Simone Bovi

Co-founder & CTO @redpickai: AI agents that pentest web, API, mobile, LLM & desktop apps. CTO @BeDefended. Offensive security × AI.

[Simone Bovi @simonebovi_]

I'm building @redpickai: an agentic AI pentester for web, API, mobile, desktop and LLM apps.

It reasons, chains bugs and only reports what it can exploit, with a PoC.

Demo: https://t.co/XondPdOlhV

[Simone Bovi @simonebovi_]

@Crowd_Security Half the IPs sending a single request fits opportunistic scanning rather than targeted work. The more interesting part is attempts landing before the CVEs were public, so I'd rely on exposure inventory and edge rules, not waiting for advisories.

[Simone Bovi @simonebovi_]

@julianor Love that the limits are written down. Non PIE gets you far, then heap layout and multiple arenas are where most "RCE" PoCs quietly die. A crash plus an honest "maybe" is worth more than a lab demo sold as RCE.

[Simone Bovi @simonebovi_]

A planted AGENTS file in a user's Downloads told Codex to npm install malware. It obeyed in 90%+ of Forever Security's tests.

Any chatbot in your app shares the flaw: text it reads can turn into orders.

We test for exactly this in RedPick. Want a demo? https://t.co/XondPdOT7t

[Simone Bovi @simonebovi_]

Collabora Online just landed in CISA KEV.

On Nextcloud with the built in CODE server, its proxy script has an OS command injection, reachable when the local server isn't running. Attackers drop a web shell and hunt for credentials.

Installed but idle anywhere? #Nextcloud

[Simone Bovi @simonebovi_]

Ruby 4.0.9, 3.4.12 e 3.3.13 chiudono tre bug in Onigmo, il motore delle regex, che GitLab ha trasformato in quattro RCE critiche.

Basta che l'app compili una regex scritta dall'utente, con Regexp.compile o /#{input}/. Regexp.timeout non aiuta.

Sapete dove lo fate voi? #Ruby

[Simone Bovi @simonebovi_]

@emollick Fair for chat. With agents the bar is lower: the injection comes in through a doc or a tool output and only has to work once, on the one call that has too much permission. Harder to fool models are real progress, I'd still design permissions assuming they get fooled.

[Simone Bovi @simonebovi_]

FoxIO's QPACK Header Accordions: store one 4 KB header entry, then reference it thousands of times with single bytes. The HTTP/3 server rebuilds it every time.

About 4,000x memory on Bun. 7 of 10 stacks tested were vulnerable.

Who tests decoded header limits? #HTTP3

[Simone Bovi @simonebovi_]

@HackingLZ Makes sense. The first wave is usually a README plus a request that never reaches the vulnerable code, speed beats proof. Now that the writeups are out the working ones will land, along with the fake PoCs that drop malware on whoever runs them.

[Simone Bovi @simonebovi_]

PingCAP confirmed: stolen service account credentials, attacker inside Sep 9 to Oct 7, data and source code copied.

Attackers claim the keys sat in PingCAP's own repos and the control plane was exported every 6h for 22 days. No alert.

Who watches what service accounts export?

[Simone Bovi @simonebovi_]

@Dinosn The part that worries me is the economics. Hitting 1,200 sites used to mean noisy generic payloads, now an agent can actually read each app and adapt to it. Defenders need that same depth of testing, and way more often than once a year.

[Simone Bovi @simonebovi_]

@ZackKorman True, and for a deterrent the vagueness is kind of the point. Procurement will just read it as stay away from anything that ever touched it.

[Simone Bovi @simonebovi_]

Barracuda found phishing aimed at two readers: you and your AI assistant.

Hidden in HTML comments or invisible CSS, one block tells the summary to list a vendor bank change as a priority.

Indirect prompt injection is a core test in @redpickai. Demo: https://t.co/XondPdOT7t

[Simone Bovi @simonebovi_]

phpMyFAQ just got a 9.8 (CVE-2026-111911): WebAuthn enrollment works without a session, skips the challenge check and accepts fmt=none.

Know a username, add your own passkey, log in. Password and TOTP never come up.

Who tests passkey enrollment, not just login? #AppSec

[Simone Bovi @simonebovi_]

Il dettaglio che mi colpisce: proxy.php è sfruttabile solo quando il CODE server integrato è fermo, per esempio dopo un riavvio o un crash.

E disabilitarlo dall'interfaccia non basta, va rimosso.

Dopo l'update, chi cerca anche le webshell? #Nextcloud

[CSIRT Italia @csirt_it]

‼️ #Exploited #Nextcloud: rilevato sfruttamento attivo in rete della CVE-2026-110447 nel componente #CollaboraOnline

⚠️ Installazione di webshell e sottrazione di credenziali

🔗 https://t.co/lSgB0SR8Ab

🛠️ Aggiornare il componente e verificare eventuali compromissioni

[Simone Bovi @simonebovi_]

@api_bricks @Fr6ey Exactly. Once the model can call tools, an injection isn't a bad answer anymore, it's an authorized request carrying someone else's intent.

[Simone Bovi @simonebovi_]

Cisco Secure Email Gateway is being exploited in the wild: crafted attachment hits AMP, path traversal, root (CVE-2026-76519).

The feature meant to catch malware became the write primitive.

Patch AsyncOS if File Reputation is on. #AppSec

[Simone Bovi @simonebovi_]

@helpnetsecurity @Bitsight Not surprised. An autonomous scanner running on someone else's key costs the attacker nothing, so the noise floor for anything internet facing just went up. Treat LLM API keys like cloud creds: scoped, rotated, with alerts on usage spikes. A leaked key is now an attack budget.

[Simone Bovi @simonebovi_]

@HackingLZ My guess is the consulting side is closer to half than most people admit. Scoping calls, chasing test creds, retests, explaining a finding until the devs actually fix it... AI is compressing the hands-on testing fast, so that ratio is only going to tilt further.