@marver

Security Vulnerability Coach, responsible for @x41sec and @persistent_psi Tweets here are my own.

 Right here
persistent-security.net
Joined January 2009
  • Tweets8.4K
  • Following609
  • Followers3.4K
271Media
Reality check your defenses! POC collection of the Month-of-Bypasses: github.com/persistent-securi…

GitHub - persistent-security/month-of-bypasses: Proof-of-Concepts for Detection Engineering...

Proof-of-Concepts for Detection Engineering Purposes Only - persistent-security/month-of-bypasses

github.com
4
476
Markus Vervier retweeted
Joseph Thacker
@rez0__Oct 22
My non-hacking buddy asked me how much the person who found the php2shell made. Then he made a good observation: Hack a small company, make a little. Hack a big company, make a lot. Hack 70% of the world, make nothing.
34
84
12
2,881
78,459
Nemesis Team on 🔥
Nemesis | Adversarial Exposure Validation@Persistent_PsiOct 24
Great to see us featured by the @Cyber_Coalition! Our co-founder Babette De Decker spoke about her path to Nemesis, why cybersecurity needs diverse talent, and how we're making security validation accessible to all. cybersecuritycoalition.be/in… #Nemesis #ThreatToTest #Security

Babette De Decker

Babette De Decker did not have a technical background when she joined a cyber startup three years ago. Today, she is co-founder of Nemesis, a growing security validation company. Her journey points...

cybersecuritycoalition.be
133
Let’s take this flaw as an example of how to defend against 0days: First of all to set the expectations, nobody in their right mind can claim there is a 100% defense against 0days (vulnerabilities yet unknown except to some who are exploiting them)…BUT you can lower the chances of being hit! How? In this example the attack vector are the file names that can be used to inject malicious payloads. If your application uses Pillow to process images, ask yourself if this requires allowing arbitrary file names? If not then don’t do it, use a uuid as a name => this takes away the attack surface required to exploit the vuln! Doing this is the best way to reduce your exposure against yet unknown vulnerabilities!
Frank
@jedisct1Oct 23
Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image thehackernews.com/2026/10/cr…

Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image

Pillow 13.0.0 fixes EPS, JPEG, and TIFF flaws, including command execution paths involving Ghostscript and crafted image files.

thehackernews.com
1
406
Markus Vervier retweeted
Frank
@jedisct1Oct 23
Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image thehackernews.com/2026/10/cr…

Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image

Pillow 13.0.0 fixes EPS, JPEG, and TIFF flaws, including command execution paths involving Ghostscript and crafted image files.

thehackernews.com
2
5
2
16
2,515
Well…
Anthropic
@AnthropicAIOct 22
New on our Frontier Red Team blog: using Claude to formally verify software at large scale. Formal verification can prove that code is free of certain bugs, but historically it has only been feasible for small codebases (or required a lot of expert time). With AI models, however, this is beginning to change. In collaboration with @theoremlabs, we used Claude to prove security properties in over one hundred real-world open-source libraries over the span of a few weeks. Read our research in full here: anthropic.com/research/forma…

LLMs are making formal software verification feasible at a much larger scale

Claude formally proved security properties in the compiled code of 123 open-source libraries. Along the way, it found bugs that had eluded detection for years.

anthropic.com
1
2
157
We will find you some ;)
Rajashree Agrawal
@rajashreeOct 23
Making sure I state it clearly: We can literally patch and prove bug-freeness of the entire software stack running in production. With AI that exists right now for ~$100m. This means no more software-level hacks. I know it sounds too good to be true, but it isn't. AMA.
1
191
No more security bugs in software in 18 month from now? Challenge accepted, we will find you some!
Jason D. Clinton 🔸
@JasonDClintonOct 22
Replying to @RothRottweiler
vulnzero. the scaling laws will have driven cyber mythos-class capabilities into small, cheap models and all software dev everywhere will be using models for fractions of pennies on the dollar to stop shipping security bugs permanently.
1
4
196
Nikos Laleas from our team took the stage at the @netpptechnology event to show how #Nemesis runs live, continuous attacks to see what security controls actually hold up. A huge thanks to the Net++ team for putting together a great session at Hard Rock Cafe. #ThreatToTest
1
3
144
Battlestar Galactica’s has the right approach against AI hacking threats: youtu.be/OPKGbg16ulU

It's an integrated computer network and I will not have it aboard...

Roslin: It tells people things like where the restroom is, and- A...

youtube.com
114
Markus Vervier retweeted
Tolmo
@TolmoHQOct 22
"We had our hands on it, and we called it a crash." In 2024, Mihail Kirov's @Quarkslab team reported a flaw in the exact code behind PHP2Shell. Two years later, three teams turned it into a working attack in six weeks. His story: tolmo.com/blog/faster-than-a… cc: @cryptonitemmk

We can now find flaws faster than anyone can fix them · Tolmo

In 2024 our audit of PHP's core reported two flaws in the exact code behind php2shell and filed one as a crash. Two years later, three teams independently turned the same defect into a working attack...

tolmo.com
cryptonite@cryptonitemmkOct 22
A liability with a timer on it: tolmo.com/blog/faster-than-a…

We can now find flaws faster than anyone can fix them · Tolmo

In 2024 our audit of PHP's core reported two flaws in the exact code behind php2shell and filed one as a crash. Two years later, three teams independently turned the same defect into a working attack...

tolmo.com
1
4
2
6
1,341
Markus Vervier retweeted
Calif
@calif_ioOct 21
Let’s set the record straight: @lcfr_hax was the first to discover php2shell and develop a working exploit. See his August 5 tweet: xitter.cf/lcfr_hax/status/208503… His work convinced the PHP Foundation to invest in fixing this entire bug class. He then worked around the clock to review, test, and retest the patches.
LCFR
@lcfr_haxAug 5
d935be023a55b04681eccd1d2b8385b4b295e141a5df108e5e979d8d5d7124ac
54
409
93
3,084
393,178
We’ve put quite some effort into making a full AEV solution available and affordable for even smaller businesses! Including AI that can work in air gapped environments like OT and explore attack paths in safe and controlled way! 🚀
Nemesis | Adversarial Exposure Validation@Persistent_PsiOct 21
Some environments thrive in the cloud, others demand on-premise control especially in regulated sectors Nemesis handles both effortlessly by running #localAI model inside your own system. Get continuous attack validation w/o compromising on where your data lives. #ThreatToTest
112
Some environments thrive in the cloud, others demand on-premise control especially in regulated sectors Nemesis handles both effortlessly by running #localAI model inside your own system. Get continuous attack validation w/o compromising on where your data lives. #ThreatToTest
1
1
1
209
We’re heading to Techtonics! Our co-founder Babette De Decker will be there representing Nemesis, ready to catch up w familiar faces, make new connections and talk about where defenses break down. If you're attending, come say hi 👋 #Techtonics2026 #Networking #cybersecurity
🤖 Made with AI
1
1
85
Loved catching up with old friends and making new ones at @_c0c0n_ 2026! Getting such a warm welcome from Kerala Police was a highlight, along with @marver's training session. Big thanks to the organizers, volunteers and speakers for a great event 👋 #c0c0n2026 #cybersecurity
1
3
141
Wow I really managed to look like the evil red team guy in this one! 😈
benarent
@benarentOct 13
A month ago I rented an Irish Bar and hosted an AI security panel + speakeasy. Here is the 35min panel youtu.be/ShMq_vH44LU Lots of fun content here.. I've gotta put more of these on the books.

Offense vs. Defense in the Age of AI | Red Team vs. Blue Team Panel

Who has the edge in AI security when attackers and defenders have t...

youtube.com
1
201
With Uber and friends we traded conversations with drivers all over the world for lower risk of being scammed and ease of use.
182
Markus Vervier retweeted
Andrea Barisani@AndreaBarisaniOct 8
Qwen3-0.6B running happily in a bare metal Go TamaGo microVM and writing a haiku about it. This is on pure CPU with GOEXPERIMENT=simd on. Qwen3.8-27B also runs (slower) if you have enough RAM. I just need a bare metal Go GPU driver now...
3
6
419
Markus Vervier retweeted
Phrack Zine@phrackOct 6
🎉 PDF direct link here archives.phrack.org/dl/73/th…
The Hacker's Choice (@[email protected])
@hackerschoiceOct 6
Zip's (team-teso) long lost ssh1-crc32 exploit was found (xt 😘), (PLUS hellkit, 7350statd, 7350qpopper, icmp-tunnel, shellcode, lkm-work, and much more). 🚰 LEAKING phrack 73 article NOW (@phrack ): github.com/hackerschoice/tea… 🤘🤘🤘
13
1
53
3,852
Markus Vervier retweeted
Phrack Zine@phrackOct 6
One more Phrack 73 leak for you! Blueboxing Myths and Feelings: a nostalgic dive into phone phreaking’s golden age. archives.phrack.org/dl/73/bl… by @hackerschoice and @GammaTHC
2
36
1
141
7,344
Load more