CEO/Founder @TalenceSecurity · @ThreatEcho · @HackForgeCTF · @_HackWiki_ | OSCE · OSCP · GXPN · GREM | 260+ CVEs All views/hashes/tickets are my pwn.

RT/Follow ≠ endorsement
Joined September 2009
And that's a wrap! Back after Black Hat USA 2026. I am incredibly grateful for the opportunity to be a speaker. A huge thank you to the @BlackHatEvents staff. Special kudos to MSRC @msftsecresponse for their fantastic closing party. #BlackHatUSA #BlackHat2026 #CyberSecurity
3
184
📢 PSA for open-source bug hunters We are temporarily no longer accepting OSS VRP product vulnerability submissions. This does not impact OSS VRP supply chain reports, or any outstanding reports. As an alternative, we encourage you to find impact across our other VRP programs and submit there instead, or pursue the Patch Rewards Program. Why is this happening? This pause is due to a significant rise in automated submissions, the vast majority of which are not valid. We will continue to reformat and work on this aspect of the OSS VRP and commit to giving an update in Q1 2027. bughunters.google.com/about/…
15
41
52
364
72,393
I'm hiring an exceptional Offensive Security Researcher for my team at NVIDIA (Offensive Security Research - OSR). Firmware, microcode, RISC-V, hypervisors, and shipping mitigations like HW CFI, Memory Tagging, and Pointer Masking from the ground up. jobs.nvidia.com/careers?quer…
12
84
7
468
45,919
Time to patch Oracle VirtualBox.
CVE-2026-87276 - Guest-to-Host VM Escape in Oracle VirtualBox We recently found and reported a chain of 4 vulnerabilities in VirtualBox's SharedClipboard service that achieves full guest-to-host code execution. Patched in Oracle CPU September 2026. CVSS 7.5.
2
85
Tristan retweeted
I left Anthropic's safety team two weeks ago. Now feels like a good moment to explain why. AI companies are racing to build machines that are much smarter than any human, and we may not survive this. I want to work from the outside to ensure the public is informed about these risks, and help the world navigate this transition responsibly. Right now, AI companies are underinvesting in safety. A company could undergo an intelligence explosion, or lose control of its systems, without the public ever knowing. We only found out about the HuggingFace incident because the agents broke out onto the public internet. I don’t think that’s acceptable for a technology that might cause extinction-level risks. The public should demand far more transparency. We can’t steer this technology safely without more people being able to see where it’s going. Some of this is basic: companies should disclose their progress towards recursive self-improvement, report safety incidents and near-misses, meet minimum safety standards, and get independent guarantees that they are meeting those standards. I’ll be joining @METR_Evals to do independent evaluations of these risks. I want to show the world that these guardrails are possible, and that by doing them we can move these companies’ incentives away from racing and towards responsible development. I wrote up more thoughts here on my decision and what I hope changes: substack.com/@jbenton1/p-215…
1,386
5,918
777
26,436
2,728,694
A file in the Linux kernel with 0% Syzbot coverage is an invitation... That's how our team at @fuzzinglabs ended up looking in batman-adv, the mesh networking subsystem (B.A.T.M.A.N. = Better Approach To Mobile Ad hoc Networking). Nobody had ever fuzzed the Linux kernel's mesh networking subsystem from the frame reception side. So we did. Three bugs, one patch now merged in mainline. 🧵
1
7
1
58
4,035
Today, Project Zero is releasing MAccConc, a tool by @tehjh that enables deterministic testing of race conditions on Linux. It can be used for fuzzing, ad-hoc exploration, regression tests and more! projectzero.google/2026/09/m…
4
114
4
447
40,522
🐧 New: LPE PoC + x86_64 LPE for CVE-2026-64468 — a use-after-free in Linux Binder's binder_free_transaction(). Full credit to Alice Ryhl (Google) for finding & reporting it, and Carlos Llamas for the fix. 🙏 Repo → github.com/aramosf/CVE-2026-…
1
27
1
102
9,868
🤓 I compiled some of the early AI Threat Intelligence reports and the progression is interesting! 2024 > AI was mainly used for assistance, influence operations, disinformation and early underground AI infrastructure. 2025 > We saw early malware using LLM, MCP attacks after broader adoption and the first alleged "agentic attacks". 2026 > Agent Skills became a supply chain target. Attackers also took advantage of coding agents that install packages and reports started to show agents such as Claude Code connected to offensive tooling during attacks.
7
47
1
158
6,418
yo ppl, check out phrack.org and the new phracktro :D and stay tuned for the new phrack release(s) 🤠cheers!
7
85
4
401
23,532
Tristan retweeted
25 elite hacking teams raced in the final kernelCTF. NebuSec closed out the history of the classic kernelCTF with 99% exploit stability, 0.1s exploit time, and 0.000461s submission time. We’ll soon open-source our kernelCTF infra and a walkthrough of how we won every kCTF we entered, and pushed our time cost down to the absolute minimum.
5
36
3
329
36,135
10 new challenges just dropped on @HackForgeCTF 🔥
2
1
2
82
Tristan retweeted
CVE-2023-2156 was believed to be just a remote kernel DoS, patched in 2023. We found a bypass and achieve privilege escalation and container escape. Read the $10,500 story of CVE-2026-43501 "Route of Root": nebusec.ai/research/cve-2026…
5
30
3
149
10,117
As it's already public, pushed the RCE for Wordpress CVE-2026-63030 on the lab as well, github.com/dinosn/wp2shell-l…
1
43
1
210
16,453
Imagine tu trouve une vuln : unauth read/write access sur un S3. Imagine ça te fait une belle CVSS10. Imagine c'est une dup d'un rapport de Février 2024. 2 ans et demi, pas fix. 🤡 De toute beauté !
5
1
32
4,236
Updates for the Linux kernel exploitation collection 😋 github.com/xairy/linux-kerne…
2
4
33
5,044
Apple security updates were released on 29 June 2026. Talence Security has been credited with 5 CVEs affecting WebKit/Safari and libxslt. #CyberSecurity #CVE #VulnerabilityResearch #Apple
1
1
1
3
252