to 144 countries. Codenamed FlyTrap, this malware hides behind applications to steal social credentials from its thousands of victims and spread misinformation. #WeSecureMobile #FlyTrap
https://t.co/h69wwatoFH

[cyber8knight @AravGarg3]

CVE-2020-28022 + CVE-2020-28026 unauth root RCE in Exim4 < 4.94.2.

[HackSys Team @HackSysTeam]

Adobe patched one of the UaF we reported (Nipun Gupta , Ashfaq Ansari and Krishnakant Patil - CloudFuzz) as CVE-2021-35983
https://t.co/iKzoCTPFgD

cc: @shsirk

[Check Point Research @_CPResearch_]

We have recently discovered 4 security issues applicable in most MS-Office products.
Read all the details here:
https://t.co/KxPiOnCxeq
cc @sagitz_ @NetanelBenSimon

[Nipun gupta @psy4n0n]

I found an integer overflow which lead to heap overflow in Redis, it was due to an incomplete patch.

CVE-2021-32625

Response time was really good. :)

[Redis News Feed @redisfeed]

[RELEASE] Redis 6.2.4 and 6.0.14 are out!

Upgrade urgency: SECURITY, contains fixes to security issues that affect authenticated client connections. MODERATE otherwise.

Mailing list thread: https://t.co/gziv1L4w2M