Tuan Dinh Van 🇻🇳

Security engineer | MSRC 2024 Q3/4 | MSRC 2025 MVR

[TrendAI Zero Day Initiative @thezdi]

Another collision! Although successful on stage, @rewhiles of Viettel Cyber Security (@vcslab) targeting Anthropic Claude Code in the Coding Agent category used a bug that was previously known to the vendor. They still earn $20,000 and 2 Master of Pwn points. #Pwn2Own #P2OBerlin

[Zhenpeng (Leo) Lin @Markak_]

NGINX rift: We autonomously discovered this 18 yr old heap overflow (CVE-2026-42945) in @nginx impacting version 0.6.27 to 1.30.0. If you use rewrite and set directive, you maybe impacted! Please update your NGINX or change the config to mitigate it. Read more at https://t.co/KeoblrGL24

[striga @striga_ai]

Unauthenticated RCE in Apache Tomcat (CVE-2026-34486)

The EncryptInterceptor was supposed to protect cluster communication. A fix for a padding oracle vulnerability moved one line outside a try block, and the encryption layer silently started forwarding every failed decryption straight into unfiltered Java deserialization.

We found it with Striga, built the exploit, and reported it to The Apache Software Foundation.

https://t.co/cygPWfXCnB

[Immunefi @immunefi]

Security researcher ily2 has just earned a staggering $3,000,000 from submitting a critical smart contract bug via Immunefi.

That's the largest single payout in web3 security in recent memory.

In total, he's submitted 3 reports. All 3 were paid. 100% accuracy.

His leaderboard update is coming soon, but you can pledge IMU to him now and earn when he finds the next one:

https://t.co/ZEN8N5SP2c

[Youssef Sammouda (sam0) @samm0uda]

$312,500 worth of stored/reflected XSS vulnerabilities in Meta’s Conversions API Gateway allowed Javascript code to run on any Facebook domain and millions of third-party websites. The flaw enabled zero-click Facebook account takeover and more:

https://t.co/7gWpR4LQ8x

[Tuan Dinh Van 🇻🇳 @tunadv]

@LTiDiii Đỉnh quá a ơi. Chúc mừng a nhé🔥🔥🔥

[Tuan Dinh Van 🇻🇳 @tunadv]

@janlele91 Chắc chắn là 🔥🔥🔥 hơn rồi ông à 🤣

[Microsoft Security Response Center @msftsecresponse]

Congratulations to all the researchers recognized in this quarter’s MSRC 2025 Q3 Security Researcher Leaderboard! Thanks to all the researchers who partnered with us for your hard work and continued dedication to securing our customers.

Learn more in our blog post: https://t.co/AmXl9IrbTX

We also want to recognize the top 10 researchers in the leaderboard:
🥇Brad Schlintz (@nmdhkr)
🥈 Yuval Avrahami
🥉 b2ahex
4. Jianyang song
5. Felix B.
6. Haifei Li @HaifeiLi
6. tuandv of Viettel Cyber Security
8. P1hcn
9. 0x140ce @0x140ce
10. Matthew Jensen

[DARKNAVY @DarkNavyOrg]

We triggered WhatsApp 0-click on iOS/macOS/iPadOS.
CVE-2025-55177 arises from missing validation that the [Redacted] message originates from a linked device, enabling specially crafted DNG parsing that triggers CVE-2025-43300.
Analysis of Samsung CVE-2025-21043 is also ongoing.

[5pider @C5pider]

90% of my Twitter DMs are asking me about how to start getting into Malware development. Well, I love answering them but it's easier to write a small thread about it so here we go.
1/12

[Tuan Dinh Van 🇻🇳 @tunadv]

@HaifeiLi @msftsecresponse Oh I’m curious. Because it seems like my gift from MSRC hasnt arrived yet

[Mandiant (part of Google Cloud) @Mandiant]

🚨 We identified a ViewState deserialization attack affecting Sitecore deployments. The attacker leveraged an exposed ASP[.]NET machine key to perform remote code execution.

Get the full details, indicators of compromise, and defensive recommendations: https://t.co/nkXi97LjOa

[Tuan Dinh Van 🇻🇳 @tunadv]

My first year at MSRC and being in the top 100 MVR is something I am very proud of😊. Thank you @msftsecresponse for your enthusiastic support🫡. Congratulations to all the researchers on the leaderboard 🎉

[Microsoft Security Response Center @msftsecresponse]

The Microsoft Researcher Recognition Program offers public thanks and recognition to security researchers who help protect our customers by discovering and sharing security vulnerabilities under Coordinated Vulnerability Disclosure.

Today, we are excited to recognize this year’s 100 Most Valuable Researchers (MVRs), based on the total number of points earned for each valid report. Please join us in celebrating this year’s MVRs, including our top 10:
1. 🥇 VictorV (@vv474172261)
2. 🥈 wkai
3. 🥉 Suresh Chelladurai
4. Anonymous
5. Adnan (@adnanthekhan)
6. Dhiral Patel (@dhiralpatel94)
7. Nan Wang (@eternalsakura13) and Ziling Chen
8. Anonymous
9. @0x140ce
10. Azure Yang (@4zure9)

See the full list of this year’s 100 MVRs, in addition to our Azure, Office, Windows, and Dynamics 365 leaderboards: https://t.co/8vhDhDpr3E

#bugbounty

[Khoa Dinh @_l0gg]

While waiting for the Pwn2Own chain, you might want to read this.
Disclaimer: This is a bug I discovered by accident, and already been resolved. I’m not sure which CVE or patch this maps to.
If you know any information, please feel free to leave a comment
https://t.co/tIeEhUefPW

[Tuan Dinh Van 🇻🇳 @tunadv]

@thaivd98 Đỉnh quá anh ơi

[Check Point Research @_CPResearch_]

Zero-Day used by Stealth Falcon APT group in a spear-phishing campaign:
💥 .URL file exploitation (assigned CVE-2025-33053)
🧰 Custom Mythic implants, LOLBins, and custom payloads
🌍 High-profile targets across the Middle East and Africa
https://t.co/OnQmC2GBLJ

[Tuan Dinh Van 🇻🇳 @tunadv]

@janlele91 @Bugcrowd Ss ong ơi

[Tuan Dinh Van 🇻🇳 @tunadv]

@thaivd98 Troll à a =))