Aloïs Thévenot

Jack of all trades, master of some. CTO / Pentester @vaadata - Bluesky: @techbrunch.fr

[Aloïs Thévenot @TechBrunchFR]

You can find me on Bluesky at @techbrunch.fr, see you there.

[Daniel @0x64616e]

Recordings from SO-CON 26 are out
https://t.co/Zdbt7j33mk

[Coiffeur @Coiffeur0x90]

⛓️As I promised, I delivered, here is how to escape the PHP sandbox by exploiting a PHP UAF on macOS 🏴‍☠️

🦜 https://t.co/gH8Bdg7OzT

[Michael Weber @BouncyHat]

We think of WASM as a mechanism to run compiled code in your browser, but what if we shimmed in all the host APIs necessary to run full implants with ALL logic entirely in the WASM VM? This post walks through what that looks like.
https://t.co/xGVpPe2zyC

#wasm #malware #sliver

[Calif @calif_io]

Big news: @lcamtuf has joined us.

Michal has been advising us since the earliest days of the company, helping us navigate everything from difficult strategic decisions to situations that were difficult primarily because we created them ourselves.

As the business has grown, so has the number of problems that can only be solved by asking, "What would Michal think of this?" We're delighted that he has now joined us officially and can no longer pretend not to see our messages.

We're also excited to share that Michal has granted us an exclusive world-wide license to commercialize his groundbreaking C/C++ remote dependency technology.

Existing customers are encouraged to begin planning their migration to our next-generation implementation, which has been carefully re-engineered with Claude in PHP to maximize nostalgia value for some of our hackers.

Welcome aboard, Michal!

[Matthew Prince 🌥 @eastdakota]

Welp, that happened faster than I predicted. Thought it would be end of 2027, then early 2027, but agentic traffic growing so fast that bots have now passed human traffic online for the first time in the Internet's history. https://t.co/2zX5bHdhsa

[Yanir Tsarimi @Yanir_]

Bottom line: If you use any of those apps on Android, update.

Full details on https://t.co/EwCS8PN4G8

[Aloïs Thévenot @TechBrunchFR]

@Sonar_Research Is there an RSS feed for your blog posts ?

[Sonar Research @Sonar_Research]

Shellcode execution as a service!

To exploit an argument injection in Jellyfin, we searched and found a gadget in the .NET runtime to turn file writes into code execution. Learn about the bug and this new technique:

https://t.co/HvWtrNbbK5

#appsec #security #vulnerability

[Kuba Gretzky @mrgretzky]

I wanted to address the speculation about the recently introduced Device Bound Session Credentials (DBSC) security feature in Google Chrome.

Does it help increase the security of session cookies against infostealer malware and MFA phishing?

The feature has been available and enabled by default since the Chrome 146 update (April 2026), if you're running Windows with a hardware-backed TPM security module (macOS support is coming in future updates).

DBSC allows the browser to upgrade session cookies from long-lived to short-lived, requiring the browser to refresh them approximately every 10 minutes to maintain access to the user's account.

> Does DBSC prevent account takeover by threat actors using a stolen session cookie obtained from the user's browser via infostealer malware?

Yes (kind of). The extracted session cookie will be valid for up to 10 minutes from the time it is extracted. The attacker will be unable to maintain long-term access to the user's account. Still, the timeframe may be sufficient, for example, to exfiltrate the inbox if the attack is automated. The attacker cannot refresh the short-lived session cookie because it requires the private key (stored in the TPM) assigned to the account to sign the challenge. The malware cannot access the private keys stored in the TPM.

> Does DBSC prevent account takeover by threat actors during a phishing attack?

No. Servers need to provide legacy support for the browsers that do not yet support DBSC. By default, the server registers and sends a long-lived session cookie to the browser. If the server supports DBSC, it will announce the DBSC API endpoint URL in the `Secure-Session-Registration` HTTP header of the response packet that contains the long-lived session cookies.
Only after the short-lived session cookie is registered via the DBSC API endpoint is the long-lived session cookie invalidated.

When the attacker removes the `Secure-Session-Registration` HTTP header retrieved from the server during a phishing attack, the browser will continue using long-lived session cookies and assume the server does not support DBSC. In short, removing that HTTP header while proxying traffic during a phishing attack allows the attacker to maintain long-term access to the user's account using the stolen long-lived session cookie.

I hope I've managed to clear up some confusion.

On a related note, you will soon be able to simulate phishing attacks against Google Workspace accounts (and other websites) that bypass DBSC and MFA protections using Evilginx Pro with the Phishlets 2.0 update.

[Packagist @packagist]

Full analysis of Composer behavior and unintended side effects as well as our new supply chain security features on our blog: https://t.co/1WmcILybu3

[Nathan McNulty @NathanMcNulty]

I see a lot of misunderstanding about what this means and what it will do for us

So let's be very clear:

- browser only
- does not prevent AitM by itself
- does not prevent pre-existing malware from tampering with key generation

This is not a panacea, it is a fair compromise

[Yanir Tsarimi @Yanir_]

What happens when your math and map processing libs become RCE vectors?

We've exploited OSS libraries to pop 2 shells on Microsoft's cloud infra, got assessed "low" severity, and found 2 bypasses again to defend our case, almost losing out on 6 digits in bounties

The current impact is over 120,000 repos just on GitHub. AI agents, LangChain, TiTiler, pandas.

Everybody wants the researchers to be responsible.
Here's how responsible disclosure looks like from the other side:

[Matthew Green @matthew_d_green]

Last week I discovered that ChatGPT and Claude will send you their “encrypted raw reasoning” and of course I immediately wasted a weekend trying to do something bad with it. What I got for my trouble was this blog post: https://t.co/bxWNsFCaRL

[Gabriel Landau @GabrielLandau]

My last submission to MSRC was for a Device Guard bypass.  I learned my lesson from prior drawn-out submissions, so I included a 90 day window this time.  MSRC responded saying that it met their bar and they would fix it, but asked me to withhold disclosure well past 90 days because they needed a few extra months to fix it.  I agreed on the condition that they issue a CVE, to which they agreed. 

After the agreed-upon Patch Tuesday a few months later, I couldn’t find any mention in the CVE list, so I reached out to MSRC to inquire. It turns out - they changed their minds, deciding it did not meet their bar for servicing, yet they patched it anyway.  Since it didn’t meet the bar, they didn’t issue a CVE. MSRC strung me along for a few extra months to keep me quiet, then broke their word.

They could have at least bought me dinner first.

The interaction left such a bad taste in my mouth that I don’t really feel like interacting with them again. That’s why I didn’t publish any exploits/tools last year. #MeTooMSRC

[Rémi GASCOU (Podalirius) @podalirius_]

Last time I dealt with MSRC

I found a command injection vulnerability present for a decade in context menus, not highly critical but still exploitable. (see my talk Shift Happens)

MSRC did not reward a bounty nor did they attribute a CVE to this finding because this ”doesn’t meet [their] criteria as a vulnerability that requires an immediate security update”

However, this was fixed a month later in Windows 11 Canary (10.0.27902.1000).

Case closed.

https://t.co/8PFw4xs7Bx

[rootsecdev @rootsecdev]

Last time I dealt with MSRC.

Responsibly disclosed an issue with legacy auth that allowed me to spray passwords at <redacted endpoint> and avoid smart lockout.

Receives email.. 5 months after initial case opening.

“Doesn’t meet the bar for servicing”

Microsoft silently fixed. Closed case.

https://t.co/9iFpMJMSXC

[Jorian @J0R1AN]

I won't keep you in mystery any longer, here's how I found an XSS vulnerability *in* Shazzer!
The chain involved some interesting browser techniques no sane developer could foresee. Check out the details below:
https://t.co/nY20Anz0VO
(and thanks @garethheyes for making Shazzer!)

[Samir @SBousseaden]

Detecting #Tycoon2FA AiTM attacks across Entra ID and Google Workspace. We map telemetry fingerprints across both platforms, ship detection rules for both tiers, and contain incidents in under 10 seconds with Elastic Workflows.

https://t.co/mSxH6m0bGB

[skull @brutecat]

StubZero: $148,337 RCE in Google Cloud Production

https://t.co/m7cBnSTaj4

[spaceraccoon | Eugene Lim @spaceraccoonsec]

35 CVEs caught before publication, with an average lead time of 2 days. Three months of running Vulnerability Spoiler Alert - the numbers, the false positives, and what it takes to make an LLM vulnerability monitor actually work.

https://t.co/Ibnaid6vR2