SAAITAAMAA

[SAAITAAMAA @saaaadhjj]

We went from "HACK THE PLANET" to "Hey AI, hack the planet for me would ya!"

Fully Found by a custom Vulnerability Research Agent (0$ thanks to @opencode zen)

#ZeroDay #VulnerabilityResearch #ApplicationSecurity #GameSecurity #InfoSec #Cybersecurity #CWE78

[SAAITAAMAA @saaaadhjj]

Peek marketing.

[Flipper Devices @flipper_net]

Sub-GHz testing, but with considerably more positive feedback.

[SAAITAAMAA @saaaadhjj]

@marouane53 The only spark of light are the Chinese open models and the few people open sourcing inference optimization techniques for everyone to barely run them locally.

[SAAITAAMAA @saaaadhjj]

Been playing with a DNG POC of CVE-2025-43300 for the past few weeks, Long story short, the patch on iOS 16.7.12 turned the bug from 0click RCE to 1click DOS.

[SAAITAAMAA @saaaadhjj]

Is this something that will be implemented correctly by developers ?!!
https://t.co/gHhp5ekTdb

[SAAITAAMAA @saaaadhjj]

@0xbadb33f How does feel ! To be living my dream 😞.
Congrats !!

[SAAITAAMAA @saaaadhjj]

@Rajveer_1000 @Apple What you claim is a screen lock bypass, its probably worth 500k-1m.
Report it to apple if your confident.

[SAAITAAMAA @saaaadhjj]

@thedawgyg What would a beginner vuln researcher with no bias to software type target for bounties in 2026 ?

[SAAITAAMAA @saaaadhjj]

Thank god I bought the pixel 10, the Motorola partnership is the perfect option anyways, degoogling from both software and hardware.

[GrapheneOS @GrapheneOS]

We have a partial port of GrapheneOS to the Pixel 11 series after a week of work on it. We're unable to complete the port due to lack of support for ARM hardware memory tagging in software, firmware and near certainly hardware. It appears Google cut an important security feature to save money.

ARM hardware memory tagging (MTE) is used by GrapheneOS across the entire base OS including the kernel and every standard base OS process. It's only temporarily disabled for a few device-specific processes. It greatly improves protection against nearly all remote exploits and many local exploits.

Pixel 8 launched with hardware MTE support in October 2023. We integrated it into our hardened_malloc project and began using it across the OS later that month. Android and the Pixel OS never started using it by default. Android Advanced Protection Mode in Android 16 enables it for a few processes.

Apple's Memory Integrity Enforcement (MIE) is an always enabled feature on the iPhone 17. It's simply a high quality implementation of MTE using the latest standard extensions. It uses MTE in the most secure mode in the kernel and a large portion of userbase. They did a very good job integrating it.

Apple's MIE and Android 16+ AAPM don't use MTE for user installed apps unless those explicitly opt in. GrapheneOS enables it for more apps automatically and has a toggle for users to opt-in for every user installed app. There's a per-app toggle to opt-out for incompatible apps which is uncommon.

Neither iOS or Android encourage app developers to opt into MTE and other more aggressive security features used in the base OS. Apple's docs warn developers of performance and stability issues. Even Signal doesn't opt-in. Our approach enables forcing using MTE in the standard allocators regardless.

Pixel 11 does have security improvements including moving to post-quantum secure verified boot (ML-DSA) and replacing Samsung Shannon IMS with AOSP IMS. Titan M3 should significantly improve protection against data extraction in Before First Unlock state. It's too bad they ruined it by cutting MTE.

Pixel 11 series is a lot more expensive for an incremental improvement to the CPU, the same underpowered GPU and reduced RAM for the Pro base models. They finally caught up to the last generation of Qualcomm cellular radio. It's overpriced, the upgrades aren't impressive and losing MTE is appalling.

Compared to the Pixel 11, a Snapdragon 8 Elite Gen 5 has ~40% higher single threaded CPU performance, ~80% higher multi threaded performance, over 100% higher GPU performance and a far better cellular radio. It also finally has MTE. The next gen is what will be in the first Motorola with GrapheneOS.

Pixel 9a and earlier (including Nexus devices) were the Android Open Source Project reference devices. Pixel support was removed from AOSP with Android 16. It's now harder to support Pixels than many other devices and massive progress towards open source firmware and driver libraries was discarded.

Compared to the stock Pixel OS, GrapheneOS ships AOSP patches months earlier and Linux kernel patches many months earlier. However, we rely on them for firmware and most driver updates. We also want to move to new kernel branches earlier. These things can be improved with our Motorola partnership.

We strongly recommend against buying Pixel 11 devices. Pixel 8, 9 and 10 have much better overall security for GrapheneOS. Pixel 10 is cheaper with similar hardware and MTE. Pixel 11's Titan M3 should improve BFU security for users without a strong passphrase, but losing MTE craters AFU security.

We haven't determined what to do about this situation. It may be best for us to skip the Pixel 11 series devices. We can shift our focus entirely to the upcoming Motorola devices instead. Pixel 10a was really a 9th gen Pixel, so hopefully the Pixel 11a does the same with 10th gen and includes MTE.

[Lupin @0xLupin]

“Security researchers are doomed because of AI.”

I kept hearing versions of this, so I went back through 500 years of people saying the same thing every time a machine learned a human skill.

Some were idiots.

Some were right.

Here’s where I landed. https://t.co/ghFe7ONlOi

[SAAITAAMAA @saaaadhjj]

A quick read on how Claude code missed finding CVE-2026-8695 & CVE-2026-8696 while a grep() did the work.
https://t.co/fak0xyPQvN

[SAAITAAMAA @saaaadhjj]

A quick read on how Claude code missed finding CVE-2026-8695 & CVE-2026-8696 while a grep() did the work.
https://t.co/fak0xyPQvN

[SAAITAAMAA @saaaadhjj]

@yoursbyte Cool, I run a similar architecture but I add a critique loop by the end of the workflow, it's entire job is to criticize the findings and making sure everything is spotless.

[Thai S.D @_sondt_]

😓 Pwn2Own 2026

[Lukasz Olejnik @lukOlejnik]

AI will not solve cybersecurity! “With the recent news of folks finding vulnerabilities left and right using LLMs, some folks hope that we'd be able to find every single vulnerability. Today, I hope to shatter that idea” https://t.co/fDokoW9VuL

[SAAITAAMAA @saaaadhjj]

In Other words, @Hacker0x01 does not care if a bug hunter is being treated fairly as much as pleasing the clients, what's unfortunate is that it's supposed to be built by hackers who know the frustration of dealing with these sorts of issues.

Time to switch platforms.

[SAAITAAMAA @saaaadhjj]

On April 22nd @Nextclouders decided to stop their bounties and closed my report as resolved with a "thank you".

When the issue was brought up to @Hacker0x01 support, they said "the teams have the final say ", and I can't request mediation because of cynical signal requirement.

[SAAITAAMAA @saaaadhjj]

@z0v3r1n @XenoKovah @OpenSecTraining I think the vulns are unrelated, we'll wait for a more detailed write up to compare.

[SAAITAAMAA @saaaadhjj]

Just published my first vuln research write-up.

OOB write in QEMU's A speed ADC.

Reported, patched by Red Hat, name in the commit.

Big thank you to @XenoKovah — @OpenSecTraining is the real deal.

🔗 https://t.co/tP65I31F7x

#QEMU #VulnResearch #InfoSec