Mathy Vanhoef

Prof. @KU_Leuven | Ex-Postdoc NYU | Network Security & Crypto | FragAttacks & KRACK |

[Mathy Vanhoef @vanhoefm]

I found some design and implementation flaws in Wi-Fi again. All Wi-Fi devices are affected. It was a long ~9 months embargo, over this time a lot of info has been collected and that info now available at https://t.co/nAQtK9XY0R

[Mathy Vanhoef @vanhoefm]

Interesting realization: any bash script can get your geolocation.

Here done using Wi-Fi trilateration on macOS by spawning a chrome browser.

I would assume the same thing is possible on Linux, probably even without spawning a browser.

[Tal Be'ery @TalBeerySec]

1/
WHEREAMI: Built a Chrome-based geolocation red team tool (bash script😅).
whoami tells you who. whereami tells you where.
Living-Off-the-Land (#LOLbins), no new binaries, no permissions prompts.
Relevant for proximity based attacks, e.g. @Volexity's nearest neighbor

[Steven Murdoch @sjmurdoch]

For 19 years, GPS satellites have secretly broadcast a “numbers station” in their public signals. We decoded 12M messages: a 2011 flash where 31 of 32 satellites flipped in hours, “ghost” substrings repeating years apart, and a “TEXT” prefix spreading now. https://t.co/xz3svmqiDa

[Christian B. @kimocoder]

wifite2 as many are familiar with through WiFi penetrating testing and/or @kalilinux as a listed tool on the platform made it to a Netflix series 'Bloodhounds' not long ago and both myself and @derv82 appreciate the attention ☺️ wifite2 is open source and covers a range of 'tests

[Mathy Vanhoef @vanhoefm]

Vulnerabilities not being exploitable in a common configuration also happens often when I audit network code during research. The effort to report them, or describe them in a paper, was often not worth it. So these ‘vulnerabilities’ typically remained unpatched.

[thaidn @XorNinja]

We’ve now seen at least four nginx RCEs that require non-default configs: nginx rift, nginx poolslip, and two of our own (including the one in the last tweet).

The configs involved are unusual, which raises the obvious question: do these attacks actually work in real-world deployments?

We asked Claude to download and analyze more than 4,000 nginx config files from GitHub.

The result was embarrassing: none of them were vulnerable to nginx rift or our own attacks. We can’t say anything about nginx poolslip yet, since it hasn’t been published.

So don't worry about your nginx yet.

Moral of the story: AI can generate FUD, but also help fight FUD. Embrace it!

[thaidn @XorNinja]

We’ve now seen at least four nginx RCEs that require non-default configs: nginx rift, nginx poolslip, and two of our own (including the one in the last tweet).

The configs involved are unusual, which raises the obvious question: do these attacks actually work in real-world deployments?

We asked Claude to download and analyze more than 4,000 nginx config files from GitHub.

The result was embarrassing: none of them were vulnerable to nginx rift or our own attacks. We can’t say anything about nginx poolslip yet, since it hasn’t been published.

So don't worry about your nginx yet.

Moral of the story: AI can generate FUD, but also help fight FUD. Embrace it!

[Mathy Vanhoef @vanhoefm]

@veorq I have no doubt about that :) Perhaps EKE was the easiest for them to apply this theory to, instead of taking some of the more recent variants

[Mathy Vanhoef @vanhoefm]

@IceSolst This probably also helps fuel the LLM hype

(beyond merely their real and formidable utility)

[Gerard Govers @gerardgovers]

Als een significant gedeelte van de bevolking géén kinderen heeft zullen zij die nog wel kinderen hebben (en investeren om die op te voeden) het niet OK blijven vinden dat de pensioenen van mensen mét en zonder kinderen gelijk blijven.

[Mathy Vanhoef @vanhoefm]

Nominate yourself to help review papers for USENIX Security 2027! https://t.co/gXhXyAnRuH (or https://t.co/TPDnV0w3VO ). Deadline: May 28, 2026.

We're looking for both senior and junior people. See Andrei Sabelfeld's LinkedIn post for more info: https://t.co/yjYZPfzP18

[Matthew Green @matthew_d_green]

There’s been some reporting that Meta contributed an unfathomable sum to promote age verification laws globally. This is broadly true, but actual situation is a bit more complex. Figured it was worth an update.

[Frank @jedisct1]

Pre-announcement of BIND 9 security issues scheduled for disclosure 20 May 2026

https://t.co/1muFtSmQhl

[Tao Yan @ga1ois]

[2]After our failed competition, we headed to Apple Store and bought the mbp m5 and spent less than half an hour to set it up and found a fixed offset is changed 1 bit on it, so we just change 1 bit on our exp and it worked with a 100% success rate. Yes just 1 bit change, 1 to 2.

[Moritz Schloegel @m_u00d8]

NDSS 2027 is looking for volunteers to join the Artifact Evaluation Committee.

If you care about reproducibility & open science, we would be glad to have you on board. All sorts of backgrounds welcome & no prior experience required.

Self-nominate here: https://t.co/j5PDPegpBo

[ggwhyp @ggwhyp]

I was hoping to compete in Pwn2Own with a Firefox full-chain entry, but unfortunately it was rejected. I’ve reported the vulnerability to the Mozilla team.

[Xchg Labs @xchglabs]

Pwn2Own hit max capacity for the first time in history. We unfortunately couldn’t get in. We submit our research to vendors. Look to our blog for technical breakdowns coming soon!

#cybersecurity #0day #reverseengineering #exploitdev #infosec #xchglabs #pwn2own

[Dave Aitel @daveaitel]

https://t.co/vngHIPQFKk

[Mathy Vanhoef @vanhoefm]

@SwiftOnSecurity This platform has kept going downhill. The "For You" page is mainly interaction slop where tweets stop in the middle of the sentence, right before the "juicy info", to get you to click on it. The "Following" page is less interesting because many people left or are less active

[Pwnie Awards @PwnieAwards]

🚨Nominations for the 2026 Pwnie Awards are now open!

Best bug? Worst Bug? Incredible research? Cataclysmic fuckups that knocked over half the internet?

You know who deserves a Pwnie this year! Let us know!
🏇🏇🏇🏇🏇
https://t.co/shPn9ze2ng

[Brian Pak @brian_pak]

Hey everyone. We’ve seen the discussions around Copy Fail (CVE-2026-31431) and the disclosure process. We appreciate the passion from distro maintainers, defenders, and the broader Linux community. This is a serious issue, and we want to share some context on our side in good faith. 🧵