Mykola Grymalyuk retweeted
If you would like to kinda work with me :D - this is the place
Our team for Apple's Bug Bounty is hiring! If you love working on overly complicated vulnerability reports at scale, this is the role for you:
jobs.apple.com/en-ca/details…
Mykola Grymalyuk retweeted
I’m pumped to be joining the team! This is going to be a great adventure 🦾🤖🍎
We have some exciting news to share: @blacktop__ is joining Calif to work on a range of R&D projects focused on Apple and AI security.
If you work in the Apple security ecosystem, he’s already a household name. He’s the creator of:
* ipsw – the ubiquitous Apple firmware analysis tool: github.com/blacktop/ipsw
* darwin-xnu-build – reproducible XNU kernel builds: github.com/blacktop/darwin-x…
* ipsw-diffs – automated diffing of Apple releases: github.com/blacktop/ipsw-dif…
* The only public deep-dive on Apple’s Lockdown Mode: github.com/blacktop/presenta…
His tooling is so good that even Apple engineers use it. If you do reverse engineering, chances are you’ve touched his Rust headless IDA MCP server: github.com/blacktop/ida-mcp-….
People have literally collected CVEs and bug bounties just by digging through the diffs produced by his tools.
With @brucedang, @Little_34306 and now @blacktop__, we're building a serious Apple security force at Calif. We’ll have more announcements in this space soon!
If you're interested in Apple security, AI, automated bug discovery, reverse engineering, or hacking, we’re hiring: calif.io/jobs.
We have some exciting news to share: @blacktop__ is joining Calif to work on a range of R&D projects focused on Apple and AI security.
If you work in the Apple security ecosystem, he’s already a household name. He’s the creator of:
* ipsw – the ubiquitous Apple firmware analysis tool: github.com/blacktop/ipsw
* darwin-xnu-build – reproducible XNU kernel builds: github.com/blacktop/darwin-x…
* ipsw-diffs – automated diffing of Apple releases: github.com/blacktop/ipsw-dif…
* The only public deep-dive on Apple’s Lockdown Mode: github.com/blacktop/presenta…
His tooling is so good that even Apple engineers use it. If you do reverse engineering, chances are you’ve touched his Rust headless IDA MCP server: github.com/blacktop/ida-mcp-….
People have literally collected CVEs and bug bounties just by digging through the diffs produced by his tools.
With @brucedang, @Little_34306 and now @blacktop__, we're building a serious Apple security force at Calif. We’ll have more announcements in this space soon!
If you're interested in Apple security, AI, automated bug discovery, reverse engineering, or hacking, we’re hiring: calif.io/jobs.
Mykola Grymalyuk retweeted
🔺NEW: iPhone and iPad are now the first and only generally-available devices to meet the exacting security requirements for handling classified NATO information. apple.com/newsroom/2026/02/i…
Mykola Grymalyuk retweeted
Come take our training if you're around. Csaba and I have been working on delivering the best macOS vulnerability training we could
This quoted post is unavailable.
Mykola Grymalyuk retweeted
🔺New security-focused developer event on March 5 at Apple Park: featuring sessions on Memory Integrity Enforcement, new tools in Enhanced Security in Xcode, Apple’s defensive security engineering approach, Swift adoption in security-sensitive code, and how to apply all these techniques to protect apps. Sign up: developer.apple.com/events/v…
Mykola Grymalyuk retweeted
🔺This is the first talk I've given in 6 years – featuring formal verification of post-quantum cryptography, the evolution of the Secure Page Table Monitor, a view into Memory Integrity Enforcement, updates to Apple Security Bounty… and a personal note.
The collection is complete! 🎬 We just uploaded @radian's keynote to our YouTube channel
youtube.com/watch?v=Du8BbJg2…
Mykola Grymalyuk retweeted
The slidedeck to our talk, Crash One: A Starbucks Story - CVE-2025-24277, with @gergely_kalman from @hexacon_fr and @objective_see #OBTS is available from the link below.
It was a macOS vulnerability impacting the crash reporting process where we could achieve LPE and sandbox escape.
theevilbit.github.io/talks_w…
Mykola Grymalyuk retweeted
Very excited to see interesting Gatekeeper research!
security.apple.com/blog/appl…
Mykola Grymalyuk retweeted
Apple's Real World CTF : you get the flag, you get the bounty
security.apple.com/blog/appl…
Mykola Grymalyuk retweeted
Are you interested in bleeding-edge microarchitecture offensive security research, with a concrete impact on user security?
We have just opened a Microarchitecture Security Internship position at Apple, in SEAR LASER! ❤️🔥
Apply here: jobs.apple.com/en-us/details…
Mykola Grymalyuk retweeted
The slides of my talk "The Evolution of macOS Security from the Desert to the Lake" @macsysadmin is up at my site:
theevilbit.github.io/talks_w…
Mykola Grymalyuk retweeted
We’re thrilled and honored to reveal our second keynote speaker: Ivan Krstić (@radian)
Any guesses what he might talk about? 😉
Mykola Grymalyuk retweeted
Got 10 CVEs and 4 Acks in macOS Tahoe release. Probably the most I ever got for a single release. 😎
Upgrade your devices.
support.apple.com/en-us/1251…
Mykola Grymalyuk retweeted
🔺iPhone models announced today include Memory Integrity Enforcement, the culmination of an unprecedented design and engineering effort that we believe represents the most significant upgrade to memory safety in the history of consumer operating systems. security.apple.com/blog/memo…
Mykola Grymalyuk retweeted
Will be presenting my Hydroph0bia (CVE-2025-4275) research at OFFZONE (offzone.moscow) 2025 on Aug 21st.
It will be 1 hr long main track talk about UEFI SecureBoot, the hole Insyde left in the H2O platform for a decade, and the things we all can do to prevent such holes.
Mykola Grymalyuk retweeted
Proud to announce that I’m interning at Apple this summer on the UIKit team!!
Mykola Grymalyuk retweeted
Hello friends. Check out this awesome and unique role that just opened up on my team in SEAR. Wanna secure Apple silicon, ROMs, iBoot, and more? jobs.apple.com/en-us/details…
Mykola Grymalyuk retweeted
📣 Some good news on the training front:
🎉 we teamed up with @gergely_kalman and by bringing in our different expertise in the field will make this training even better
🎉 we should be ready by early 2026
🎉 we aim to deliver it in 3 public conferences
🎉 first two modules are actually written
Mykola Grymalyuk retweeted
The slides to my talk "Finding Vulnerabilities in Apple Packages at Scale", which I gave at @MacDevOpsYVR and @securityfest are available on my website: theevilbit.github.io/talks/

















