Cybersecurity engineer, researcher, and advisor with broad technical and scientific experience on designing, analyzing, and testing security-critical systems.
San Diego, CA
Joined February 2008
- Tweets5.2K
- Following1.2K
- Followers2.9K
- Likes3.5K
Federico Maggi retweeted
Man the brotli thing really is way more widespread than I had realized. Lots of new detectors coming in the Tsunami scanner.
Federico Maggi retweeted
Since the @Apple Bug Bounty Program is by far the worst program I've ever hacked on, I am going to be dumping all of the data/POCs/report write ups etc for everything found during the 4 months of hacking them. This will include POCs for vulns that didnt meet their bar for a bounty so wasnt reported to them, so you may be able to find ways to escalate some of them. Ill be uploading the data all this weekend.
AI is scaling vulnerability discovery, but remediation still relies a lot on tribal knowledge and "human glue".
I don't think LLMs will fix the missing infrastructure.
The software industry & dev community spent decades building the foundations
trustial.substack.com/p/repr…
[...]
[...] that make today's AI coding agents effective.
I think vulnerability response lacks comparable infrastructure.
We need to scale context, not repeatedly reconstruct it.
Structured, reproducible, traceable vulnerability evidence should become a first-class artifact.
[...]
Many thanks to @angealbertini , @RyanNolette , Jonathan Reiter, Noah Spahn, Yuval Ostrovsky, and a dozen of anonymous.
The way #php2shell has been pre-announced is a glimpse of what the future of disclosure may be.
Heads up to the public instead of embargoes, everyone rushes to find the same vuln, patches fly in, some will get exploited earlier.
The best clankers will win the patching race.
Federico Maggi retweeted
🚨 PHP2Shell detection is now available in Burp Suite Professional & Burp Suite DAST.
Most of the web is powered by PHP, which means most of the web is vulnerable to these critical unauthenticated remote code execution flaws (CVE-2026-109618 / 109619). You can already detect it in Burp Suite using:
🟧 ActiveScan++ v2.0.13 (portswigger.net/bappstore/31…)
🟧 Bambda scan checks (github.com/PortSwigger/bambd…)
🟧 BChecks (github.com/PortSwigger/bchec…)
Start scanning for the vulnerability now → portswigger.net/bappstore/31…
Federico Maggi retweeted
Currently seeing 196.189.236[.]67 probing for the PHP vuns, suggest to block them on gateways, been hitting honeypots with a bunch of stuff since at least Oct 2.
Federico Maggi retweeted
Keeping track of all #PHP2Shell things, IOCs, log artifacts, exploitation status, patches, here: medium.com/@costin.raiu/php2…
Custom harnesses are still extremely valuable, despite frontier labs are pushing for bigger models that can one-shot complex cyber tasks. Confirmed by @unpromptedconf's analysis of 490 talks: "The work has moved from the model to the harness around it"
unpromptedcon.org/wp-content…
Offensive AI Conference (OAIC) 2026 - @OffensiveAIcon
My very unpolished takeaways straight out of day 2.
trustial.substack.com/p/offe…
⬇️ Takeaways below ⬇️
Federico Maggi retweeted
The OAIC keynote video is live!
Thank you to David Brumley for an excellent keynote, “AI Exploitation, Quantified,” and for giving us plenty to think about as frontier labs push AI’s cyber capabilities forward.
Watch here: youtu.be/HY4_9o2xPvk
Federico Maggi retweeted
I've decided to finally release my vulnerability hunting methodology that I've been using for several months now, both in testing as well as live engagements with great success.
I was inspired by (and huge congrats to) the @Blackfrost_AI team open-sourcing Cyber-Frost Harness, their reproducible security-agent runtime with procedural skills, an evidence ledger, and isolated Docker targets for red/blue/purple work. 🎉
If you like the Cyber Frost Harness, and want some out of the box vulnerabilty hunting and POC development kit to go along with it - check out my VulnHunter.
It's already loadable: their harness reads standard SKILL.md skills. Point skill_dir at VulnHunter's (or run its installer), and the hunting, falsification, and PoC disciplines load immediately.
Repo: github.com/nealbridges/VulnH…
CREDITS: This is fork of @CapitalOne original repo. I simply took it a step further on POC development and model agnostic. I'm also actively developing in my forked repo as I make more changes to it and welcome the contributions from the community as well.
I think I'm doing the whole "respect who you give credit to" drama, and I asked my model to double and triple check it. So i can blame the model if its wrong. Otherwise, dont put me on blast on X if i suck at credits. /s
Looking forward to developing on this further with the community.
- Vulnerability discovery in the age of AI is noise at industrial scale
- Custom harnesses are still extremely valuable
- Fine-grained benchmarking tells the true story and can inform RL efforts
- ...
Offensive AI Conference (OAIC) 2026 - @OffensiveAIcon
My very unpolished takeaways straight out of day 2.
trustial.substack.com/p/offe…
⬇️ Takeaways below ⬇️
Federico Maggi retweeted
Oceanside is under a heat warning this week! As always, OAIC is casual- shorts and sandals are strongly encouraged! ☀️🩴
🤖 Made with AI
I must backpedal on this. I'm re-writing some of my decision-making agents and saving LOADS of tokens:
- BEFORE: "reason on task X and create an answer that helps me decide on"
- NOW: "Jev, is this A or B?" -> "Explain Jev's answer."
Feeling bit dizzy but in awe!
Federico Maggi retweeted
The official IDA MCP is out. According to their blog, reduces token consumption by about 20% through an efficient architecture and works well with both frontier and local models. Link below.
The official IDA MCP Server is here. It's free, open source, and works with any LLM.
Your agent writes IDAPython, uses ~20% fewer tokens, and can share an IDB with you in real time.
𝚞𝚟𝚡 𝚒𝚍𝚊-𝚑𝚌𝚕𝚒 𝚖𝚌𝚙 𝚒𝚗𝚜𝚝𝚊𝚕𝚕
hex-rays.com/blog/hex-rays-i…
(copy-paste: uvx ida-hcli mcp install)
